4 ms·
I'm not sure what's the outrage is about here. If they don't say PayPal before the URL, as PayPal's EV certificate does, then why does it matter that Let's Encr
by mtgx 10y ago
I'm not sure what's the outrage is about here. If they don't say PayPal before the URL, as PayPal's EV certificate does, then why does it matter that Let's Encrypt issued SSL certs to websites that have PayPal in their names?
By that logic, I would much sooner be outraged at registrars for allowing those guys to obtain domain names that put the PayPal name in the address bar. But of course even that is a silly argument, as it's not the registrar's job to enforce trademark protection for any company.
- catdog 10y agoYou are exactly right, not sure why you get down voted. Let's Encrypt does domain validation. It's perfectly fine that it issues a certificate to paypal.com.phishysite.com to the rightful owner of phishysite.com. It's not their fault that some people do not grasp what that type of certificate (which is nothing new) assures and what not. If you really want blame someone you have to blame browser vendors for not making it clear enough inside their UI. //edit: Trademark protection gets even easier as CT logs present such potential violations on a silver plate.