4 ms·

I wonder what the solution to this can be. Should the CA prevent people from getting certificates for domains containing the names of 'big' websites and corpor

I wonder what the solution to this can be. Should the CA prevent people from getting certificates for domains containing the names of 'big' websites and corporations? Should browsers make it more obvious that the website has an EV certificate? Maybe also try to detect phishing URLs?

tyingq 10y ago
There is some precedent for similar situations, where entities like domain registrars are named/shamed for not trying to filter shady looking stuff. Personally, I don't see how it makes sense for a domain registrar, CA, web hosting provider, etc, to have to figure this out, but... - Legitscript, some kind of consortium meant to block internet sales of pharma products named/shamed a domain registrar https://www.legitscript.com/blog/2012/12/internet-bs-domain-name-registrar-does-180-internet-pharmacy-crime/ https://www.legitscript.com/blog/2012/12/internet-bs-domain-... - Markmonitor, some service sold to big brands to protect their brands, also does some name/shame type reports: http://www.circleid.com/posts/best_worst_phishing_domain_registrars/ http://www.circleid.com/posts/best_worst_phishing_domain_reg... Some approaches to detecting it exist, like this "deceptive domain" score from Netcraft: https://www.netcraft.com/anti-phishing/deceptive-domain-score/ https://www.netcraft.com/anti-phishing/deceptive-domain-scor... I assume, though, they are just doing some fancy string matching with a few other features (character lookalikes, xlate to punycode, etc). I imagine that both the "false positive" and "false negative" rates are pretty bad.
peterwwillis 10y ago
There's one aspect, connection security, which either you have or you don't have. There's no useful purpose to an icon which is always there and people can then ignore. For practical purposes, browsers should only inform people when their connection is not secure, so people can assume security the rest of the time. Then there's the other aspect, identity. Is this really PayPal? Honestly, most users will never be able to notice if it's not. Who cares what host is in the address bar, or if it has a valid cert, or if it's plain http? Average users don't scrutinize these things because they don't know what a certificate is, or encryption, or how domains or web pages work. If it looks like Paypal, they assume it is. EV certificates have always been a scam. I don't think users know they exist, and I don't notice at all when I am on a site that uses one, unless I look really hard and click some buttons and read around. Even when I do (in Firefox, for example), no part of the UI explains to me that this company paid for an expensive process to prove this website is owned by this legal company. It just says "This is Bank of America Corporation (US), verified by xyz". Well, yeah, I would have assumed it was anyway, and I don't know what "verifying" implies. On an identical site without an EV using a phishing domain, it would simply not have this information, and nothing would seem amiss to me at all. So EV does nothing for me as a user. What is more useful are apps. Apps in an app store do tend to pop up the most authentic result first. You can see this app is Bank of America, and the app was made by Bank of America Corp. Seems legit. If a phishing site popped up a phishing app, and it wasn't made by Bank of America Corp, I might be suspicious enough to double check it before installing it, but maybe not. If the first time I visit a website the browser displayed some information about the domain, certificate, etc, that would be similar to what the app store does. "This is Bank of America website, owned by Bank of America company, and we legally verified it with X verifier." Or, "This is Bank of America website, it has not been legally verified". Or, "This website is Bank of America, and is registered and geo-located in Lithuania". That would seem odd. Another failure of browsers: I just visited https://www.bankofamerica.com/ https://www.bankofamerica.com/, right cliked, clicked View Page Info, and then clicked the Security tab. (Honestly that's way too many clicks, and too hidden) It says "Have I visited this website prior to today? No." Which I don't think is true actually, but anyway, it at least is one hint that maybe I should be suspicious. I think the browser should provide a button called "Identify" that when you click it, it tries to give you an idea of how much you can trust this page. Show me who owns the domain, the DNS, Geolocation, EV information, the URL, have I been here before, does it match any tracked lists of malware URLs, is it in an IP pool commonly used for cybercrime, etc. Everything I need to get a feeling for if it's trustworthy. And specifically, throw up red flags where something might not be 100% trustworthy. I probably do not care if abcnews.com is not 100% trustworthy, but I do care if Paypal is, so I want a button I can press that will tell me if it isn't.
- grenoire 10y ago
  I do agree for the most part, except for the use of the words 'trust' and 'trustworthy.' 'Authentic' is a better one I'd say.
  - peterwwillis 10y ago
    Ok, so that's a third thing: security, authenticity, and trust. (I would probably rename "authentic" to "real" to be more intuitive) A "Scan your PC now for viruses!" website that is exactly who they say they are may be authentic, but not trustworthy, as some steal your identity. That is probably already handled by Google Safe Browsing, though.

tyingq 10y ago

There is some precedent for similar situations, where entities like domain registrars are named/shamed for not trying to filter shady looking stuff. Personally, I don't see how it makes sense for a domain registrar, CA, web hosting provider, etc, to have to figure this out, but... - Legitscript, some kind of consortium meant to block internet sales of pharma products named/shamed a domain registrar https://www.legitscript.com/blog/2012/12/internet-bs-domain-name-registrar-does-180-internet-pharmacy-crime/ https://www.legitscript.com/blog/2012/12/internet-bs-domain-... - Markmonitor, some service sold to big brands to protect their brands, also does some name/shame type reports: http://www.circleid.com/posts/best_worst_phishing_domain_registrars/ http://www.circleid.com/posts/best_worst_phishing_domain_reg... Some approaches to detecting it exist, like this "deceptive domain" score from Netcraft: https://www.netcraft.com/anti-phishing/deceptive-domain-score/ https://www.netcraft.com/anti-phishing/deceptive-domain-scor... I assume, though, they are just doing some fancy string matching with a few other features (character lookalikes, xlate to punycode, etc). I imagine that both the "false positive" and "false negative" rates are pretty bad.

peterwwillis 10y ago

There's one aspect, connection security, which either you have or you don't have. There's no useful purpose to an icon which is always there and people can then ignore. For practical purposes, browsers should only inform people when their connection is not secure, so people can assume security the rest of the time. Then there's the other aspect, identity. Is this really PayPal? Honestly, most users will never be able to notice if it's not. Who cares what host is in the address bar, or if it has a valid cert, or if it's plain http? Average users don't scrutinize these things because they don't know what a certificate is, or encryption, or how domains or web pages work. If it looks like Paypal, they assume it is. EV certificates have always been a scam. I don't think users know they exist, and I don't notice at all when I am on a site that uses one, unless I look really hard and click some buttons and read around. Even when I do (in Firefox, for example), no part of the UI explains to me that this company paid for an expensive process to prove this website is owned by this legal company. It just says "This is Bank of America Corporation (US), verified by xyz". Well, yeah, I would have assumed it was anyway, and I don't know what "verifying" implies. On an identical site without an EV using a phishing domain, it would simply not have this information, and nothing would seem amiss to me at all. So EV does nothing for me as a user. What is more useful are apps. Apps in an app store do tend to pop up the most authentic result first. You can see this app is Bank of America, and the app was made by Bank of America Corp. Seems legit. If a phishing site popped up a phishing app, and it wasn't made by Bank of America Corp, I might be suspicious enough to double check it before installing it, but maybe not. If the first time I visit a website the browser displayed some information about the domain, certificate, etc, that would be similar to what the app store does. "This is Bank of America website, owned by Bank of America company, and we legally verified it with X verifier." Or, "This is Bank of America website, it has not been legally verified". Or, "This website is Bank of America, and is registered and geo-located in Lithuania". That would seem odd. Another failure of browsers: I just visited https://www.bankofamerica.com/ https://www.bankofamerica.com/, right cliked, clicked View Page Info, and then clicked the Security tab. (Honestly that's way too many clicks, and too hidden) It says "Have I visited this website prior to today? No." Which I don't think is true actually, but anyway, it at least is one hint that maybe I should be suspicious. I think the browser should provide a button called "Identify" that when you click it, it tries to give you an idea of how much you can trust this page. Show me who owns the domain, the DNS, Geolocation, EV information, the URL, have I been here before, does it match any tracked lists of malware URLs, is it in an IP pool commonly used for cybercrime, etc. Everything I need to get a feeling for if it's trustworthy. And specifically, throw up red flags where something might not be 100% trustworthy. I probably do not care if abcnews.com is not 100% trustworthy, but I do care if Paypal is, so I want a button I can press that will tell me if it isn't.

grenoire 10y ago
I do agree for the most part, except for the use of the words 'trust' and 'trustworthy.' 'Authentic' is a better one I'd say.
- peterwwillis 10y ago
  Ok, so that's a third thing: security, authenticity, and trust. (I would probably rename "authentic" to "real" to be more intuitive) A "Scan your PC now for viruses!" website that is exactly who they say they are may be authentic, but not trustworthy, as some steal your identity. That is probably already handled by Google Safe Browsing, though.