4 ms·
The scheme is very elaborate, multi-step process so the risk is quite low. Once in motion it is nearly impossible to prevent by a bank, but it would be triviall
by mamon 9y ago
The scheme is very elaborate, multi-step process so the risk is quite low. Once in motion it is nearly impossible to prevent by a bank, but it would be trivially preventable by Facebook, if they just bothered to check the url and warn if they find them suspicious.
EDIT:
BTW this shows that sites like Let's Encrypt, which automatically issue certificates to websites kind of defeat the whole purpose of certificates - they only check that the site exists and requestor has admin access to it, but do nothing to check whether it is legitimate business or scam.
A green padlock in the address bar should mean that the site is trustworthy. Now it only means that site admin knows how to setup https.
- zeta0134 9y agoSure, in theory, but how do you solve a problem like this in practice? What is it about a given URL that makes it suspicious? Is there a whitelist? Because then the press and the rest of the internet will cry censorship and stifling of innovation. Is there an algorithm? Then the scammers simply learn how to game the algorithm and defeat it easily. (This applies to some easy checks like domain registration date too.) Is it a team of humans? That's a lot of sites and a lot of humans to employ. What about user-reports? Now you have to deal with false reporting and abuse. While it's possible for some combination of approaches to succeed here, it's not nearly trivial.
- deleted 9y ago[deleted]
- ecesena 9y agoMost importantly, how could you create a trustworthy online business like an ecommerce, if you can't get an https site until you're trustworthy?
- andrewflnr 9y agoTrustworthiness of the organization behind a site is only half the story behind TLS, if that. The most important benefit IMO of secure connections is that some unknown-unknown party can't MitM your connection and read your data or inject malicious code. Trust in the intended participants in the conversation is really a different problem. The problem with your scenario where https===trustworthy is that it doesn't leave any middle ground for a site to simply protect its and your information. It's either full bank-site security, or none at all. That's not acceptable.
- benchaney 9y ago> A green padlock in the address bar should mean that the site is trustworthy. Now it only means that site admin knows how to setup https. The green padlock means that you have a secure connection to the site you have selected to visit. We should not attempt to ascribe any other meaning to it.
- cm2187 9y agoThe padlock (even an EV padlock) doesn't (and cannot) claim that the website is honest. It claims the website is who it says it is and that no one can intercept the communications between you two.
- closeparen 9y agoYou are deeply mistaken on the purpose of certificates. They say that the holder of the corresponding private key is who they are say they are. DV checks the DNS name, EV checks the DNS name and the presence of a business registration with the relevant authority. The purpose of certificates has never been a "not a scam" stamp, and no traditional certificate vendor was ever checking your business practices or legitimacy. Issuance of DV certs is just as automated at Verisign, etc.
- deleted 9y ago[deleted]
- erpellan 9y agoThis problem was solved in 1999 with client-side certificates. Your browser would simply refuse to log you into the fake bank site.
- kahnpro 9y agoIt sounds like you fundamentally misunderstood what HTTPS certificates are for, because they absolutely do not reflect trustworthiness or "not a scam".