6 ms·

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

by mavdi 9y ago

mixedbit 9y ago
What prevented Paypal phishing sites from buying certificates from other providers?
- mavdi 9y ago
  checks they're supposed to be performing. Some are ignoring them but being punished for it. http://www.bbc.com/news/technology-39365315 http://www.bbc.com/news/technology-39365315
  - pricechild 9y ago
    I'd definitely recommend clicking through that article and reading the source of the announcement: https://groups.google.com/a/chromium.org/forum/m/#!msg/blink-dev/eUAKwjihhBs/rpxMXjZHCQAJ https://groups.google.com/a/chromium.org/forum/m/#!msg/blink... > As captured in Chrome’s Root Certificate Policy, root certificate authorities are expected to perform a number of critical functions commensurate with the trust granted to them. This includes properly ensuring that domain control validation is performed for server certificates, to audit logs frequently for evidence of unauthorized issuance, and to protect their infrastructure in order to minimize the ability for the issuance of fraudulent certs. > On the basis of the details publicly provided by Symantec, we do not believe that they have properly upheld these principles, and as such, have created significant risk for Google Chrome users. Symantec allowed at least four parties access to their infrastructure in a way to cause certificate issuance, did not sufficiently oversee these capabilities as required and expected, and when presented with evidence of these organizations’ failure to abide to the appropriate standard of care, failed to disclose such information in a timely manner or to identify the significance of the issues reported to them. i.e. they apparently weren't even checking requesters controlled the domain they requested a certificate for in some instances!! And that's pretty much the only requirement for DV certificates? My point is that the legacy ssl providers you're referring to were doing less checks than Lets Encrypt!
  - deleted 9y ago
    [deleted]
  - detaro 9y ago
    DV certificates were never required to have different checks than what LE is doing, so what checks are you talking about?
  - pfg 9y ago
    Both Mozilla[1] and Google[2] are on the record as saying that they don't believe CAs should be the ones to detect and block domains used for phishing and malware. Both are also platinum sponsors of Let's Encrypt. [1]: https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/4Xy1Q6PHA7Y/-OcrrsTqCAAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p... [2]: https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/vMrncPi3tx8/M-U5F8K7AQAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p...
- j_s 9y ago
  The part where it wasn't scalable because it wasn't free.
treehau5 9y ago
damage they've done? Or damage phishers have done? Are we not to advance technology because some scumbags might abuse the technology?
corobo 9y ago
0.02% is a lot less than I thought there'd be. There's also nothing stopping people from buying certificates from legacy CAs, do you have the stats on how many non-letsencrypt phishing certificates there are?
agrajag 9y ago
That's .02% of all certs issued. A road might enable a bank robber to get away faster, but nobody is complaining that we shouldn't build roads because of it.
- mavdi 9y ago
  That's only Paypal :) There are hundreds more instances of abuse
  - 0xfeba 9y ago
    And 99,900,000 instances of non-abuse. A free service gets abused, surprise surprise. As LE have said, it's not their problem to solve typo-squatters, or IP infringement.
the_common_man 9y ago
I think you misunderstand how domain validated certs work. DV certs have always been issued with the simple check that you own the domain (either by email or by DNS). The email check was always a bit scary because email is so readily forgeable.
sametmax 9y ago
Damn it, those people creating those safety belts. Now drug dealers use them too and they don't die when they run away with drugs in their fast cars !
okket 9y ago
Why is nobody complaining about the fraudulent domain names and the registries that enable them? This is where the problem starts. The certificate only proves that the owner has access to the domain, nothing more.
- theandrewbailey 9y ago
  That's not going to do much, because subdomains are a thing. Aren't a lot of phishing domains like: fake-paypal.phish.com
ancarda 9y ago
Do you really think the world is worse off because of Let's Encrypt?
michaelbuckbee 9y ago
I did some work in this space. The cert authorities were never really designed to be a backstop against phishers as that threat really rose up in prominence after they were setup. And it placed them in a weird gatekeeper role. As designed, it was supposed to be that: Domain Validation (DV) certs would indicate that your connection was secure. Extended Validation (EV) certs would indicate that your connection was secure and you were connecting to the proper site. In reality, the problems with phishing and mis-issued DV certs got so bad that that issuers like GeoTrust (owned by Symantec) began keyword checking DV certs for major company trademarks, phishing targets, etc. that depending on what it was would put your through varying degrees of scrutiny. Examples: - Some used bookstore had a domain like "the-good-book.com" which got flagged for manual review b/c of the "book.com" string and so many "facebook.com" phishing attempts. - Anytime people would request certs for BMW, HBO, would trigger requests for contact information within those organizations and often a phone call from GeoTrust - It was basically impossible to get anything issued with the term "paypal", "bank" or "apple" in the domain. Please note that these were all for run of the mill - $15 single domain, DV certs. This was for a fairly high end service that required credit card accounts, etc and we still saw around 5% of requests get pulled (rightly or wrongly) into one of these manual review filters. It was a fairly unsung and unappreciated part of the what the cert issuers were doing - but it absolutely 100% helped. LetsEncrypt is forcing the Cert and Browser industry back to the original DV/EV split and it's unclear where we're going to land. Right now even technical people _trust_ the green lock and it's wildly easy to miss the fact that you're on a domain that is paypal-login-security-usa-1.com I think we're going to see a future where the browser indicators are: Red -> No SSL Gray -> DV SSL Green -> EV SSL
- catdog 9y ago
  Browsers should also completely drop that lock icon for any type of connection as it's connotated wrongly in too many heads (even for EV because what you really need to check is that it is issued to the right company).
deleted 9y ago
[deleted]
jwilk 9y ago
https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

by mavdi 9y ago

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

mixedbit 9y ago

What prevented Paypal phishing sites from buying certificates from other providers?

mavdi 9y ago
checks they're supposed to be performing. Some are ignoring them but being punished for it. http://www.bbc.com/news/technology-39365315 http://www.bbc.com/news/technology-39365315
- pricechild 9y ago
  I'd definitely recommend clicking through that article and reading the source of the announcement: https://groups.google.com/a/chromium.org/forum/m/#!msg/blink-dev/eUAKwjihhBs/rpxMXjZHCQAJ https://groups.google.com/a/chromium.org/forum/m/#!msg/blink... > As captured in Chrome’s Root Certificate Policy, root certificate authorities are expected to perform a number of critical functions commensurate with the trust granted to them. This includes properly ensuring that domain control validation is performed for server certificates, to audit logs frequently for evidence of unauthorized issuance, and to protect their infrastructure in order to minimize the ability for the issuance of fraudulent certs. > On the basis of the details publicly provided by Symantec, we do not believe that they have properly upheld these principles, and as such, have created significant risk for Google Chrome users. Symantec allowed at least four parties access to their infrastructure in a way to cause certificate issuance, did not sufficiently oversee these capabilities as required and expected, and when presented with evidence of these organizations’ failure to abide to the appropriate standard of care, failed to disclose such information in a timely manner or to identify the significance of the issues reported to them. i.e. they apparently weren't even checking requesters controlled the domain they requested a certificate for in some instances!! And that's pretty much the only requirement for DV certificates? My point is that the legacy ssl providers you're referring to were doing less checks than Lets Encrypt!
- deleted 9y ago
  [deleted]
- detaro 9y ago
  DV certificates were never required to have different checks than what LE is doing, so what checks are you talking about?
- pfg 9y ago
  Both Mozilla[1] and Google[2] are on the record as saying that they don't believe CAs should be the ones to detect and block domains used for phishing and malware. Both are also platinum sponsors of Let's Encrypt. [1]: https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/4Xy1Q6PHA7Y/-OcrrsTqCAAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p... [2]: https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/vMrncPi3tx8/M-U5F8K7AQAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p...
j_s 9y ago
The part where it wasn't scalable because it wasn't free.

treehau5 9y ago

damage they've done? Or damage phishers have done? Are we not to advance technology because some scumbags might abuse the technology?

corobo 9y ago

0.02% is a lot less than I thought there'd be. There's also nothing stopping people from buying certificates from legacy CAs, do you have the stats on how many non-letsencrypt phishing certificates there are?

agrajag 9y ago

That's .02% of all certs issued. A road might enable a bank robber to get away faster, but nobody is complaining that we shouldn't build roads because of it.

mavdi 9y ago
That's only Paypal :) There are hundreds more instances of abuse
- 0xfeba 9y ago
  And 99,900,000 instances of non-abuse. A free service gets abused, surprise surprise. As LE have said, it's not their problem to solve typo-squatters, or IP infringement.

the_common_man 9y ago

I think you misunderstand how domain validated certs work. DV certs have always been issued with the simple check that you own the domain (either by email or by DNS). The email check was always a bit scary because email is so readily forgeable.

sametmax 9y ago

Damn it, those people creating those safety belts. Now drug dealers use them too and they don't die when they run away with drugs in their fast cars !

okket 9y ago

Why is nobody complaining about the fraudulent domain names and the registries that enable them? This is where the problem starts. The certificate only proves that the owner has access to the domain, nothing more.

theandrewbailey 9y ago
That's not going to do much, because subdomains are a thing. Aren't a lot of phishing domains like: fake-paypal.phish.com

ancarda 9y ago

Do you really think the world is worse off because of Let's Encrypt?

michaelbuckbee 9y ago

I did some work in this space. The cert authorities were never really designed to be a backstop against phishers as that threat really rose up in prominence after they were setup. And it placed them in a weird gatekeeper role. As designed, it was supposed to be that: Domain Validation (DV) certs would indicate that your connection was secure. Extended Validation (EV) certs would indicate that your connection was secure and you were connecting to the proper site. In reality, the problems with phishing and mis-issued DV certs got so bad that that issuers like GeoTrust (owned by Symantec) began keyword checking DV certs for major company trademarks, phishing targets, etc. that depending on what it was would put your through varying degrees of scrutiny. Examples: - Some used bookstore had a domain like "the-good-book.com" which got flagged for manual review b/c of the "book.com" string and so many "facebook.com" phishing attempts. - Anytime people would request certs for BMW, HBO, would trigger requests for contact information within those organizations and often a phone call from GeoTrust - It was basically impossible to get anything issued with the term "paypal", "bank" or "apple" in the domain. Please note that these were all for run of the mill - $15 single domain, DV certs. This was for a fairly high end service that required credit card accounts, etc and we still saw around 5% of requests get pulled (rightly or wrongly) into one of these manual review filters. It was a fairly unsung and unappreciated part of the what the cert issuers were doing - but it absolutely 100% helped. LetsEncrypt is forcing the Cert and Browser industry back to the original DV/EV split and it's unclear where we're going to land. Right now even technical people _trust_ the green lock and it's wildly easy to miss the fact that you're on a domain that is paypal-login-security-usa-1.com I think we're going to see a future where the browser indicators are: Red -> No SSL Gray -> DV SSL Green -> EV SSL

catdog 9y ago
Browsers should also completely drop that lock icon for any type of connection as it's connotated wrongly in too many heads (even for EV because what you really need to check is that it is issued to the right company).

deleted 9y ago

[deleted]

jwilk 9y ago

https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html