3 ms·

I think that's only true if your trust system recognizes the attacking key as valid for the destination. DV seems to prevent that, absent typo squatting.

by ynniv 9y ago

dogecoinbase 9y ago
tptacek is referring to the chain of trust that's used to validate that the issuer for a DV certificate is someone we trust to perform DV.
tptacek 9y ago
I'm not arguing that we have the optimal trust system now. I'm saying that the argument that we should have started with "privacy" for everyone and made trust optional is invalid. A different key infrastructure may very well have been better than the X.509 PKI! But not having any identity in the system is an unrealistic goal.
wbond 9y ago
Whenever dealing with financial websites, I am always extremely suspicious of a website that does not have an EV certificate because of the added level of scruitiny applied to such certs. The number of mis-issued DV certs, and typos means that it would be relatively easy to enter banking credentials to a well-executed phishing site. It is going to be a lot harder to get an EV cert issued to paypa1.com with “PayPal, Inc. [US]” as the organization. The only website that I regularly have anxiousness about entering my credentials on are Google properties. Since email can be used to reset pretty much anything, Google is one of the most important set of credentials to prevent falling into the wrong hands. Unfortunately they don’t seem to care about EV certs. Additionally, app-based OAuth screens with web login prompts regularly give me pause. I don’t like not being able to see the URL and certificate information.
- tracker1 9y ago
  It's funny, but this is where having a password manager really saves me... if I don't have a login for a site I use often, I'll really scrutinize it... sometimes login urls change, but not very often.

3 ms·

I think that's only true if your trust system recognizes the attacking key as valid for the destination. DV seems to prevent that, absent typo squatting.

by ynniv 9y ago

I think that's only true if your trust system recognizes the attacking key as valid for the destination. DV seems to prevent that, absent typo squatting.

dogecoinbase 9y ago
tptacek is referring to the chain of trust that's used to validate that the issuer for a DV certificate is someone we trust to perform DV.
tptacek 9y ago
I'm not arguing that we have the optimal trust system now. I'm saying that the argument that we should have started with "privacy" for everyone and made trust optional is invalid. A different key infrastructure may very well have been better than the X.509 PKI! But not having any identity in the system is an unrealistic goal.
wbond 9y ago
Whenever dealing with financial websites, I am always extremely suspicious of a website that does not have an EV certificate because of the added level of scruitiny applied to such certs. The number of mis-issued DV certs, and typos means that it would be relatively easy to enter banking credentials to a well-executed phishing site. It is going to be a lot harder to get an EV cert issued to paypa1.com with “PayPal, Inc. [US]” as the organization. The only website that I regularly have anxiousness about entering my credentials on are Google properties. Since email can be used to reset pretty much anything, Google is one of the most important set of credentials to prevent falling into the wrong hands. Unfortunately they don’t seem to care about EV certs. Additionally, app-based OAuth screens with web login prompts regularly give me pause. I don’t like not being able to see the URL and certificate information.
- tracker1 9y ago
  It's funny, but this is where having a password manager really saves me... if I don't have a login for a site I use often, I'll really scrutinize it... sometimes login urls change, but not very often.