10 ms·

Here, I have an idea for how to sell this to the CAs: establish a perceptual distance metric, and the larger a perceptual distance "moat" a customer wants, the

Here, I have an idea for how to sell this to the CAs: establish a perceptual distance metric, and the larger a perceptual distance "moat" a customer wants, the more you charge them. then if the customer is google.com, and they've paid for a moat of width 5, and somebody tries to register these domains: domain distance ===================== google.com 0 google.co 1 goegle.com 1 gargle.com 4 gaggle.com 9 example.com 40 then all those with distance <= 5 will get flagged for manual review and the CA will offer google a chance to +1 or -1 it. The person trying to register goegle.com can show trademark paperwork to try to override the -1 decision. OK this is actually not a great idea (too easy to abuse). But what else are all those sweet, sweet EV cert fees going towards?

tracker1 9y ago
Actually, allow the registration of up to 5 distance, including xn--* tlds translated... then require anyone registering closer than that to have an EV cert... Have the price set to $20K-$100K/year per order of distance. For a banking establishment, or mega site, it should be reasonable. The option for anyone too close would be to get an EV cert... also requiring EV for any domain within a distance of 4 to alexa top 100, 3 to the alexa top 1000 and 2 to the top 10000 would be a good start.
- infogulch 9y ago
  This sounds awesome. Should greatly help against the biggest phishing threats, and seems fair for both sides without getting lawyers involved. My question is how would registrars coordinate this?
  - philsnow 9y ago
    > My question is how would registrars coordinate this? A few of them get together and make a pact about how to measure similarity, then convince browser vendors to treat their certificates specially (triple padlocks!! 3 > 1, must be safer!!)?

tracker1 9y ago

Actually, allow the registration of up to 5 distance, including xn--* tlds translated... then require anyone registering closer than that to have an EV cert... Have the price set to $20K-$100K/year per order of distance. For a banking establishment, or mega site, it should be reasonable. The option for anyone too close would be to get an EV cert... also requiring EV for any domain within a distance of 4 to alexa top 100, 3 to the alexa top 1000 and 2 to the top 10000 would be a good start.

infogulch 9y ago
This sounds awesome. Should greatly help against the biggest phishing threats, and seems fair for both sides without getting lawyers involved. My question is how would registrars coordinate this?
- philsnow 9y ago
  > My question is how would registrars coordinate this? A few of them get together and make a pact about how to measure similarity, then convince browser vendors to treat their certificates specially (triple padlocks!! 3 > 1, must be safer!!)?