3 ms·

If you think the typical paypal user will understand the difference between "Secure", "Private", and "Encrypted" I would beg to differ. CAs who issue certifica

• stordoff 9y ago
  But wouldn't doing that be a _huge_ hurdle to Let's Encrypt/certification automation more generally? I'd not sure that would be a net positive.
• pfg 9y ago
  What are your thoughts on a CA issuing a wildcard certificate for: *.com.removed-limits.com Blocking the string "paypal" would prevent issuance for phishing sites for maybe a day. After that, they'd have all migrated to "payypal" or "paypel", which would still be more than sufficient. And if that stops working too, well, good luck with wildcards! Not to mention that in an HTTPS-only world, CAs would have full control over which domains are permitted on the web. Is introducing a semi-centralized content police really a good trade-off just to prevent phishing, or shouldn't we look into how we can prevent phishing using other means (U2F, webauthn) and focus on moving to negative-only security indicators (where HTTPS becomes the default, with no security indicator)?
• peterwwillis 9y ago
  A CA is just someone who verifies a cert was signed by a key that they know about. Their only purpose is to show your connection wasn't MITM'd. They have nothing to do with figuring out if you're being phished.