9 ms·

A DV cert from letsencrypt means you have provided some bare minimum of evidence that you control the domain in question. That's it. Most people don't understan

A DV cert from letsencrypt means you have provided some bare minimum of evidence that you control the domain in question. That's it. Most people don't understand that. They just think "https == good" and it's taken years just to get to that point. CAs need to do more and browser vendors should expect them to if they want to be included in the default bundle. CAs should not be issuing certificates for any name that contains components like "paypal.com" or "google" or "gmail" Yeah it's kind of a game of whack-a-mole but at least get the low-hanging fruit.

Ajedi32 9y ago
I agreed with you right up until this sentence: > CAs need to do more and browser vendors should expect them to if they want to be included in the default bundle. CAs _should not_ be expected to validate anything about a domain name other than who controls it (at least for DV certs). That's not their job, nor should it be. First, it's not nearly as simple as blacklisting domains containing "PayPal" or "Gmail". What if, for example, someone wants to register a domain like "paypal-sucks.com" and use that to express their distaste for PayPal's business practices? Should they not be allowed to do that? And what about wildcard certs? `*.some-site.com` matches `paypal.some-site.com` just as easily as it does `forum.some-site.com`. Do you expect CAs to police that somehow?
- ams6110 9y ago
  You and I understand this. Most paypal users do not. That's why they keep getting phished even when their browser says they are on a "Secure" site. Maybe it would help to have something between the green "Secure" and the red "Danger! Stop!", e.g. an amber "warning" symbol implying that "You're connected to the site your browser is showing, but be sure it's the site you think it is." Sadly in reality I don't think that would go very far to solving the problem.
  - Ajedi32 9y ago
    The problem with showing a warning like that on every site you visit is that users will quickly become used to it and start ignoring it as a result. (Alarm fatigue) Warnings are only useful if they're shown rarely enough for users to take note of them as an unusual event when they do occur.

Ajedi32 9y ago

I agreed with you right up until this sentence: > CAs need to do more and browser vendors should expect them to if they want to be included in the default bundle. CAs _should not_ be expected to validate anything about a domain name other than who controls it (at least for DV certs). That's not their job, nor should it be. First, it's not nearly as simple as blacklisting domains containing "PayPal" or "Gmail". What if, for example, someone wants to register a domain like "paypal-sucks.com" and use that to express their distaste for PayPal's business practices? Should they not be allowed to do that? And what about wildcard certs? `*.some-site.com` matches `paypal.some-site.com` just as easily as it does `forum.some-site.com`. Do you expect CAs to police that somehow?

ams6110 9y ago
You and I understand this. Most paypal users do not. That's why they keep getting phished even when their browser says they are on a "Secure" site. Maybe it would help to have something between the green "Secure" and the red "Danger! Stop!", e.g. an amber "warning" symbol implying that "You're connected to the site your browser is showing, but be sure it's the site you think it is." Sadly in reality I don't think that would go very far to solving the problem.
- Ajedi32 9y ago
  The problem with showing a warning like that on every site you visit is that users will quickly become used to it and start ignoring it as a result. (Alarm fatigue) Warnings are only useful if they're shown rarely enough for users to take note of them as an unusual event when they do occur.