3 ms·
I agreed with you right up until this sentence: > CAs need to do more and browser vendors should expect them to if they want to be included in the default bund
by Ajedi32 9y ago
I agreed with you right up until this sentence:
> CAs need to do more and browser vendors should expect them to if they want to be included in the default bundle.
CAs _should not_ be expected to validate anything about a domain name other than who controls it (at least for DV certs). That's not their job, nor should it be.
First, it's not nearly as simple as blacklisting domains containing "PayPal" or "Gmail". What if, for example, someone wants to register a domain like "paypal-sucks.com" and use that to express their distaste for PayPal's business practices? Should they not be allowed to do that?
And what about wildcard certs? `*.some-site.com` matches `paypal.some-site.com` just as easily as it does `forum.some-site.com`. Do you expect CAs to police that somehow?
- ams6110 9y agoYou and I understand this. Most paypal users do not. That's why they keep getting phished even when their browser says they are on a "Secure" site. Maybe it would help to have something between the green "Secure" and the red "Danger! Stop!", e.g. an amber "warning" symbol implying that "You're connected to the site your browser is showing, but be sure it's the site you think it is." Sadly in reality I don't think that would go very far to solving the problem.
- Ajedi32 9y agoThe problem with showing a warning like that on every site you visit is that users will quickly become used to it and start ignoring it as a result. (Alarm fatigue) Warnings are only useful if they're shown rarely enough for users to take note of them as an unusual event when they do occur.