8 ms·
And they're using an Extended Validation certificate from DigiCert for it CN = nytimes3xbfgragh.onion OU = Technology O = The New York Times Compan
by blfr 9y ago
And they're using an Extended Validation certificate from DigiCert for it
CN = nytimes3xbfgragh.onion
OU = Technology
O = The New York Times Company
Object Identifier (2 5 4 15) = Private Organization
along with some other addresses
DNS Name: nytimes3xbfgragh.onion
DNS Name: graylady3jvrrxbe.onion
DNS Name: *.graylady3jvrrxbe.onion
DNS Name: *.dev.graylady3jvrrxbe.onion
DNS Name: *.stg.graylady3jvrrxbe.onion
DNS Name: *.nytimes3xbfgragh.onion
DNS Name: *.api.nytimes3xbfgragh.onion
DNS Name: *.api.dev.nytimes3xbfgragh.onion
DNS Name: *.api.stg.nytimes3xbfgragh.onion
DNS Name: *.blogs.nytimes3xbfgragh.onion
DNS Name: *.blogs.stg.nytimes3xbfgragh.onion
DNS Name: *.blogs5.stg.nytimes3xbfgragh.onion
DNS Name: *.dev.nytimes3xbfgragh.onion
DNS Name: *.dev.blogs.nytimes3xbfgragh.onion
DNS Name: *.newsdev.nytimes3xbfgragh.onion
DNS Name: *.prd.nytimes3xbfgragh.onion
DNS Name: *.sbx.nytimes3xbfgragh.onion
DNS Name: *.stg.nytimes3xbfgragh.onion
DNS Name: *.stg.blogs.nytimes3xbfgragh.onion
DNS Name: *.stg.newsdev.nytimes3xbfgragh.onion
DNS Name: www.bestsellers.nytimes3xbfgragh.onion
DNS Name: www.homedelivery.nytimes3xbfgragh.onion
- Izmaki 9y agoWhat does this mean in regular human terms?
- belorn 9y agoExtended Validation certificate is when a company go to a CA and provide a bunch of business documents and legal proof that they really own the company behind a name. Its not a technical aspect but human lawyer <-> human lawyer that establish a certificate. At the end if the validation is successful, the company get a technical signed document that in browsers shows up as a green lock and the name in green next to the URL.
- colejohnson66 9y agoSo in addition to knowing that your browser is connected to where you want, you now know that the website you want is actually who they say they are?
- yourself92 9y agoExactly
- kzrdude 9y agoOf course you also need a browser and/or OS to establish the roots of the trust relations.
- gcb0 9y ago...and hope symantec/komodo/et al won't start selling those certs by the bucket.
- forapurpose 9y ago> you now know that the website you want is actually who they say they are? That's the idea. Of course, validation, while more thorough than for standard certs, still is not that reliable. My strong impression is that it could be fooled by anyone sufficiently motivated.
- peterwwillis 9y agoNot only that - in practice it's kind of meaningless, because if you were served a non-EV cert, you wouldn't notice. And there's usually other domains or subdomains that don't use the EV cert. It's mostly just a kind of token gesture by a business to claim they're more secure.
- easyroot 9y agoEV is part of a narrative. Which has some value, even if weak.
- athenot 9y ago> "a bunch of business documents and legal proof" In my case they just needed me to put an entry in the Yellow Pages...
- icebraining 9y agoWhich CA?
- deleted 9y ago[deleted]
- athenot 9y agoErrata: sorry I went back and checked and I believe they also required some proof of incorporation. My apologies for the incorrect cynicism. :(
- DonHopkins 9y agoDon't forget to restart your ypserver! Also, never put this line in /etc/netgroup then rwall to it: universal (,,) http://www-mice.cs.ucl.ac.uk/multimedia/misc/tcp_ip/8702.mm.www/0310.html http://www-mice.cs.ucl.ac.uk/multimedia/misc/tcp_ip/8702.mm....
- kurusii 9y agoThat was a fun read. Thanks for the link. On a somewhat related topic, I worry a lot about things on the internet disappearing, most often simply due to neglect (domain expiry, companies being bought, et c.) I try to save everything I can that I find interesting, in fear of it never being available again. That said, it makes me very happy to see emails from 1987 archived online--so happy that I've even saved a copy.
- acchow 9y agoWhy do we think a lawyer would be less likely to be duped? If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake?
- JumpCrisscross 9y ago> If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake? Lawyers are good at verifying identities. It's a core part of their work. More critically, in-person fraud scales differently from electronic fraud.
- frank_abagnale 9y agohttps://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale
- blfr 9y agoYou get a green bar to know you're connecting to the NYT and the cert is issued for many additional addresses showing large coverage of their services and hinting at future use.
- 0xfeba 9y agoEV certs provide more than just encryption that a DV (domain validation) cert provides. DV just checks to make sure the domain is under control of whoever is asking for the cert. EV ensures that the entity (person, corp, org, whatever) is in fact in control of the domain and is who they say they are.
- andimm 9y agoI liked this post on EV certificates: https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas-phishing-lets-encrypt/ https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...
- Ajedi32 9y agoWorth noting that a lot of the arguments in this article change when you're talking about Onion services. Notably, Onion services tend to have URLs that are _very_ difficult for humans to remember (they're essentially just gibberish), and they're anonymous by default, meaning without an EV cert there's no easy way to check whether the service you're visiting is legitimate or not. DV certs are also pretty useless for Onion services, since your connection is already encrypted and authenticated by Tor.
- nailer 9y agoEV is mandatory for .onion HTTPS certificates - since onion hashes (the 'domain name') are even less meaningful as a form of identity than regular domains. There's a couple of other differences with .onion certs too: https://certsimple.com/help/tor-support https://certsimple.com/help/tor-support
- dublinben 9y agoThis is incorrect. Onion domain addresses already provide the same level of confidence as a DV certificate, because they are a public key of the server you are connecting to. There would be no additional value in issuing a DV certificate for an .onion domain.
- secabeen 9y agoYes, but how do you know that you are actually connected to nytimes3xpfgragh.onion each time? DV lets you know that the onion site you connected to is the NYTimes, and not a privacy-attacking MITM site. Did you notice that I changed the nytimes URL a tiny bit up there? nytimes3xbfgragh.onion is the real one. (Yes, there's no guarantee that someone else would be able to generate a specific alternate address, but one that also starts with nytimes is probably possible for a well-resourced attacker.)
- dublinben 9y agoDV lets you know that you're connecting to the domain that you're connecting to. You already know that with all onion addresses. EV lets you assure that you are connected to the New York Times.
- feelin_googley 9y agohttps://crt.sh/?id=240277340 https://crt.sh/?id=240277340
- Ajedi32 9y agoAny idea why it was revoked?
- JoshTriplett 9y agoSometimes I wonder if it's a good idea to brute-force these kinds of "vanity" onion prefixes. Take a look at the addresses used in http://incoherency.co.uk/blog/stories/hidden-service-phishing.html http://incoherency.co.uk/blog/stories/hidden-service-phishin... ; they brute-forced the same prefix with a different suffix. Would anyone really notice?
- chrisfosterelli 9y agoIf they didn't use vanity names, then people would only remember the first/last few random characters and the phishing scheme could very well still work, just it'd be less readable for visitors. I don't think we can assume that if all the characters were random they would remember them all better.
- JoshTriplett 9y agoI don't think people would remember them better if completely random. Rather, I think if they're completely random, people might correctly assume they can't, and remain appropriately skeptical; if they include a vanity prefix, people seem likely to remember the vanity prefix and somewhat less likely to pay attention to the rest.
- corobo 9y agoCan you CNAME with onion domains? For example onion.nytimes.com CNAME nytimes3xbfgragh.onion Edit to clarify - more a technical pondering than a solution to anything
- Ajedi32 9y ago.onion addresses aren't resolved using the DNS system. So... no? I guess in theory a browser _could_ support something like that, but it'd be pretty unusual. I also think the idea of relying on DNS to resolve a hidden service would defeat a lot of the privacy and security guarantees associated with those services, so I don't think any browser serious about security would implement something like that.
- deleted 9y ago[deleted]