6 ms·

Check it out here: https://stripe.ian.sh/ https://stripe.ian.sh/ - it has an EV cert that makes the browser show "Stripe, Inc" next to the padlock.

anc84 9y ago
That should be the submission, it is very well written and detailed.
- samwillis 9y ago
  It was submitted (https://news.ycombinator.com/item?id=15902848 https://news.ycombinator.com/item?id=15902848) but in the middle of the night US/EU so dropped off the new list... Quite often the mods will combine/replace a thread when this happens.
NelsonMinar 9y ago
I love this quote: 'this site uses an EV certificate for "Stripe, Inc", that was legitimately issued by Comodo'. Comodo has been responsible for a bunch of SSL-related security fiascos over the year. https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies
- gruez 9y ago
  but in this case, what is Comodo supposed to do? For a generic name such as "stripe", are other (less famous) "stripe" companies, are they out of luck if they want a EV certificate?
  - pishpash 9y ago
    Maybe it's time to put all the certification documentation into the certificate so they can be retrieved and viewed by anyone. Registration, signatures, payments, proofs, etc. Why does only the CA get to see it? Everyone should be able to see.
    - tinus_hn 9y ago
      The information you need is in the certificate. The problem is it doesn’t fit in the UI.
    - tialaramex 9y ago
      Depending on the certificate, this could be quite a lot of data, the certificate is delivered on every new connection, right now they're commonly a kilobyte or so of data. For a typical DV certificate, maybe the CA has done 3.2.2.4.6, so they have a log showing the DNS look-up they did from first principles (so it's the whole thing from the root, not just a cached single entry), then the HTTP transaction, with the Request Token inside it, and they've matched the Request Token against the expected value. That could easily be several kilobytes. The CA is required to store this, but burning it into the certificate is extra data all so that what, one person in a million can look at it, and go "Eh, that looks roughly like I'd expect" ? For an EV certificate there's going to be stuff they found in a government data source, then the stuff from Dun & Bradstreet, then... what maybe a WAV file of a phone call to the number listed in D&B? PDF scans of headed notepaper? And it tells you... somebody, somewhere said this was fine. So what? As I've stated on m.d.s.policy the ability to make companies in the US and UK that can't be traced back to their real owners without a heroic effort by law enforcement is not a bug it's a feature. Your government (if you live in the UK, the US, or even arguably the EU) tacitly supports the dirty business done by this route so long as they're able to disclaim any knowledge it's going on.
      - pishpash 9y ago
        You can send it through a secondary query, not in the initial cert, so only if the user looks it up. It should be a supported possibility though. As for what you get out of it, that's okay, have it match meatspace level first, not trying to fix the world.
- rgbrenner 9y ago
  This isn’t Comodos fault.. trademarks are only unique by industry and region.. two companies in unrelated industries can use the same name. So it was always the case there might be more than one stripe inc. The problem is the browsers display of that information. Knowing this, why would you hide the domain of the website?
wiradikusuma 9y ago
"However, when you hear "Stripe, Inc", you are probably thinking of the payment processor incorporated in Delaware. Here, though, you are talking to the "Stripe, Inc" incorporated in Kentucky." -- how is that possible to have identical company name in a country?
- mynewtb 9y ago
  Is it an uppercase I or a lowercase l?
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
- mikeokner 9y ago
  Companies are registered at the state level, but names are trademarks that are overseen at the federal level. The real Stripe could probably sue and force a change of name due to trademark infringement, especially since the fake Stripe's primary business seems to be online as well. The real Stripe probably couldn't sue and force a change if someone registered another Stripe, Inc. in a different state who paints lines on roads or something.
  - rgbrenner 9y ago
    Being online isn't a business. stripe.ian.sh does not compete with stripe.com, and there's zero risk of consumer confusion between these two websites. Stripe.com has no case for trademark infringement.
    - mikeokner 9y ago
      If I were Stripe.com's legal counsel, I'd have already fired off a C&D. Stripe.ian.sh isn't trying to subvert traffic, but the entire point of this exercise is to show how it's possible to be confused for the real Stripe.com under certain circumstances. It's a fine line and if I were from the real Stripe I wouldn't want to let those sorts of grey areas go unchallenged.

anc84 9y ago

That should be the submission, it is very well written and detailed.

samwillis 9y ago
It was submitted (https://news.ycombinator.com/item?id=15902848 https://news.ycombinator.com/item?id=15902848) but in the middle of the night US/EU so dropped off the new list... Quite often the mods will combine/replace a thread when this happens.

NelsonMinar 9y ago

I love this quote: 'this site uses an EV certificate for "Stripe, Inc", that was legitimately issued by Comodo'. Comodo has been responsible for a bunch of SSL-related security fiascos over the year. https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies

gruez 9y ago
but in this case, what is Comodo supposed to do? For a generic name such as "stripe", are other (less famous) "stripe" companies, are they out of luck if they want a EV certificate?
- pishpash 9y ago
  Maybe it's time to put all the certification documentation into the certificate so they can be retrieved and viewed by anyone. Registration, signatures, payments, proofs, etc. Why does only the CA get to see it? Everyone should be able to see.
  - tinus_hn 9y ago
    The information you need is in the certificate. The problem is it doesn’t fit in the UI.
  - tialaramex 9y ago
    Depending on the certificate, this could be quite a lot of data, the certificate is delivered on every new connection, right now they're commonly a kilobyte or so of data. For a typical DV certificate, maybe the CA has done 3.2.2.4.6, so they have a log showing the DNS look-up they did from first principles (so it's the whole thing from the root, not just a cached single entry), then the HTTP transaction, with the Request Token inside it, and they've matched the Request Token against the expected value. That could easily be several kilobytes. The CA is required to store this, but burning it into the certificate is extra data all so that what, one person in a million can look at it, and go "Eh, that looks roughly like I'd expect" ? For an EV certificate there's going to be stuff they found in a government data source, then the stuff from Dun & Bradstreet, then... what maybe a WAV file of a phone call to the number listed in D&B? PDF scans of headed notepaper? And it tells you... somebody, somewhere said this was fine. So what? As I've stated on m.d.s.policy the ability to make companies in the US and UK that can't be traced back to their real owners without a heroic effort by law enforcement is not a bug it's a feature. Your government (if you live in the UK, the US, or even arguably the EU) tacitly supports the dirty business done by this route so long as they're able to disclaim any knowledge it's going on.
    - pishpash 9y ago
      You can send it through a secondary query, not in the initial cert, so only if the user looks it up. It should be a supported possibility though. As for what you get out of it, that's okay, have it match meatspace level first, not trying to fix the world.
rgbrenner 9y ago
This isn’t Comodos fault.. trademarks are only unique by industry and region.. two companies in unrelated industries can use the same name. So it was always the case there might be more than one stripe inc. The problem is the browsers display of that information. Knowing this, why would you hide the domain of the website?

wiradikusuma 9y ago

"However, when you hear "Stripe, Inc", you are probably thinking of the payment processor incorporated in Delaware. Here, though, you are talking to the "Stripe, Inc" incorporated in Kentucky." -- how is that possible to have identical company name in a country?

mynewtb 9y ago
Is it an uppercase I or a lowercase l?
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
mikeokner 9y ago
Companies are registered at the state level, but names are trademarks that are overseen at the federal level. The real Stripe could probably sue and force a change of name due to trademark infringement, especially since the fake Stripe's primary business seems to be online as well. The real Stripe probably couldn't sue and force a change if someone registered another Stripe, Inc. in a different state who paints lines on roads or something.
- rgbrenner 9y ago
  Being online isn't a business. stripe.ian.sh does not compete with stripe.com, and there's zero risk of consumer confusion between these two websites. Stripe.com has no case for trademark infringement.
  - mikeokner 9y ago
    If I were Stripe.com's legal counsel, I'd have already fired off a C&D. Stripe.ian.sh isn't trying to subvert traffic, but the entire point of this exercise is to show how it's possible to be confused for the real Stripe.com under certain circumstances. It's a fine line and if I were from the real Stripe I wouldn't want to let those sorts of grey areas go unchallenged.