3 ms·

IYAM, any major web property such as google, facebook, credit card issuers, etc. should buy up all the most likely typo-ed versions of their domains so that thi

IYAM, any major web property such as google, facebook, credit card issuers, etc. should buy up all the most likely typo-ed versions of their domains so that this doesn't happen. The average user is going to blame Facebook anyway if they get duped into logging in at faccebook.com, and it goes to protecting their brand (trademarks are weakened if the owner doesn't defend them).

BrandoElFollito 9y ago
They do, and if they don't, they end up like the White House a few years ago when whitehouse.<I forgot the TLD> was bought and an almost exact replica was created, according to Rule 34. My point is that you can buy any site from a CA and no verification is done, exactly as with Let's Encrypt. Even with an EV there is no guarantee that the requester is genuine ("best effort" to check)
- tialaramex 9y ago
  With EV the checks basically care about: 1. Does this entity exist, e.g. it's in an official government business directory and the address details match what was specified 2. Use a third party directory (e.g. Dunn & Bradstreet) to look up this entity, and phone them. Ask to talk to some specific role at the company e.g. "Head of the IT department" and then confirm the details with that person. This involves actual humans, albeit basically call centre employees, looking at paperwork, making telephone calls, that sort of thing. I guess you could label it "best effort" but to me that signifies much less. For Americans a surprise problem with EV is that your country doesn't _have_ a central business directory. Each State runs its own directory, most businesses are registered in Delaware, regardless of their actual home state. https://stripe.ian.sh/ https://stripe.ian.sh/ has a completely genuine Stripe, Inc. EV certificate, issued to a Stripe, Inc. just not the one that's famous.

3 ms·

IYAM, any major web property such as google, facebook, credit card issuers, etc. should buy up all the most likely typo-ed versions of their domains so that thi

by ams6110 9y ago

BrandoElFollito 9y ago
They do, and if they don't, they end up like the White House a few years ago when whitehouse.<I forgot the TLD> was bought and an almost exact replica was created, according to Rule 34. My point is that you can buy any site from a CA and no verification is done, exactly as with Let's Encrypt. Even with an EV there is no guarantee that the requester is genuine ("best effort" to check)
- tialaramex 9y ago
  With EV the checks basically care about: 1. Does this entity exist, e.g. it's in an official government business directory and the address details match what was specified 2. Use a third party directory (e.g. Dunn & Bradstreet) to look up this entity, and phone them. Ask to talk to some specific role at the company e.g. "Head of the IT department" and then confirm the details with that person. This involves actual humans, albeit basically call centre employees, looking at paperwork, making telephone calls, that sort of thing. I guess you could label it "best effort" but to me that signifies much less. For Americans a surprise problem with EV is that your country doesn't _have_ a central business directory. Each State runs its own directory, most businesses are registered in Delaware, regardless of their actual home state. https://stripe.ian.sh/ https://stripe.ian.sh/ has a completely genuine Stripe, Inc. EV certificate, issued to a Stripe, Inc. just not the one that's famous.