4 ms·
They do, and if they don't, they end up like the White House a few years ago when whitehouse.<I forgot the TLD> was bought and an almost exact replica was creat
by BrandoElFollito 9y ago
They do, and if they don't, they end up like the White House a few years ago when whitehouse.<I forgot the TLD> was bought and an almost exact replica was created, according to Rule 34.
My point is that you can buy any site from a CA and no verification is done, exactly as with Let's Encrypt.
Even with an EV there is no guarantee that the requester is genuine ("best effort" to check)
- tialaramex 9y agoWith EV the checks basically care about: 1. Does this entity exist, e.g. it's in an official government business directory and the address details match what was specified 2. Use a third party directory (e.g. Dunn & Bradstreet) to look up this entity, and phone them. Ask to talk to some specific role at the company e.g. "Head of the IT department" and then confirm the details with that person. This involves actual humans, albeit basically call centre employees, looking at paperwork, making telephone calls, that sort of thing. I guess you could label it "best effort" but to me that signifies much less. For Americans a surprise problem with EV is that your country doesn't _have_ a central business directory. Each State runs its own directory, most businesses are registered in Delaware, regardless of their actual home state. https://stripe.ian.sh/ https://stripe.ian.sh/ has a completely genuine Stripe, Inc. EV certificate, issued to a Stripe, Inc. just not the one that's famous.