3 ms·

As far as I know, he legitimately had a company named "Stripe, Inc". It was just registered in a different state.

by Operyl 9y ago

realusername 9y ago
Yeah but I thought EV certificates involved phone calls, manual checks of the website, some basic security compliance... All the kind of manual paperwork & background checks that the standard certificate would not do.
- tribby 9y ago
  right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe could take this up with the courts about how ian is confusing consumers and so forth, and they would win. but they didn't - they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- to help protect people from fraud. what wouldn't be a fine reasonable response is to do the same if he were in fact doing real business as a different stripe with non-confusing logos in a different market, not trying to look confusing on purpose. there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer. ultimately his point is that if EV SSL can do this, it is shit, and on that I agree.
  - deleted 9y ago
    [deleted]
  - icebraining 9y ago
    they went straight to the CAs Is there any evidence that Stripe had anything to do with this?
    - deleted 9y ago
      [deleted]
  - ryanlol 9y ago
    >they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- Bullshit. It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" https://web.archive.org/web/20171211181630/https://stripe.ian.sh/ https://web.archive.org/web/20171211181630/https://stripe.ia... It is also utterly ridiculous to describe this as "helping protect people from fraud". There was no fraud. >there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer FWIW I've had my website kicked off Cloudflare and countless of domain names suspended because a SF BigCo hired an very big international law firm to keep my site offline at any cost. I wouldn't put it past them to try and get certificates revoked too, but they tend to be able to put out enough pressure to get the domain names suspended pretty fast. (My site sells legally scraped public data from that BigCo's website, instead of suing me they prefer to just keep my site offline)
    - icebraining 9y ago
      It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" Scroll down a bit on that page, and you'll see this image: https://web.archive.org/web/20171211213402im_/https://stripe.ian.sh/firefox.png https://web.archive.org/web/20171211213402im_/https://stripe... Maybe that page was updated later in the day, but before the Web Archive captured it.
      - ryanlol 9y ago
        I'm aware of the image, and even if the page actually looked like that for 10 minutes while he was taking the screenshot I'd still think it's obvious that his intent was not to confuse people with this site. https://crt.sh/?id=393002115&opt=ocsp https://crt.sh/?id=393002115&opt=ocsp Just compare the revocation date and the archive.org date. At best they revoked the cert after it had been used to serve a completely different site for many months.

As far as I know, he legitimately had a company named "Stripe, Inc". It was just registered in a different state.

by Operyl 9y ago

As far as I know, he legitimately had a company named "Stripe, Inc". It was just registered in a different state.

Yeah but I thought EV certificates involved phone calls, manual checks of the website, some basic security compliance... All the kind of manual paperwork & background checks that the standard certificate would not do.

tribby 9y ago
right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe could take this up with the courts about how ian is confusing consumers and so forth, and they would win. but they didn't - they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- to help protect people from fraud. what wouldn't be a fine reasonable response is to do the same if he were in fact doing real business as a different stripe with non-confusing logos in a different market, not trying to look confusing on purpose. there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer. ultimately his point is that if EV SSL can do this, it is shit, and on that I agree.
- deleted 9y ago
  [deleted]
- icebraining 9y ago
  they went straight to the CAs Is there any evidence that Stripe had anything to do with this?
  - deleted 9y ago
    [deleted]
- ryanlol 9y ago
  >they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- Bullshit. It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" https://web.archive.org/web/20171211181630/https://stripe.ian.sh/ https://web.archive.org/web/20171211181630/https://stripe.ia... It is also utterly ridiculous to describe this as "helping protect people from fraud". There was no fraud. >there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer FWIW I've had my website kicked off Cloudflare and countless of domain names suspended because a SF BigCo hired an very big international law firm to keep my site offline at any cost. I wouldn't put it past them to try and get certificates revoked too, but they tend to be able to put out enough pressure to get the domain names suspended pretty fast. (My site sells legally scraped public data from that BigCo's website, instead of suing me they prefer to just keep my site offline)
  - icebraining 9y ago
    It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" Scroll down a bit on that page, and you'll see this image: https://web.archive.org/web/20171211213402im_/https://stripe.ian.sh/firefox.png https://web.archive.org/web/20171211213402im_/https://stripe... Maybe that page was updated later in the day, but before the Web Archive captured it.
    - ryanlol 9y ago
      I'm aware of the image, and even if the page actually looked like that for 10 minutes while he was taking the screenshot I'd still think it's obvious that his intent was not to confuse people with this site. https://crt.sh/?id=393002115&opt=ocsp https://crt.sh/?id=393002115&opt=ocsp Just compare the revocation date and the archive.org date. At best they revoked the cert after it had been used to serve a completely different site for many months.