6 ms·

right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe

by tribby 8y ago

right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe could take this up with the courts about how ian is confusing consumers and so forth, and they would win. but they didn't - they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- to help protect people from fraud. what wouldn't be a fine reasonable response is to do the same if he were in fact doing real business as a different stripe with non-confusing logos in a different market, not trying to look confusing on purpose. there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer. ultimately his point is that if EV SSL can do this, it is shit, and on that I agree.

deleted 8y ago
[deleted]
icebraining 8y ago
they went straight to the CAs Is there any evidence that Stripe had anything to do with this?
- deleted 8y ago
  [deleted]
ryanlol 8y ago
>they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- Bullshit. It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" https://web.archive.org/web/20171211181630/https://stripe.ian.sh/ https://web.archive.org/web/20171211181630/https://stripe.ia... It is also utterly ridiculous to describe this as "helping protect people from fraud". There was no fraud. >there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer FWIW I've had my website kicked off Cloudflare and countless of domain names suspended because a SF BigCo hired an very big international law firm to keep my site offline at any cost. I wouldn't put it past them to try and get certificates revoked too, but they tend to be able to put out enough pressure to get the domain names suspended pretty fast. (My site sells legally scraped public data from that BigCo's website, instead of suing me they prefer to just keep my site offline)
- icebraining 8y ago
  It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" Scroll down a bit on that page, and you'll see this image: https://web.archive.org/web/20171211213402im_/https://stripe.ian.sh/firefox.png https://web.archive.org/web/20171211213402im_/https://stripe... Maybe that page was updated later in the day, but before the Web Archive captured it.
  - ryanlol 8y ago
    I'm aware of the image, and even if the page actually looked like that for 10 minutes while he was taking the screenshot I'd still think it's obvious that his intent was not to confuse people with this site. https://crt.sh/?id=393002115&opt=ocsp https://crt.sh/?id=393002115&opt=ocsp Just compare the revocation date and the archive.org date. At best they revoked the cert after it had been used to serve a completely different site for many months.
- felipelemos 8y ago
  > It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" [...] And what about this? https://stripe.ian.sh/firefox.png https://stripe.ian.sh/firefox.png
  - kuschku 8y ago
    That's called using developer tools to create a mockup of a page.
- tribby 8y ago
  > Bullshit. no, not bullshit. see the screenshots in this thread and the tweet in the post itself where the two stripe sites are compared side by side. making a "look how useless EV SSL is" site through a phishing example isn't a good strategy for maintaining an EV SSL cert, clearly. he was practically asking them to revoke it, and they gave him what he wanted. > (My site sells legally scraped public data from that BigCo's website, instead of suing me they prefer to just keep my site offline) it sounds reasonable that cloudflare kicked you off, too. you may not be breaking the law, but you're not respecting BigCo's terms of service and you can't expect a red carpet given the nature of the business you're in. seems like an interesting/fun game of cat and mouse, in any case :) I'd be much more worried about this kind of thing if it were happening to good/neutral actors. but as presented it just seems like the centralized internet doing a pretty OK job of policing itself.

by tribby 8y ago

deleted 8y ago

[deleted]

icebraining 8y ago

they went straight to the CAs Is there any evidence that Stripe had anything to do with this?

deleted 8y ago
[deleted]

ryanlol 8y ago

>they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- Bullshit. It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" https://web.archive.org/web/20171211181630/https://stripe.ian.sh/ https://web.archive.org/web/20171211181630/https://stripe.ia... It is also utterly ridiculous to describe this as "helping protect people from fraud". There was no fraud. >there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer FWIW I've had my website kicked off Cloudflare and countless of domain names suspended because a SF BigCo hired an very big international law firm to keep my site offline at any cost. I wouldn't put it past them to try and get certificates revoked too, but they tend to be able to put out enough pressure to get the domain names suspended pretty fast. (My site sells legally scraped public data from that BigCo's website, instead of suing me they prefer to just keep my site offline)

icebraining 8y ago
It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" Scroll down a bit on that page, and you'll see this image: https://web.archive.org/web/20171211213402im_/https://stripe.ian.sh/firefox.png https://web.archive.org/web/20171211213402im_/https://stripe... Maybe that page was updated later in the day, but before the Web Archive captured it.
- ryanlol 8y ago
  I'm aware of the image, and even if the page actually looked like that for 10 minutes while he was taking the screenshot I'd still think it's obvious that his intent was not to confuse people with this site. https://crt.sh/?id=393002115&opt=ocsp https://crt.sh/?id=393002115&opt=ocsp Just compare the revocation date and the archive.org date. At best they revoked the cert after it had been used to serve a completely different site for many months.
felipelemos 8y ago
> It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" [...] And what about this? https://stripe.ian.sh/firefox.png https://stripe.ian.sh/firefox.png
- kuschku 8y ago
  That's called using developer tools to create a mockup of a page.
tribby 8y ago
> Bullshit. no, not bullshit. see the screenshots in this thread and the tweet in the post itself where the two stripe sites are compared side by side. making a "look how useless EV SSL is" site through a phishing example isn't a good strategy for maintaining an EV SSL cert, clearly. he was practically asking them to revoke it, and they gave him what he wanted. > (My site sells legally scraped public data from that BigCo's website, instead of suing me they prefer to just keep my site offline) it sounds reasonable that cloudflare kicked you off, too. you may not be breaking the law, but you're not respecting BigCo's terms of service and you can't expect a red carpet given the nature of the business you're in. seems like an interesting/fun game of cat and mouse, in any case :) I'd be much more worried about this kind of thing if it were happening to good/neutral actors. but as presented it just seems like the centralized internet doing a pretty OK job of policing itself.