3 ms·

Counter-argument: domain names are notoriously bad at conveying the identity of real-world entities. How is a user supposed to know that my-bank.com is the doma

Counter-argument: domain names are notoriously bad at conveying the identity of real-world entities. How is a user supposed to know that my-bank.com is the domain for their bank, as opposed to mybank.com or my-bank.org? EV certs can serve much the same role that the "Verified" indicator does on social media sites; it provides some assurance that the name you're seeing on screen really _does_ belong to the person or company you think it does. There are obviously issues with EV as it's currently implemented, but I believe the solution to that is to fix those issues, not to eliminate the indicator entirely.

geofft 8y ago
A better long-term solution (although maybe too long-term) is to move to some auth mechanism that knows about your origin. When you get a bank account, you should get a U2F device (which should cost <$20, which should be far less than the amount the bank is already spending on securing your account) that you enroll then and there, and so if you end up at my-bank.org by mistake, it doesn't matter, your U2F device doesn't have a shared key with the origin and you can't log in. Or do the same sort of thing with WebAuthn. Or you scan a QR code with your phone and get a link to the bank's mobile website and bookmark it, or whatever. Attack 1 makes me worry about whether this is solvable at all. There's a lot of "First Bank and Trust"s out there, and they'd all need an EV certificate for the same string, so avoiding the attack seems genuinely hard. Like social media (or curated app stores), the only way it can really work is if the "verified" marker creates first-class and second-class entities: the entities approved by the powerful as reasonable to do business with, and the entities that aren't. Someone makes a decision about which First Banks and Trusts are "real" and which ones aren't, and you can't appeal it.

geofft 8y ago

A better long-term solution (although maybe too long-term) is to move to some auth mechanism that knows about your origin. When you get a bank account, you should get a U2F device (which should cost <$20, which should be far less than the amount the bank is already spending on securing your account) that you enroll then and there, and so if you end up at my-bank.org by mistake, it doesn't matter, your U2F device doesn't have a shared key with the origin and you can't log in. Or do the same sort of thing with WebAuthn. Or you scan a QR code with your phone and get a link to the bank's mobile website and bookmark it, or whatever. Attack 1 makes me worry about whether this is solvable at all. There's a lot of "First Bank and Trust"s out there, and they'd all need an EV certificate for the same string, so avoiding the attack seems genuinely hard. Like social media (or curated app stores), the only way it can really work is if the "verified" marker creates first-class and second-class entities: the entities approved by the powerful as reasonable to do business with, and the entities that aren't. Someone makes a decision about which First Banks and Trusts are "real" and which ones aren't, and you can't appeal it.