5 ms·

I have mixed feelings about all of this. The big philosophical divide is really around what you think a cert/https should mean. The one side (I'm summarizing h

I have mixed feelings about all of this. The big philosophical divide is really around what you think a cert/https should mean. The one side (I'm summarizing here) says that HTTPS only means that the data transferred over the wire is secure and has nothing to do with authenticating that you're actually talking to the correct website. And that's correct, there are all sorts of MITM attacks, etc. that could be done and people shouldn't automatically trust that seeing a green lock means it's safe to put their password into a website. And that's correct. The other side says: nothing is 100% secure and security is all about defense in depth and these EV certs can be really helpful. Consider the Washington Post: https://www.washingtonpost.com/ https://www.washingtonpost.com/ There is a whole cottage industry of unscrupulous advertisers who make their living off of scraping the look and feel of websites like the WashingtonPost, setting up a URL like washingtonpostnews.com and then making up a fake story about how the Rock was arrested because he had some special muscle growing formula on him that oh look they have a link to buy for only $15/mo. It's quite unlikely that an EV cert would be issued for washingtonpostnews.com and it doesn't seem crazy to think that there is some value in having the EV cert on the proper www.washingtonpost.com website. They'll also point out that even DV cert issuance pre LetsEncrypt was a mixed bag of good and bad. Some CA's wouldn't issue you a cert if it had certain habitually abused trademark names, etc. in it. You'd have to do more than just have an email address or a DNS entry for it. This is for terms like BMW, Tesla, Facebook, etc. and this practice legitimately tripped up (but likely didn't stop) a metric ton of phishing sites. I think LetsEncrypt is awesome and makes a ton of sense and probably has made the internet safer in general. But the general response to things like LetsEncrypt issuing upwards of 15,000 different certs for domains containing "paypal" [1] is that you should rely upon sending your browsing information to Google, Microsoft, etc. so that they can tell you "Warning this is a possible Phishing Site" [2] which worryingly seems like we've then replaced multiple CAs (which we thought were too centralized) with an even fewer number of browser vendors (which are even more centralized). 1 - https://www.bleepingcomputer.com/news/security/14-766-lets-encrypt-ssl-certificates-issued-to-paypal-phishing-sites/ https://www.bleepingcomputer.com/news/security/14-766-lets-e... 2 - https://www.google.com/safebrowsing/static/faq.html https://www.google.com/safebrowsing/static/faq.html

akerl_ 8y ago
What percentage of users do you think routinely check for the presence of an EV or OV certificate on the sites they're browsing?
- SkyPuncher 8y ago
  I think it's much, much higher in the aging population.
  - duskwuff 8y ago
    The only place where the presence of an OV certificate is exposed is in the certificate details dialog -- the same dialog that will typically display arcane technical details like the public key and signature of the certificate. Non-technical users never look at this.
geofft 8y ago
> It's quite unlikely that an EV cert would be issued for washingtonpostnews.com I think the https://stripe.ian.sh https://stripe.ian.sh story argues otherwise - it would be pretty easy to start an LLC named "Washington Post News" in some other state and have the government agencies be fine with that. (In fact, for the specific case of Washington Posts, half of all US states have a city/town named "Washington.") Also the more practical problem with the Washington Post is the existence of the Washington Times, established in 1982 by Sun Myung Moon well before the web or SSL.
- ocdtrekkie 8y ago
  This is one example, sure, but EV does, in general, work. And the reason why is not because it's an ironclad indefeatable process for proving you are legitimately a major trustworthy party: It's a frustrating pile of hoops to jump through. The arcane and archaic nature of getting an EV gates out malicious actors pretty effectively. If you go through all of the process to get an EV (often involving scanned/faxed documents and phone calls), and then do something malicious with it, you're going to end up burning it (getting it revoked, generally, though, obviously the nightmare of revocation being still effectively broken comes into play) or even just the domain blocked by web filters and marked unsafe in the Safe Browsing list, setting you back to square one. All an EV vendor has to do for this to work is remember not to issue an EV again to anyone who uses the same credentials or proofs, whether or not they verified them with other authorities. Whereas a domain-validated cert can, of course, be automated (as can domain purchasing), meaning DV certs can scale. As with spam, malware, etc., you just publish it in volume, keep changing addresses, content, etc. to evade automated filtering, and press on. Meanwhile, if someone gets a Washington Post News EV, and starts impersonating WaPo, they only have one target to shut down a malicious actor. I could give non-CA-related examples, but I've come to the belief recently that security and trust is often a matter of creating solutions which don't scale.

akerl_ 8y ago

What percentage of users do you think routinely check for the presence of an EV or OV certificate on the sites they're browsing?

SkyPuncher 8y ago
I think it's much, much higher in the aging population.
- duskwuff 8y ago
  The only place where the presence of an OV certificate is exposed is in the certificate details dialog -- the same dialog that will typically display arcane technical details like the public key and signature of the certificate. Non-technical users never look at this.

geofft 8y ago

> It's quite unlikely that an EV cert would be issued for washingtonpostnews.com I think the https://stripe.ian.sh https://stripe.ian.sh story argues otherwise - it would be pretty easy to start an LLC named "Washington Post News" in some other state and have the government agencies be fine with that. (In fact, for the specific case of Washington Posts, half of all US states have a city/town named "Washington.") Also the more practical problem with the Washington Post is the existence of the Washington Times, established in 1982 by Sun Myung Moon well before the web or SSL.

ocdtrekkie 8y ago
This is one example, sure, but EV does, in general, work. And the reason why is not because it's an ironclad indefeatable process for proving you are legitimately a major trustworthy party: It's a frustrating pile of hoops to jump through. The arcane and archaic nature of getting an EV gates out malicious actors pretty effectively. If you go through all of the process to get an EV (often involving scanned/faxed documents and phone calls), and then do something malicious with it, you're going to end up burning it (getting it revoked, generally, though, obviously the nightmare of revocation being still effectively broken comes into play) or even just the domain blocked by web filters and marked unsafe in the Safe Browsing list, setting you back to square one. All an EV vendor has to do for this to work is remember not to issue an EV again to anyone who uses the same credentials or proofs, whether or not they verified them with other authorities. Whereas a domain-validated cert can, of course, be automated (as can domain purchasing), meaning DV certs can scale. As with spam, malware, etc., you just publish it in volume, keep changing addresses, content, etc. to evade automated filtering, and press on. Meanwhile, if someone gets a Washington Post News EV, and starts impersonating WaPo, they only have one target to shut down a malicious actor. I could give non-CA-related examples, but I've come to the belief recently that security and trust is often a matter of creating solutions which don't scale.