5 ms·

https://stripe.ian.sh https://stripe.ian.sh addresses this objection: > First, from incorporation to issuance of the EV certificate, I spent less than an hour

by geofft 8y ago

https://stripe.ian.sh https://stripe.ian.sh addresses this objection: > First, from incorporation to issuance of the EV certificate, I spent less than an hour of my time and about $177. $100 of this was to incorporate the company, and $77 was for the certificate. It took about 48 hours from incorporation to the issuance of the certificate. > The primary point raised by advocates of extended validation is that obtaining EV certificates would leave behind a signifigant paper trail of the bad actor's identity. However, there is minimal individual identity verification in the process. Dun & Bradstreet1 is the only entity who attempted to verify my identity, and did so with a few trivial identity verification questions. Purchasing identities with answers to common verification questions is neither hard nor expensive. > Otherwise, there was no attempt at identity verification from the state of Kentucky or the registered agent I used in the process. This is typical of company formation in the United States. Given the use of a registered agent, and given that registered agents are a pretty common thing, I don't think that anything is actually being burned here, unless you want to say that any registered agent who incorporates a phishing company gets all their other companies banned. Which, like the CASC's "You can't have EV if you haven't existed for 18 months" suggestion, will technically work at the cost of making EV useless. Also, a lot of attacks don't care that they're burning credentials anyway. You don't need to spoof MyEtherWallet more than once to walk off with hundreds of thousands in Ethereum. You don't need to spoof the Washington Post more than once to spread fake news 48 hours before a presidential election.

ocdtrekkie 8y ago
Your first quote proves my point: $177 times... how many malicious attempts? That isn't a cost that scales, because in the case of a multitude of malicious activities online, the number of attempts, at $177 a try, would not be worth it. You are using an example of singular high profile attempts, such as "I incorporated a company for this demo" or "I am a state actor trying to derail a Presidential election". While you fail to recognize that EV would likely protect users from 99% of attacks caused by malicious actors spoofing domains, which could trivially be domain validated otherwise. I find this a particular trend amongst security discussion, particularly here on HN: Focus on the most possibly sophisticated and capable attack, while ignoring that tens of millions of users are afflicted by pretty rudimentary attacks that are more or less automated on a daily basis. If EV were to solely succeed in ensuring an actual human had to go through the registration process, it would almost certainly be worth it. Additionally, as a point of note, EV certificates could be made vastly more effective by easily addressing your concerns: Raise the price of EV certs significantly, which CAs would be more than happy to do, and ensure you needed to go to one of the upper levels of the CA system (say, having to go to Comodo for them, rather than your Trustico nonsense) to reduce the number of parties which could issue them as much as possible, and raise the mutual requirements between them to issue them.
- geofft 8y ago
  Our scales of economics must be totally off. I'd argue that an attack that costs $177 a try is entirely scalable - presumably you should gain more than $177 in value from a single spoofed domain, right? I do agree that if $177 is too high a cost, then the problem is solvable by just setting a price floor on certificates (modulo CA/Browser Forum antitrust concerns). I do not think that solution is likely to work, except at a price point at which EV becomes unusably expensive for legitimate users. EV only works if we are reasonably confident that users will refuse to enter credentials into a site without EV. As EV stands today - with EV costing less than $177 for a legitimate user (because they've already incorporated) - that isn't happening. Making EV harder to acquire doesn't actually solve phishing. That's my objection. Sure, you can make it harder to get an EV cert for a phishing site, but, so what? (A better solution that actually works against rudimentary attacks is to just give everyone a U2F security key.)
  - ocdtrekkie 8y ago
    I don't agree EV should be the bar for "entering credentials". I currently don't consider it a requirement that I only "enter credentials" in HTTPS sites either, insofar as "credentials" is a very wide term. (I find the fact that simple password boxes on low security sites now pester me with a dropdown warning on Firefox. I know they're HTTP sites, but I don't care.) As an example I do not care about: My HN account. I would not care if it was intercepted and "hacked", because the damage it can do to me personally is minimal. It would probably annoy the mods somewhat, but the handful of spam posts would get cleaned up, I'd have to reach out to the mods to get unbanned, and life would move on. I don't really care that HN has a cert at all, I certainly don't think HN needs an EV cert, I have no real concern about either my password being intercepted, or me being phished into believing a fake site is HN. If we move DV certificates to be the bare minimum a site is expected to have, then EV should be a bar for important credentials. Aka, your Gmail account, your Bank of America account, etc. You know, Fortune 500 level companies which could afford, I don't know, a $5,000 or more annual investment. The higher cost would also justify higher requirements to get one. At that sort of cost, they could literally fly someone out to your office to check you out directly. Whereas people have mistakenly corroborated the lock icon with "legitimate websites", an EV cert should ideally be the sort of thing household name companies have, which someone trustworthy has directly ensured is actually the keepers of that certificate. I don't think placing the burden on my grandma to have a U2F security key is reasonable, but we should have a process so that google.com is clearly marked as being owned by Google, LLC, and that it is, in fact, the real google.com.

by geofft 8y ago

ocdtrekkie 8y ago

Your first quote proves my point: $177 times... how many malicious attempts? That isn't a cost that scales, because in the case of a multitude of malicious activities online, the number of attempts, at $177 a try, would not be worth it. You are using an example of singular high profile attempts, such as "I incorporated a company for this demo" or "I am a state actor trying to derail a Presidential election". While you fail to recognize that EV would likely protect users from 99% of attacks caused by malicious actors spoofing domains, which could trivially be domain validated otherwise. I find this a particular trend amongst security discussion, particularly here on HN: Focus on the most possibly sophisticated and capable attack, while ignoring that tens of millions of users are afflicted by pretty rudimentary attacks that are more or less automated on a daily basis. If EV were to solely succeed in ensuring an actual human had to go through the registration process, it would almost certainly be worth it. Additionally, as a point of note, EV certificates could be made vastly more effective by easily addressing your concerns: Raise the price of EV certs significantly, which CAs would be more than happy to do, and ensure you needed to go to one of the upper levels of the CA system (say, having to go to Comodo for them, rather than your Trustico nonsense) to reduce the number of parties which could issue them as much as possible, and raise the mutual requirements between them to issue them.

geofft 8y ago
Our scales of economics must be totally off. I'd argue that an attack that costs $177 a try is entirely scalable - presumably you should gain more than $177 in value from a single spoofed domain, right? I do agree that if $177 is too high a cost, then the problem is solvable by just setting a price floor on certificates (modulo CA/Browser Forum antitrust concerns). I do not think that solution is likely to work, except at a price point at which EV becomes unusably expensive for legitimate users. EV only works if we are reasonably confident that users will refuse to enter credentials into a site without EV. As EV stands today - with EV costing less than $177 for a legitimate user (because they've already incorporated) - that isn't happening. Making EV harder to acquire doesn't actually solve phishing. That's my objection. Sure, you can make it harder to get an EV cert for a phishing site, but, so what? (A better solution that actually works against rudimentary attacks is to just give everyone a U2F security key.)
- ocdtrekkie 8y ago
  I don't agree EV should be the bar for "entering credentials". I currently don't consider it a requirement that I only "enter credentials" in HTTPS sites either, insofar as "credentials" is a very wide term. (I find the fact that simple password boxes on low security sites now pester me with a dropdown warning on Firefox. I know they're HTTP sites, but I don't care.) As an example I do not care about: My HN account. I would not care if it was intercepted and "hacked", because the damage it can do to me personally is minimal. It would probably annoy the mods somewhat, but the handful of spam posts would get cleaned up, I'd have to reach out to the mods to get unbanned, and life would move on. I don't really care that HN has a cert at all, I certainly don't think HN needs an EV cert, I have no real concern about either my password being intercepted, or me being phished into believing a fake site is HN. If we move DV certificates to be the bare minimum a site is expected to have, then EV should be a bar for important credentials. Aka, your Gmail account, your Bank of America account, etc. You know, Fortune 500 level companies which could afford, I don't know, a $5,000 or more annual investment. The higher cost would also justify higher requirements to get one. At that sort of cost, they could literally fly someone out to your office to check you out directly. Whereas people have mistakenly corroborated the lock icon with "legitimate websites", an EV cert should ideally be the sort of thing household name companies have, which someone trustworthy has directly ensured is actually the keepers of that certificate. I don't think placing the burden on my grandma to have a U2F security key is reasonable, but we should have a process so that google.com is clearly marked as being owned by Google, LLC, and that it is, in fact, the real google.com.