6 ms·

Extended validation isn't very useful, for exactly the reasons the article explained. Most users don't take advantage of its benefits no matter how technically

Extended validation isn't very useful, for exactly the reasons the article explained. Most users don't take advantage of its benefits no matter how technically sound the concept is. Providing users with anti-phishing and phishing-detection tools doesn't mitigate phishing. The way to mitigate phishing isn't to empower the user with sophisticated awareness, it's to eliminate the need for that awareness.

themihai 8y ago
Ok so we just removed the "sophisticated awareness" and now we wait for a fantasy/unknown solution. No brainer, right? To me this looks like a bad day for the open internet and a good day for walled gardens(i.e. Apple Store).
- throwawaymath 8y ago
  How exactly did you get from the inefficacy of extended validation certificates (and their subsequent obsolescence) to solidfying moats for walled gardens?
  - snowwrestler 8y ago
    The original purpose of an EV cert is to provide a browser UI that tells a first-time visitor that they can trust the website they've landed on. This is a separate goal from TLS in general, which is just supposed to secure the traffic in transit. Google in particular has no interest in providing such a browser UI. They want users to use Google Search to establish trust instead. "If you're not sure, Google the business name" is common advice to avoid copycat sites. Boy is that a good position for Google to be in! Why would they invest in an alternate solution with a distributed architecture and client-side UI? Almost all the "best practice" security advice today is centered around protecting existing relationships with sites. "Use a strong password, a password manager, and two-factor-authentication" does nothing to protect a first-time site visitor from a scams. It makes sense for security professionals to focus on the lowest hanging fruit, but the result is web in which first time site visits are perilous and uses get no help at all with that.
    - throwawaymath 8y ago
      Yikes there's a lot of (in my opinion) misconceived cynicism here... > The original purpose of an EV cert is to provide a browser UI that tells a first-time visitor that they can trust the website they've landed on. This is a separate goal from TLS in general, which is just supposed to secure the traffic in transit. This isn't really accurate. Basic TLS (domain validation) provides encryption and authentication - if TLS did not provide authentication in its most basic form, the encryption would not be very secure on its own. Extended validation merely adds further parameters (properties, characteristics, etc) to the server side of the authentication process that already exists in TLS, in combination with administrative work on the part of the certificate authorities. Then the client provides the UI visual indicators corresponding to the authenticated identity, as you say. But while all of this technically works, most users don't bother with checking it. Security with friction to use doesn't typically provide any security, it just makes you feel like you're doing something. > Google in particular has no interest in providing such a browser UI. They want users to use Google Search to establish trust instead. "If you're not sure, Google the business name" is common advice to avoid copycat sites. Boy is that a good position for Google to be in! Why would they invest in an alternate solution with a distributed architecture and client-side UI? I can trade your flavor of cynicism with my own: certificate authorities don't want TLS certificates to be cheap, so they come up with shiny options such as OV and EV to have something they can upsell. See what I just did? We can just keep arguing cynically if we'd like, but we don't arrive at any new insight about the actual point. The fact of the matter is that it's largely irrelevant what Google's motivation is, because the efficacy of extended validation (or lack thereof) does not rely on Google (or any other browser's) motivation. And for what it's worth, Google is not the only browser maintainer moving away from EV visual indicators. > Almost all the "best practice" security advice today is centered around protecting existing relationships with sites. "Use a strong password, a password manager, and two-factor-authentication" does nothing to protect a first-time site visitor from a scams. This is a fair point. It's definitely true that phishing is not as sexy a problem as "technical" security vulnerabilities, and so gets relatively less attention. But a security mechanism only augments security if it's actually used or adhered to. I'm not debating the technical merits of extended validation. I'm stating that it's ineffective beause it's a technical solution to a social problem. The way to resolve that social problem is through more sophisticated education and training. Or more likely, to re-architect the interface and browsing methodology in a way that obviates phishing entirely. Just because one of those approaches seems out of reach doesn't mean we should settle for EV, which in practice doesn't do anything. The only nontrivial users of EV are banks and financial institutions; these are the same institutions who have completely bought into security questions, inability to paste passwords and draconian password complexity requirements.
  - themihai 8y ago
    Now is harder to distinguish between legit business websites and scams. The best alternative is to just use an iOS app as Apple does the verification(i.e. what EV provided). EV was far from perfect, they were expensive and hard to get but I think it should be replaced by something better not just removed. I personally never heard/seen of any phishing website using EV certificates.
    - throwawaymath 8y ago
      The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They secure their website with regular domain validated TLS, get a domain that looks halfway decent compared to the real one, and users never even look for the extended validation certificate. Trying to get an incorrect extended validation certificate would just add to the money and risk involved in the campaign. Since users only rarely even check them, you don't even need to bother with it. It's an ill-conceived solution to a problem which is intrinsically enabled via poor security education and habits. Expecting users who aren't sufficiently diligent to check for slightly incorrect phishing domains to look for slightly incorrect or non-existent extended validation certificates is silly. That's not a categorically different approach to the problem, it's just more of the same to the left of the domain name.
      - themihai 8y ago
        >> The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They don't use EV certificates because they are hard, even impossible to get for many. If you also consider that domains get blacklisted by the day, phishing would become unfeasible for many. The internet would be safer with EV-everywhere. There are two issues with EV: 1. They are too expensive and hard to get/manage. We need something like Let's Encrypt so that you can submit documentation etc through an open protocol. 2. The UI is not good enough. Due the reasons above many companies didn't implement EV. I find it hard to understand why would someone remove EV with no replacement in place. How can I tell if google-domains.tld is a domain/website owned by Google Inc or a random scam website? Even a technical person is unable to tell you because there is no tool(at least I'm not aware of any) except the EV certificates.

themihai 8y ago

Ok so we just removed the "sophisticated awareness" and now we wait for a fantasy/unknown solution. No brainer, right? To me this looks like a bad day for the open internet and a good day for walled gardens(i.e. Apple Store).

throwawaymath 8y ago
How exactly did you get from the inefficacy of extended validation certificates (and their subsequent obsolescence) to solidfying moats for walled gardens?
- snowwrestler 8y ago
  The original purpose of an EV cert is to provide a browser UI that tells a first-time visitor that they can trust the website they've landed on. This is a separate goal from TLS in general, which is just supposed to secure the traffic in transit. Google in particular has no interest in providing such a browser UI. They want users to use Google Search to establish trust instead. "If you're not sure, Google the business name" is common advice to avoid copycat sites. Boy is that a good position for Google to be in! Why would they invest in an alternate solution with a distributed architecture and client-side UI? Almost all the "best practice" security advice today is centered around protecting existing relationships with sites. "Use a strong password, a password manager, and two-factor-authentication" does nothing to protect a first-time site visitor from a scams. It makes sense for security professionals to focus on the lowest hanging fruit, but the result is web in which first time site visits are perilous and uses get no help at all with that.
  - throwawaymath 8y ago
    Yikes there's a lot of (in my opinion) misconceived cynicism here... > The original purpose of an EV cert is to provide a browser UI that tells a first-time visitor that they can trust the website they've landed on. This is a separate goal from TLS in general, which is just supposed to secure the traffic in transit. This isn't really accurate. Basic TLS (domain validation) provides encryption and authentication - if TLS did not provide authentication in its most basic form, the encryption would not be very secure on its own. Extended validation merely adds further parameters (properties, characteristics, etc) to the server side of the authentication process that already exists in TLS, in combination with administrative work on the part of the certificate authorities. Then the client provides the UI visual indicators corresponding to the authenticated identity, as you say. But while all of this technically works, most users don't bother with checking it. Security with friction to use doesn't typically provide any security, it just makes you feel like you're doing something. > Google in particular has no interest in providing such a browser UI. They want users to use Google Search to establish trust instead. "If you're not sure, Google the business name" is common advice to avoid copycat sites. Boy is that a good position for Google to be in! Why would they invest in an alternate solution with a distributed architecture and client-side UI? I can trade your flavor of cynicism with my own: certificate authorities don't want TLS certificates to be cheap, so they come up with shiny options such as OV and EV to have something they can upsell. See what I just did? We can just keep arguing cynically if we'd like, but we don't arrive at any new insight about the actual point. The fact of the matter is that it's largely irrelevant what Google's motivation is, because the efficacy of extended validation (or lack thereof) does not rely on Google (or any other browser's) motivation. And for what it's worth, Google is not the only browser maintainer moving away from EV visual indicators. > Almost all the "best practice" security advice today is centered around protecting existing relationships with sites. "Use a strong password, a password manager, and two-factor-authentication" does nothing to protect a first-time site visitor from a scams. This is a fair point. It's definitely true that phishing is not as sexy a problem as "technical" security vulnerabilities, and so gets relatively less attention. But a security mechanism only augments security if it's actually used or adhered to. I'm not debating the technical merits of extended validation. I'm stating that it's ineffective beause it's a technical solution to a social problem. The way to resolve that social problem is through more sophisticated education and training. Or more likely, to re-architect the interface and browsing methodology in a way that obviates phishing entirely. Just because one of those approaches seems out of reach doesn't mean we should settle for EV, which in practice doesn't do anything. The only nontrivial users of EV are banks and financial institutions; these are the same institutions who have completely bought into security questions, inability to paste passwords and draconian password complexity requirements.
- themihai 8y ago
  Now is harder to distinguish between legit business websites and scams. The best alternative is to just use an iOS app as Apple does the verification(i.e. what EV provided). EV was far from perfect, they were expensive and hard to get but I think it should be replaced by something better not just removed. I personally never heard/seen of any phishing website using EV certificates.
  - throwawaymath 8y ago
    The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They secure their website with regular domain validated TLS, get a domain that looks halfway decent compared to the real one, and users never even look for the extended validation certificate. Trying to get an incorrect extended validation certificate would just add to the money and risk involved in the campaign. Since users only rarely even check them, you don't even need to bother with it. It's an ill-conceived solution to a problem which is intrinsically enabled via poor security education and habits. Expecting users who aren't sufficiently diligent to check for slightly incorrect phishing domains to look for slightly incorrect or non-existent extended validation certificates is silly. That's not a categorically different approach to the problem, it's just more of the same to the left of the domain name.
    - themihai 8y ago
      >> The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They don't use EV certificates because they are hard, even impossible to get for many. If you also consider that domains get blacklisted by the day, phishing would become unfeasible for many. The internet would be safer with EV-everywhere. There are two issues with EV: 1. They are too expensive and hard to get/manage. We need something like Let's Encrypt so that you can submit documentation etc through an open protocol. 2. The UI is not good enough. Due the reasons above many companies didn't implement EV. I find it hard to understand why would someone remove EV with no replacement in place. How can I tell if google-domains.tld is a domain/website owned by Google Inc or a random scam website? Even a technical person is unable to tell you because there is no tool(at least I'm not aware of any) except the EV certificates.