3 ms·

Now is harder to distinguish between legit business websites and scams. The best alternative is to just use an iOS app as Apple does the verification(i.e. what

Now is harder to distinguish between legit business websites and scams. The best alternative is to just use an iOS app as Apple does the verification(i.e. what EV provided). EV was far from perfect, they were expensive and hard to get but I think it should be replaced by something better not just removed. I personally never heard/seen of any phishing website using EV certificates.

throwawaymath 8y ago
The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They secure their website with regular domain validated TLS, get a domain that looks halfway decent compared to the real one, and users never even look for the extended validation certificate. Trying to get an incorrect extended validation certificate would just add to the money and risk involved in the campaign. Since users only rarely even check them, you don't even need to bother with it. It's an ill-conceived solution to a problem which is intrinsically enabled via poor security education and habits. Expecting users who aren't sufficiently diligent to check for slightly incorrect phishing domains to look for slightly incorrect or non-existent extended validation certificates is silly. That's not a categorically different approach to the problem, it's just more of the same to the left of the domain name.
- themihai 8y ago
  >> The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They don't use EV certificates because they are hard, even impossible to get for many. If you also consider that domains get blacklisted by the day, phishing would become unfeasible for many. The internet would be safer with EV-everywhere. There are two issues with EV: 1. They are too expensive and hard to get/manage. We need something like Let's Encrypt so that you can submit documentation etc through an open protocol. 2. The UI is not good enough. Due the reasons above many companies didn't implement EV. I find it hard to understand why would someone remove EV with no replacement in place. How can I tell if google-domains.tld is a domain/website owned by Google Inc or a random scam website? Even a technical person is unable to tell you because there is no tool(at least I'm not aware of any) except the EV certificates.
  - tialaramex 8y ago
    Funny story, you mentioned "Google Inc" and that's wrong. The company you're probably thinking of is Alphabet (does your grandmother recognise that name?) but it might be XXVI Holdings, or Google LLC or any of dozens of other subsidiaries created to remove the ability for shareholders to conduct any meaningful oversight. You can buy Alphabet stock with the ticker name GOOG, and maybe it goes up or down, but you get no ability to see whether they're losing money on AI research or gaining money on web searching, that's all now opaque internal information for a private company owned by a different private company that is merely owned by Alphabet, and so it isn't available for you to even think about. But even though I got sidetracked by a rant, my real point here is that you have no idea what you expected to see in this EV information, so who cares? You thought you wanted "Google Inc" but that doesn't even exist, a scammer could register it, and fool you, whereas the real Google, who don't own this "Google Inc" name couldn't satisfy you. Ludicrous. If you want the company behind Google.com, don't go to Google.some.other.example and hope to somehow check that's the right company, just go to Google.com
    - themihai 8y ago
      >> You thought you wanted "Google Inc" but that doesn't even exist, a scammer could register it, No, they wouldn't be able to register Google Inc and most likely not any derivate either like they do with domain names. Setting up a company is not that easy as you might think. EV implemented right would make most(90%) of the scams unfeasible. >> my real point here is that you have no idea what you expected to see in this EV information, so who cares? Well, that's one of the issues that I mentioned and it's an UI issue not an EV issue. >> If you want the company behind Google.com, don't go to Google.some.other.example and hope to somehow check that's the right company, just go to Google.com Why would I go to google.com if the link I received in my email has a gmail.com, accounts.google.co.uk or mailchip.com/clickAnalytics=google.de ? Google has many domains so why this one would not be legit? Question for you: Is this a legit paypal website? How do you know? https://www.paypal-prepaid.com/account/login https://www.paypal-prepaid.com/account/login
      - tialaramex 8y ago

throwawaymath 8y ago

The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They secure their website with regular domain validated TLS, get a domain that looks halfway decent compared to the real one, and users never even look for the extended validation certificate. Trying to get an incorrect extended validation certificate would just add to the money and risk involved in the campaign. Since users only rarely even check them, you don't even need to bother with it. It's an ill-conceived solution to a problem which is intrinsically enabled via poor security education and habits. Expecting users who aren't sufficiently diligent to check for slightly incorrect phishing domains to look for slightly incorrect or non-existent extended validation certificates is silly. That's not a categorically different approach to the problem, it's just more of the same to the left of the domain name.

themihai 8y ago
>> The reason you haven't seen a phishing website using an EV certificate is because they don't need to even bother with it. They don't use EV certificates because they are hard, even impossible to get for many. If you also consider that domains get blacklisted by the day, phishing would become unfeasible for many. The internet would be safer with EV-everywhere. There are two issues with EV: 1. They are too expensive and hard to get/manage. We need something like Let's Encrypt so that you can submit documentation etc through an open protocol. 2. The UI is not good enough. Due the reasons above many companies didn't implement EV. I find it hard to understand why would someone remove EV with no replacement in place. How can I tell if google-domains.tld is a domain/website owned by Google Inc or a random scam website? Even a technical person is unable to tell you because there is no tool(at least I'm not aware of any) except the EV certificates.
- tialaramex 8y ago
  Funny story, you mentioned "Google Inc" and that's wrong. The company you're probably thinking of is Alphabet (does your grandmother recognise that name?) but it might be XXVI Holdings, or Google LLC or any of dozens of other subsidiaries created to remove the ability for shareholders to conduct any meaningful oversight. You can buy Alphabet stock with the ticker name GOOG, and maybe it goes up or down, but you get no ability to see whether they're losing money on AI research or gaining money on web searching, that's all now opaque internal information for a private company owned by a different private company that is merely owned by Alphabet, and so it isn't available for you to even think about. But even though I got sidetracked by a rant, my real point here is that you have no idea what you expected to see in this EV information, so who cares? You thought you wanted "Google Inc" but that doesn't even exist, a scammer could register it, and fool you, whereas the real Google, who don't own this "Google Inc" name couldn't satisfy you. Ludicrous. If you want the company behind Google.com, don't go to Google.some.other.example and hope to somehow check that's the right company, just go to Google.com
  - themihai 8y ago
    >> You thought you wanted "Google Inc" but that doesn't even exist, a scammer could register it, No, they wouldn't be able to register Google Inc and most likely not any derivate either like they do with domain names. Setting up a company is not that easy as you might think. EV implemented right would make most(90%) of the scams unfeasible. >> my real point here is that you have no idea what you expected to see in this EV information, so who cares? Well, that's one of the issues that I mentioned and it's an UI issue not an EV issue. >> If you want the company behind Google.com, don't go to Google.some.other.example and hope to somehow check that's the right company, just go to Google.com Why would I go to google.com if the link I received in my email has a gmail.com, accounts.google.co.uk or mailchip.com/clickAnalytics=google.de ? Google has many domains so why this one would not be legit? Question for you: Is this a legit paypal website? How do you know? https://www.paypal-prepaid.com/account/login https://www.paypal-prepaid.com/account/login
    - tialaramex 8y ago