14 ms·
PayPal's Beautiful Demonstration of Extended Validation FUD
- blattimwind 7y agoFirefox 66 does not show EV indicators, either, any more. But I would also like to point out that PayPal is a known bad player when it comes to phishing, so no one really should give a damn what they do, and if you do the opposite of what PayPal does in security you are probably doing better than them.
- Leace 7y agoInteresting because I've got Firefox 67 and Paypal.com does show EV indicator. Actually I see the same in Google Chrome 74.
- jve 7y agoChrome 74.0.3729.157 here on Windows. No EV indicator for paypal here.
- cpburns2009 7y agoFirefox 66.0.3 and Chromium 73.0.3683.86 on Ubuntu both show the EV indicator on PayPal.
- blattimwind 7y ago66.0.4 doesn't, Chrome 60 (old version, kept around for specific reasons) doesn't, Chromium 74 does, all on arch. "Well this is weird".
- penagwin 7y ago66.0.5 on my mac did show the EV cert indicator. Not sure if that would have been part of the .4 -> .5 release or if it's because of the os?
- Twirrim 7y ago67.0 on my Mac does. Chrome 74 does. Not sure if it's possible, but my money is on incorrect certificate deployment somewhere in the Paypal infrastructure, maybe an incomplete bundle somewhere that is affecting the "EV" evaluation.
- PuffinBlue 7y agoI replicate your findings too. FF67 and C74 in Ubuntu 19.04 shows EV certs on both.
- penagwin 7y agoI'm seeing the EV indicator with Chrome 74.0.3729.169 on Mac OSX Mojave 10.14 (18A391) Edit: I also see the EV cert on Firefox 66.0.5 and 67. I can't really tell if safari has an EV indicator or not? I really don't use it much but it looks like this https://i.imgur.com/9asQkbN.png https://i.imgur.com/9asQkbN.png Safari version 12.0 (14606.1.36.1.9)
- alistairSH 7y agoOn MacOS, Safari uses the green (as shown in your png) for EV certs. HN does not appear to have an EV cert, as it's a gray padlock (not green). And, Paypal does appear with the EV green on my Mac as well.
- SlowRobotAhead 7y agoPaypal URL is green in iPhone Safari. Normal TLS sites are black. Sites with no SSL/TLS say “Not Secured —“ before the site name.
- Semaphor 7y agoI have Firefox 69 on Windows and it does
- LeoPanthera 7y ago> But I would also like to point out that PayPal is a known bad player when it comes to phishing, so no one really should give a damn what they do, and if you do the opposite of what PayPal does in security you are probably doing better than them. I can't even imagine what you are referring to here. PayPal phishes people? Citation needed, please.
- blattimwind 7y agoPaypal does its best to make all its emails look like phishing by using a quadrizillion of different origins (stuff like paypal-service.com, paypal-australia.com.au, paypalcustomercommunication.com etc.) and routing links through another set of phishy origins and/or external third parties, and to top it all off they give bogus advice like "You can see this email is from Paypal because we are using your proper first and last name". A lot of the bigger companies are guilty of this, Google is probably one of the few exceptions, since emails from Google tend to actually originate from ...@google.com, and their logins are all handled through accounts.google.com, unlike e.g. Microsoft which still has a handful of different login portals for the same account on non-microsoft.com domains (such as "msauth.net"). E.g. Dropbox sends emails from half a dozen or so origins, Microsoft uses a bunch, too, including shit like "microsoftmail.com" which rivals some of Paypal's choices for phishiness.
- dhimes 7y agoI have found PayPal to be excellent in response to phishing attempts- but that's an N of 1 and as an outsider.
- smnrchrds 7y agoTangential question: neither McDiarmid's "Kill Sticky Headers" [0] nor its improved version [1] work on this website. Does anyone know how the bookmarklet can be changed to work here? [0] https://alisdair.mcdiarmid.org/kill-sticky-headers https://alisdair.mcdiarmid.org/kill-sticky-headers [1] https://news.ycombinator.com/item?id=19962875 https://news.ycombinator.com/item?id=19962875
- fiddlerwoaroof 7y agoIs the bookmarklet being blocked by a CSP? There should be an error in the console about that (on chrome, at least)
- smnrchrds 7y agoIndeed it is. So I guess there is no way around it?
- Someone1234 7y agoA browser extension. Most can run in a context above CSP.
- fiddlerwoaroof 7y agoYeah, interestingly enough the CSP spec says that this behavior is wrong, but browser makers don’t seem to care. https://bugzilla.mozilla.org/show_bug.cgi?id=866522 https://bugzilla.mozilla.org/show_bug.cgi?id=866522 https://bugs.chromium.org/p/chromium/issues/detail?id=233903 https://bugs.chromium.org/p/chromium/issues/detail?id=233903
- bzbarsky 7y agoWe do in fact care. I put up a fix on https://bugzilla.mozilla.org/show_bug.cgi?id=1478037 https://bugzilla.mozilla.org/show_bug.cgi?id=1478037 just yesterday which will make https://alisdair.mcdiarmid.org/kill-sticky-headers https://alisdair.mcdiarmid.org/kill-sticky-headers work in Firefox no matter what the CSP says. I fully expect to get that landed sometime in the next few weeks. Making CSP not affect bookmarklets at all (as opposed to not affecting whether they execute) is a different situation entirely, because bookmarklets by definition execute in the JS environment of the page (unlike extensions, say), so it's not really possible to tell apart things that the bookmarklet does from things the page does. For example, what should happen if the bookmarklet calls a page-defined function that then does a subresource load? What if a bookmarklet defines a function to do a subresource load that the page later calls? Note that from the point of view of the JavaScript engine the functions the bookmarklet defines and the ones the page defines are indistinguishable from each other...
- niftich 7y agoOn the HN thread on Troy's last post about this, I said [1]: "Big sites can get by with DV because people trust big sites by fiat, just by mental associations they already have to a URL. There's no benefit to Facebook having an EV cert, because literally everyone who'd want to visit Facebook knows Facebook's URL. User error about entering credentials on the wrong site -- accidentally due to typosquatting, or through leading such as phishing -- is better mitigated in other ways: multi-factor authentication (especially unproxiable such as U2F); not by making the high-profile site pay thousands of dollars for a text string in green, when there's users who fall victim to phishing from bizarre domains too." Ultimately, this is a bad example to show that EV is pointless. The biggest benefit of EV is as a flawed signal of legitimacy [1] for sites whose URLs aren't widely known and get a fair amount of first-time visitors: web presence for real-life service businesses, specialized payment portals accessed through redirects, and the like. This is because people's mental model of the trust that EV confers is broken. People typically care about whether the site they arrived at was the one they were intending to visit, which the computer can't possibly know without additional input, but EV has attained a role of serving as a flawed signal of such, because the browser bar said something that doesn't look alarmingly different. EV formalizes the vetting between legal entity and domain name, so it translates okay to entities that are firmly anchored in meatspace. But all of this chaining is trust in people's heads is done by names and strings, and experiments like stripe.ian.sh prove [2] why it's fallible. Nonetheless, EV effectively allows one extra indirection between (1) the name of the business as people refer and recognize it, and (2) the domain name that's likely correct, than DV does -- and some operators and some visitors benefit from this indirection, when the URL doesn't roll off the tongue. [1] https://news.ycombinator.com/item?id=18010961#18011914 https://news.ycombinator.com/item?id=18010961#18011914 [2] https://news.ycombinator.com/item?id=15904513#15909273 https://news.ycombinator.com/item?id=15904513#15909273
- linsomniac 7y agoTrue, but using visual inspection of the URL is problematic too: Do you mean to be at apple.com or аpple.com ? www.xudongz.com/blog/2017/idn-phishing/
- 7y ago
- lmm 7y agoHow long ago was it that users didn't notice or care if the URL was http:// http:// rather than https:// https://? Yet no-one was declaring HTTPS dead on those grounds.
- failrate 7y agoHTTPS has a tangible benefit beyond making the user feel comfortable: it secures the information channel.
- scrollaway 7y agoApples and encrypted oranges. There's no actual technical difference between EV and DV for the end user, much unlike https vs http... Why does my comment have to be spelled out anyway? I'm having a hard time believing you don't know that or haven't realized it.
- lmm 7y ago> Apples and encrypted oranges. There's no actual technical difference between EV and DV for the end user, much unlike https vs http... What does it matter to the end user whether the difference is technical, legal, or procedural? The user just wants to be able to tell the difference between a legit site and a phishing spoof. > Why does my comment have to be spelled out anyway? I'm having a hard time believing you don't know that or haven't realized it. The article points out that users and paypal didn't care that their domain wasn't using EV, as if this were a slam-dunk argument against it. But that argument would go through just the same for a domain that wasn't using HTTPS at all.
- scrollaway 7y agoThe difference matters because http vs. https makes a difference regardless of what the user or HN commenters think, whereas EV relies entirely on the user acting in a way that is entirely theoretical and not seen in practice.
- deleted 7y ago[deleted]
- JohnFen 7y agoI'm one of those who doesn't pay any attention to those EV cards at all. I know I probably should, just out of completeness, but I don't. In fact, with Firefox anyway, that spot where the EV indicator goes is used for enough weird little things that I've sorta developed a blindness to anything that appears there (I'm not saying that's a good thing!) However, if I'm going to a site that really matters, I'm not clicking on some link on a web page or email somewhere. I'm using the link I've bookmarked. So, ignoring the EV cert is probably not putting me at too much risk.
- GordonS 7y ago> I'm one of those who doesn't pay any attention to those EV cards at all The point is, you'd be an outlier if you did!
- icebraining 7y agoThe problem is that EVs never got really widespread - even well-known, important sites never used it. So you have to remember if that particular site used to have one, which is a much harder requirement.
- syn0byte 7y agoI (used to) implement EV certs among other duties and I don't pay attention to them either. Step One: Create Doofenshmirtz Evil LLC. Step Two: Register HugsAndTrustBanking.com to LLC Step Three: Get the legal services of Dewy Cheetum & Howe to issue a letter stating Evil LLC is your legitimate business. Step Three: Show CA "proof" of ownership for Doofenshmirtz Evil LLC and HugsAndTrustBanking.com. Step Four: Get genuine EV cert for your shady scam operation. Step Five: Profit. EV certs are dumb, you can trust me on that[0]. [0]https://i.imgur.com/1dbJUQ9.jpg https://i.imgur.com/1dbJUQ9.jpg
- RcouF1uZ4gsC 7y agoSteps 1-3 generate quite a paper trail for you and step 3 generates a paper trail for Dewy Cheetum & Howe. Without an EV Certificate, you can just buy a domain name and use LetsEncrypt to generate a DV certificate which is a much smaller paper trail.
- unilynx 7y ago> Note: yes, I know there can be regulatory requirements for EV in some jurisdictions, but let's not confuse that with it actually doing anything useful That exactly. Similarly confused about customers who think OV certificates are better than DV - as far as I can tell no end user knows how to tell those apart in their browser (no 'green' locks...)
- captn3m0 7y agoI run infra for a payments company and switched our main website from EV to DV last month silently. This is the landing website, not the application (which had always been DV). There have been ZERO people who have noticed, including peers in my Infra or Security teams.
- judge2020 7y agoI think a monitoring service that notifies you when the certificate changes would be useful (although it's fine to rely on CAA records)
- tialaramex 7y agoIf you're a site operator, it could definitely make sense to have cert checks (e.g. can I assess this cert as trustworthy, will it still be valid 28 days from now) as part of your high level system dashboard. A site with a busted cert is as broken as one that gives 404 errors to all visitors or crashes and won't load at all. Having somebody else do this for you makes some sense, but again it makes sense as part of a whole system dashboard, you care if your site gives 404s to everyone outside the VPN as well. Bad guys _mostly_ don't start by getting illegitimate certs issued. For the DNS hijack stuff for example, even where a cert was issued we see it significantly _after_ the traces of the hijack are visible. The bad guys lie in DNS and _then_ they might get themselves certs so they can run an HTTPS site, you ideally want to detect the DNS hijack as otherwise you're already playing catchup before the first pager alert happens, and these attacks may last just hours or even minutes, so every second counts. Without DNS hijack, they're mostly doing phishing, so you won't see new certs for your site, because you know you're legitimate.site.example and not legit-site.example or login-legit.badguys.example. Your customers, alas, not so much.
- rocqua 7y agoYou can get MitM on a smaller scale by simply spoofing WiFi SSIDs. It used to be that spoofed WiFi and SSL-strip (a program that terminates all HTTPS connections and forwards them as HTTP) would work pretty well for that. These days HSTS should stop most of that. HSTS has been adopted by the big ones, (e.g. gmail, paypal, lastpass). I'd say these are also the ones where it might work out to drop a pineapple in some NYC coffeeshops. It isn't widely deployed though, so it'll still do some damage. I guess criminals don't wanna do the sleuthing to figure out where they found creds.
- nailer 7y agoSpeaking of FUD: > "the true meaning of SSL certificates" The certificate fields for organisation, city, etc have existed and were expected to be verified since SSL was created in the nineties. Anyone who has ever made a CSR knows this. Rolling back from checking the organisation to domain-only validation in 2003 was GeoTrust trying to increase profit margins. Again, Troy should already know this and it's surprising he doesn't seem to. Oddly enough Troy also Tweets from a verified account, which seems somewhat unusual since a well known username should be enough according to his logic against verifying websites. Heads up: I run CertSimple, a startup that does faster, simpler verification for EV.
- tialaramex 7y agoI don't want this to end badly for you (via CertSimple), but as you perhaps come to anticipate my primary concern is always preventing Future Harm. EV hasn't been effective for that purpose. The article I've just read never uses the phrase "the true meaning of SSL certificates" that I can see, if that was removed I apologise but otherwise I think I have to assume you're putting words in Troy's mouth. "The certificate fields for organisation, city, etc have existed and were expected to be verified since SSL was created in the nineties. Anyone who has ever made a CSR knows this." Anyone who understands what's actually going on here knows that these are part of the X.500 directory system and are present in Netscape's SSL because it leverages that systems's X.509 certificate format. In 1999 PKIX (RFC 2459) proposes how to use this system sensibly with the Internet and the modern Web PKI largely falls out of that and its successor documents. Prior to the CA/B Forum (and the creation of Extended Validation) the only promises you had about what, if anything, in certificates you relied on had been "verified" and to what extent, was written in the legal documents of the issuing CA. In most cases they disclaimed all or almost all responsibility to the extent possible. Their methods were... unsound. Even today, when if you run Firefox (or more or less, Android) you can actually trust that someone cares whether the validation was done properly, it's more slip-shod than any of us should want. What has Certinomis been up to for the past few years? What are all these certificates doing with ST=Some-State (yes, literally the words "Some-State", because that's the default in OpenSSL)? or L=Default City (again, the default in OpenSSL)? I think we can reasonably conclude that the reason nobody engaged with my questions about those is that the answers would be embarrassing and they're hoping that if they stay quiet nobody will follow up by asking why they're filling this crap out (to make money) if they can't validate it properly...
- geekpowa 7y ago"PayPal really doesn't care that the world's most popular browser no longer displays the EV visual indicator." OT but hopefully interesting: Paypal doesn't care about many things. Like keeping their callback JVMs up2date, or changing their UAs from defaults to disguise their enabling tech. 2019.05.20 xxxx|173.0.81.33|xxxx|POST xxxx/paypal/callback HTTP/1.1|200|954|-|Java/1.8.0_60|xxx|xxxxxxx 2
- nikanj 7y agoI'm really happy that Paypal ops is not upgrading anything just for the sake of upgrading it. At that scale, changes should be approached with extreme caution.
- jmgrosen 7y agoWell, perhaps they should upgrade it for the sake of the ~170 CVEs that have been published against Java 1.8.0_60? https://www.cvedetails.com/vulnerability-list.php?vendor_id=93&product_id=19116&version_id=&page=4&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=597&sha=52d5e2189c154fbfa1e3d4ba0a13fc6b00642bc4 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... Sure, a lot of those probably don't apply to how they're using Java, but I'd bet at least a couple do.
- Rebelgecko 7y agoThey're missing out on probably dozens of security fixes from the past 4 years. Unless they depend on buggy behavior, it is incredibly unlikely that they'll have any backwards compatibility issues, and hopefully they would have tests they could run against a newer JVM to help surface those issues.
- jzl 7y agoI'm surprised no one has mentioned the main practical benefit of EV certs: the fact that a green cert in the browser ensures that there is no man-in-the-middle network proxy/appliance intercepting the traffic even if a trusted certificate for the proxy/appliance (or bad guy) has been placed in your machine's cert store. Browsers will only honor the EV setting in the cert if it was signed by a hardwired (and much shorter) list of CAs. As long as you, the user, trust that the browser itself hasn't been modified (for example if you downloaded it yourself), then it's a nice reassurance when using a browser in a not totally trusted environment.
- CherryJimbo 7y agoBrowsers are moving away from showing differences between EV and DV certs nowadays though. And anyone can register a company name and get an EV cert - that doesn't make it trusted. https://stripe.ian.sh/ https://stripe.ian.sh/ is a prime example of this. HTTPS is a nice reassurance, sure, but an EV cert isn't.
- LeoPanthera 7y ago> https://stripe.ian.sh/ https://stripe.ian.sh/ is a prime example of this. It used to be. All his EV certs were revoked.
- CherryJimbo 7y agoSure, but my point doesn't change. https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-ca/ https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-c... is a good write-up about that.
- nailer 7y agoCompany homonyms are an issue, albeit a US specific one. The industry is looking at verifying trademarks, which tend to be monopolies.
- headsoup 7y agoThe article is precisely about this: regardless of practical use, people don't follow the behaviour associated with supporting that practice, so it's worthless. And people who would follow the correct behaviour...are probably capable of doing so without the EV anyway.
- good_guy 7y agoPayPal is a shitty company though.
- Mbaqanga 7y ago"PayPal really doesn't care that the world's most popular browser no longer displays the EV visual indicator." Funny story - I was about to rant that yeah, it probably wasn't by design because Paypal still as of 2019 didn't offer 2FA which, for a payment company, was quite disturbing... well, turns out I was wrong, they now do. I just hadn't checked in a while, and of course received no email about it when they did turn it on... or maybe just missed it. Typically something you should advertise on each login if it's not activated, but hey, who cares, it's just money after all.
- jtdowney 7y agoPayPal was very early in the 2FA movement, hardware security keys were available starting in ~2008 (https://systembash.com/using-the-paypal-verisign-security-key-with-openid-for-two-factor-authentication/ https://systembash.com/using-the-paypal-verisign-security-ke...). If you're referring to app based TOTP that is a relatively new option. I was prompted to change to TOTP when I logged in.