4 ms·

I run infra for a payments company and switched our main website from EV to DV last month silently. This is the landing website, not the application (which had

I run infra for a payments company and switched our main website from EV to DV last month silently. This is the landing website, not the application (which had always been DV). There have been ZERO people who have noticed, including peers in my Infra or Security teams.

judge2020 7y ago
I think a monitoring service that notifies you when the certificate changes would be useful (although it's fine to rely on CAA records)
- tialaramex 7y ago
  If you're a site operator, it could definitely make sense to have cert checks (e.g. can I assess this cert as trustworthy, will it still be valid 28 days from now) as part of your high level system dashboard. A site with a busted cert is as broken as one that gives 404 errors to all visitors or crashes and won't load at all. Having somebody else do this for you makes some sense, but again it makes sense as part of a whole system dashboard, you care if your site gives 404s to everyone outside the VPN as well. Bad guys _mostly_ don't start by getting illegitimate certs issued. For the DNS hijack stuff for example, even where a cert was issued we see it significantly _after_ the traces of the hijack are visible. The bad guys lie in DNS and _then_ they might get themselves certs so they can run an HTTPS site, you ideally want to detect the DNS hijack as otherwise you're already playing catchup before the first pager alert happens, and these attacks may last just hours or even minutes, so every second counts. Without DNS hijack, they're mostly doing phishing, so you won't see new certs for your site, because you know you're legitimate.site.example and not legit-site.example or login-legit.badguys.example. Your customers, alas, not so much.
  - rocqua 7y ago
    You can get MitM on a smaller scale by simply spoofing WiFi SSIDs. It used to be that spoofed WiFi and SSL-strip (a program that terminates all HTTPS connections and forwards them as HTTP) would work pretty well for that. These days HSTS should stop most of that. HSTS has been adopted by the big ones, (e.g. gmail, paypal, lastpass). I'd say these are also the ones where it might work out to drop a pineapple in some NYC coffeeshops. It isn't widely deployed though, so it'll still do some damage. I guess criminals don't wanna do the sleuthing to figure out where they found creds.
    - sokoloff 7y ago
      I didn't think SSL-strip could work as described (unless you trusted the cert chain), so I did a little reading. It seems like it works by intercepting traffic and downgrading the attacked machine's connections to http. So, your text is correct; it is terminating the https connection "the other way 'round" from the way I first read your text. It's https from the MITM machine to the "real" server, but http from the browser to the MITM machine, rather than the MITM machine being able to terminate the https session from the browser (without a cert error). Sharing in case that helps someone else not have to google for "hey, I don't think that will work the way it's described".
      - rocqua 7y ago
        Thanks for the clarification. I can't edit the original post anymore, so your reply will have to do.
jiveturkey 7y ago
You work in infra for a payments company where the security folks didn't notice a certificate change? Please name the site! (so I can avoid them at all costs)
- captn3m0 7y ago
  Should have clarified, nobody noticed that the new cert was not EV.
snowwrestler 7y ago
It's obvious that EV does nothing for end users these days, which is why I think these "EVs are useless" articles from Troy and others are kind of silly, like dunking over a person with two broken legs. I think the far more interesting question is why EV certs do nothing for end users, and why browser makers have not introduced any new features to replace what EV certs were intended to do: help end users understand which websites they can trust on first visit. The entire Internet industry has absolutely punted on this problem. It's a hard problem, but no one is trying to solve it! And it is absolutely striking to compare against how well this problem has been solved in real life, at least in the U.S. You can walk into any retail establishment in the nation and reasonably expect to have a safe, productive interaction with a proprietor you don't know--even on the first visit. It's the exact opposite on the Internet, and it's insane that everyone just accepts that.
- viraptor 7y ago
  > this problem has been solved in real life, at least in the U.S. I haven't spent enough time in the US to have an opinion about it, but in many places this is not true. For example, taxi services in many countries seem to pretty commonly be ripe for dodgy behaviours with little accountability. It's really about that accountability - what are you going to do against an internet entity which scammed you? How effective is that action going to be?
  - snowwrestler 7y ago
    > It's really about that accountability - what are you going to do against an internet entity which scammed you? How effective is that action going to be? Accountability was supposed to be the extra value of OV and EV certificates. If you look at the cert for https://www.walmart.com/ https://www.walmart.com/, you see the following Subject fields: Common Name = www.walmart.com Organization = "Wal-Mart Stores, Inc." Locality = Bentonville State = Arkansas Country = US The certificate authority (GlobalSign in this case) is attesting that this is accurate identification information for this company--that you can use this information to locate legal records for the company and contact it, sue it, investigate it, prosecute it, etc. DV certs do not have the bottom 4 fields. That's what the famous "green banner" in the address bar was supposed to convey--that this website has a paper trail that can be used to impose accountability. That's NOT a guarantee that the website will treat you well. It is a guarantee that you can try to do something if it doesn't. Even if a corporation is only established temporarily for the purposes of getting an EV cert to run a scam, that still leaves a legal paper trail. DV certs do not. And this is a standards-based distributed system. It doesn't rely on one company like Google or Microsoft, or one particular browser, or even one particular CA. If Wal-Mart doesn't like GlobalSign anymore, they can go to another CA like Digicert. If you don't like Chrome, you can use Firefox--they can both read this cert information equally well. IMO it is really a shame that the Internet industry was not able to lean into this concept of accountability. For example, why don't browsers surface this company contact info directly to consumers? The way that a consumer can easily find the street address for a store they visit? Instead it's buried 4 clicks deep in a complicated cert menu. Why don't they supplement it with a link to the corporate record of the company? Or to the Dun and Bradstreet listin? Or to the police department website in the registered locality? (Bentonville, AR in the case of Walmart) Or to the Better Business Bureau in that state? It just seems like there was been the opposite of innovation into this concept of using certs to provide IRL accountability for websites.

judge2020 7y ago

I think a monitoring service that notifies you when the certificate changes would be useful (although it's fine to rely on CAA records)

tialaramex 7y ago
If you're a site operator, it could definitely make sense to have cert checks (e.g. can I assess this cert as trustworthy, will it still be valid 28 days from now) as part of your high level system dashboard. A site with a busted cert is as broken as one that gives 404 errors to all visitors or crashes and won't load at all. Having somebody else do this for you makes some sense, but again it makes sense as part of a whole system dashboard, you care if your site gives 404s to everyone outside the VPN as well. Bad guys _mostly_ don't start by getting illegitimate certs issued. For the DNS hijack stuff for example, even where a cert was issued we see it significantly _after_ the traces of the hijack are visible. The bad guys lie in DNS and _then_ they might get themselves certs so they can run an HTTPS site, you ideally want to detect the DNS hijack as otherwise you're already playing catchup before the first pager alert happens, and these attacks may last just hours or even minutes, so every second counts. Without DNS hijack, they're mostly doing phishing, so you won't see new certs for your site, because you know you're legitimate.site.example and not legit-site.example or login-legit.badguys.example. Your customers, alas, not so much.
- rocqua 7y ago
  You can get MitM on a smaller scale by simply spoofing WiFi SSIDs. It used to be that spoofed WiFi and SSL-strip (a program that terminates all HTTPS connections and forwards them as HTTP) would work pretty well for that. These days HSTS should stop most of that. HSTS has been adopted by the big ones, (e.g. gmail, paypal, lastpass). I'd say these are also the ones where it might work out to drop a pineapple in some NYC coffeeshops. It isn't widely deployed though, so it'll still do some damage. I guess criminals don't wanna do the sleuthing to figure out where they found creds.
  - sokoloff 7y ago
    I didn't think SSL-strip could work as described (unless you trusted the cert chain), so I did a little reading. It seems like it works by intercepting traffic and downgrading the attacked machine's connections to http. So, your text is correct; it is terminating the https connection "the other way 'round" from the way I first read your text. It's https from the MITM machine to the "real" server, but http from the browser to the MITM machine, rather than the MITM machine being able to terminate the https session from the browser (without a cert error). Sharing in case that helps someone else not have to google for "hey, I don't think that will work the way it's described".
    - rocqua 7y ago
      Thanks for the clarification. I can't edit the original post anymore, so your reply will have to do.

jiveturkey 7y ago

You work in infra for a payments company where the security folks didn't notice a certificate change? Please name the site! (so I can avoid them at all costs)

captn3m0 7y ago
Should have clarified, nobody noticed that the new cert was not EV.

snowwrestler 7y ago

It's obvious that EV does nothing for end users these days, which is why I think these "EVs are useless" articles from Troy and others are kind of silly, like dunking over a person with two broken legs. I think the far more interesting question is why EV certs do nothing for end users, and why browser makers have not introduced any new features to replace what EV certs were intended to do: help end users understand which websites they can trust on first visit. The entire Internet industry has absolutely punted on this problem. It's a hard problem, but no one is trying to solve it! And it is absolutely striking to compare against how well this problem has been solved in real life, at least in the U.S. You can walk into any retail establishment in the nation and reasonably expect to have a safe, productive interaction with a proprietor you don't know--even on the first visit. It's the exact opposite on the Internet, and it's insane that everyone just accepts that.

viraptor 7y ago
> this problem has been solved in real life, at least in the U.S. I haven't spent enough time in the US to have an opinion about it, but in many places this is not true. For example, taxi services in many countries seem to pretty commonly be ripe for dodgy behaviours with little accountability. It's really about that accountability - what are you going to do against an internet entity which scammed you? How effective is that action going to be?
- snowwrestler 7y ago
  > It's really about that accountability - what are you going to do against an internet entity which scammed you? How effective is that action going to be? Accountability was supposed to be the extra value of OV and EV certificates. If you look at the cert for https://www.walmart.com/ https://www.walmart.com/, you see the following Subject fields: Common Name = www.walmart.com Organization = "Wal-Mart Stores, Inc." Locality = Bentonville State = Arkansas Country = US The certificate authority (GlobalSign in this case) is attesting that this is accurate identification information for this company--that you can use this information to locate legal records for the company and contact it, sue it, investigate it, prosecute it, etc. DV certs do not have the bottom 4 fields. That's what the famous "green banner" in the address bar was supposed to convey--that this website has a paper trail that can be used to impose accountability. That's NOT a guarantee that the website will treat you well. It is a guarantee that you can try to do something if it doesn't. Even if a corporation is only established temporarily for the purposes of getting an EV cert to run a scam, that still leaves a legal paper trail. DV certs do not. And this is a standards-based distributed system. It doesn't rely on one company like Google or Microsoft, or one particular browser, or even one particular CA. If Wal-Mart doesn't like GlobalSign anymore, they can go to another CA like Digicert. If you don't like Chrome, you can use Firefox--they can both read this cert information equally well. IMO it is really a shame that the Internet industry was not able to lean into this concept of accountability. For example, why don't browsers surface this company contact info directly to consumers? The way that a consumer can easily find the street address for a store they visit? Instead it's buried 4 clicks deep in a complicated cert menu. Why don't they supplement it with a link to the corporate record of the company? Or to the Dun and Bradstreet listin? Or to the police department website in the registered locality? (Bentonville, AR in the case of Walmart) Or to the Better Business Bureau in that state? It just seems like there was been the opposite of innovation into this concept of using certs to provide IRL accountability for websites.