3 ms·

> It's really about that accountability - what are you going to do against an internet entity which scammed you? How effective is that action going to be? Acco

> It's really about that accountability - what are you going to do against an internet entity which scammed you? How effective is that action going to be? Accountability was supposed to be the extra value of OV and EV certificates. If you look at the cert for https://www.walmart.com/ https://www.walmart.com/, you see the following Subject fields: Common Name = www.walmart.com Organization = "Wal-Mart Stores, Inc." Locality = Bentonville State = Arkansas Country = US The certificate authority (GlobalSign in this case) is attesting that this is accurate identification information for this company--that you can use this information to locate legal records for the company and contact it, sue it, investigate it, prosecute it, etc. DV certs do not have the bottom 4 fields. That's what the famous "green banner" in the address bar was supposed to convey--that this website has a paper trail that can be used to impose accountability. That's NOT a guarantee that the website will treat you well. It is a guarantee that you can try to do something if it doesn't. Even if a corporation is only established temporarily for the purposes of getting an EV cert to run a scam, that still leaves a legal paper trail. DV certs do not. And this is a standards-based distributed system. It doesn't rely on one company like Google or Microsoft, or one particular browser, or even one particular CA. If Wal-Mart doesn't like GlobalSign anymore, they can go to another CA like Digicert. If you don't like Chrome, you can use Firefox--they can both read this cert information equally well. IMO it is really a shame that the Internet industry was not able to lean into this concept of accountability. For example, why don't browsers surface this company contact info directly to consumers? The way that a consumer can easily find the street address for a store they visit? Instead it's buried 4 clicks deep in a complicated cert menu. Why don't they supplement it with a link to the corporate record of the company? Or to the Dun and Bradstreet listin? Or to the police department website in the registered locality? (Bentonville, AR in the case of Walmart) Or to the Better Business Bureau in that state? It just seems like there was been the opposite of innovation into this concept of using certs to provide IRL accountability for websites.

Dylan16807 7y ago
For accountability: Knowing who to sue doesn't really get my $50 back from some jerk. The effort put into small claims makes it a net loss. My best option is a chargeback, and the cert doesn't do anything. For reputation: I have no idea if that's the company name of Wal-Mart. It's barely better than verifying the domain name.
- snowwrestler 7y ago
  If you walked into a store on Main Street and got scammed for $50, would you just throw up your hands? Or would you call the cops? If you did call the cops, they would have the address of the store to start their investigation. And aside from maybe getting you your $50 back, the state might prosecute the scammer for committing a crime. EV and OV certs are intended to provide similar information. If you report a scam by a website with an EV or OV cert, the police can use the information in the cert to start their investigations. There's more to accountability than small claims court. Setting aside the cert issue, it's just striking how many people take it for granted that there are no consequences and no recourse for online crimes. How did we come to accept this as normal, as a society?
  - Dylan16807 7y ago
    In person I'd try some things. Online I really doubt the cops are going to care about $50. > How did we come to accept this as normal, as a society? Probably because it's so much harder to pin down specific actors. That cert only does so much.

Dylan16807 7y ago

For accountability: Knowing who to sue doesn't really get my $50 back from some jerk. The effort put into small claims makes it a net loss. My best option is a chargeback, and the cert doesn't do anything. For reputation: I have no idea if that's the company name of Wal-Mart. It's barely better than verifying the domain name.

snowwrestler 7y ago
If you walked into a store on Main Street and got scammed for $50, would you just throw up your hands? Or would you call the cops? If you did call the cops, they would have the address of the store to start their investigation. And aside from maybe getting you your $50 back, the state might prosecute the scammer for committing a crime. EV and OV certs are intended to provide similar information. If you report a scam by a website with an EV or OV cert, the police can use the information in the cert to start their investigations. There's more to accountability than small claims court. Setting aside the cert issue, it's just striking how many people take it for granted that there are no consequences and no recourse for online crimes. How did we come to accept this as normal, as a society?
- Dylan16807 7y ago
  In person I'd try some things. Online I really doubt the cops are going to care about $50. > How did we come to accept this as normal, as a society? Probably because it's so much harder to pin down specific actors. That cert only does so much.