7 ms·

It's actually kind of unfortunate, as in some ways an organization's name is a much more meaningful expression of identity than a domain name is. When I visit t

It's actually kind of unfortunate, as in some ways an organization's name is a much more meaningful expression of identity than a domain name is. When I visit the website for my bank, I don't really care that the entity I'm communicating with owns "mybank.com". What I, and I suspect most people, are really concerned with is that the entity they're communicating with is the same physical, real-world organization they opened a bank account with in the past. The problem is that legal corporation names are much harder to verify than domain names, and even once verified they don't always match user expectations (as Ian Carroll so aptly demonstrated with his Stripe Inc. certificate). Furthermore, and perhaps partially as a result of the aforementioned issues, browsers don't treat EV certificates in a way which would allow any meaningful security guarantees to be built on top of them. I wonder if there are ways this situation could be improved. Brand names, for example, are probably more likely to match user expectations than legal company names. Perhaps an alternative to EV could be built around that idea.

robocat 7y ago
It would require an international register. You can surely get "Stripe Inc" in another country i.e. it isn't just an issue that can be solved at a federal level. Neither are trademarks useful because they are: per nation, per class (of goods or services), and are not pure text (icon matters).
- Ajedi32 7y ago
  In theory, there's no reason why an icon couldn't be signed and displayed alongside the pure text label.
  - rocqua 7y ago
    Near collisions of logos (i.e. off by a few pixels) would register as different. You don't want to rely on trademark suits to kill those logos, as it takes a lot less effort to create a logo than it does to sue it out of existence.
- nailer 7y ago
  Stripe (Financial Services) [US] works pretty well. It's been suggested to Google by DigiCert. Google is not interested.
  - iancarroll 7y ago
    Yes, displaying "Stripe (The Real One)" would work pretty well too. Nobody (that I have seen) has proposed any way to summarize the asinine world of trademarks into either. And that is just one, US-centric, piece of the puzzle. We got into a terrible situation with corporate legal entities; trademarks will not help either. (Also pretty disappointed you are not going to point out the fact you run a company dedicated to selling EV certificates: https://certsimple.com/ https://certsimple.com/)
    - nailer 7y ago
      Hi Ian, I pointed my job out in the first sentence of my first reply on this page. I've also discussed how trademark information could be incorporated into verification markers extensively with Ryan Sleevi on Twitter. You should follow us both if you missed the discussion.
  - novaleaf 7y ago
    That doesn't seem to stop the article's example though.
    - nailer 7y ago
      Stripe (the one you love) has a trademark on financial services in the US, granting them a monopoly on the name 'Stripe' here.
      - akerl_ 7y ago
        Who decides the categories? For example, what would the category say next to a cert for Amazon? Google? Netflix? What would the cert say for Slack (who pivoted from one industry to another)? Attempting to embed additional visible info in the cert requires some centralized consensus, and trusted validation that certs being provisioned match the consensus. And all of this occurs despite the continued fact that end users do not even look at the certificate information anyways, so we’ve deployed a new central body with a bunch of administrative overhead and not moved the needle on actual security.
ozim 7y ago
It does not matter. Main point is: "reliance on the absence of a positive visual indicator was simply never a good idea in the first place". Even if you would have reasonable alternative such as brand name or else, simply having this in address bar in green does not help people to differentiate phishing sites without brand name in progress bar. People see the same layout and colors on the page and assume it is correct one.
- Ajedi32 7y ago
  Sure, but a few years ago the same was true of the visual indicators for plain DV https. Browsers responded with an effort to increase adoption of DV certs to the point where positive indicators for encrypted connections could be replaced by negative indicators for unencrypted connections. Could a similar approach not also work with EV certs? I acknowledge it's a bit harder, since not every site necessarily _needs_ full identity verification. (I don't really care about the legal entity that owns Hacker News, for example, I just care that it's the same site I signed up for back when I first created my account.) But for the sites where it _does_ matter, there's no reason why efforts couldn't be made to shift towards negative security indicators. (For example, perhaps browsers could warn users when the legal entity that owns a site changes.)
- nailer 7y ago
  Literally everyone on the Chrome Security UX team tweets from a verified account. Even Troy Hunt does.
  - rocqua 7y ago
    That would be a pretty decent approach, but an EV cert does not assert that: > This key belongs to the owner of this domain name AND this domain name matches this business name. Instead, an EV cert comes with an extra name (the official business name) and then asserts: > This key belongs to the owner of this domain name AND this key belongs to the owner of this other business name Hence you get the image [1] of a website www.thesslstore.com but EV business name 'Rapid Web Services LLC'. Should that really mean that this counts as a 'verfied' domain that gets a tick-mark? That said, switching to a system more like the first assertion, and going with the 'verified' tick mark could work. It would make validating EV certs a lot harder though, as it requires a more subjective judgement to make. (e.g. could you validate windows.com for the company microsoft? What about youtu.be for youtube) Making a wrong judgement here should look pretty bad for a cert-issuer. [1] https://www.troyhunt.com/content/images/2019/08/image-4.png https://www.troyhunt.com/content/images/2019/08/image-4.png
skybrian 7y ago
The names that people are familiar with come from branding and publicity - that is, advertising, news, social media, and so on. This affects the web pages that search engines crawl, what users search for, and also which websites rank higher. I'm not sure how someone would do better than search engines? Searching for the company you're looking for usually works. You can imagine inventing a more systematic approach to assigning names, but it would be like using scientific names for animals instead of common names. Domain names serve this purpose already. What we really want is to document popular usage. One systematic approach to tracking popular usage might be to treat this like creating a dictionary. However the dictionary compilers are always going to lag popular usage. This is why Yahoo's directory-based approach lost out to Google. The closest thing we have now is Wikipedia and Google gets that data via crawling. I guess you could say that human languages are not entirely secure due to being a bit nebulous, but it's the best we have for humans referring to things they remember. If you want to be precise, you need to remember, record, or communicate the domain name.
- Ajedi32 7y ago
  Yes, search engines do serve a similar purpose. It's not a very rigorous solution though, and there are plenty of ways to get to a website that don't involve going through a search engine. Leaving aside the UX, I think there's also some value in providing legal authorities with a smoking gun in situations where phishing or other illegal activity does occur using a domain with a EV certificate. The extent to which current EV certs serve that purpose is debatable, but the idea is has merit.
- heavenlyblue 7y ago
  .ac.uk is reserved only for education. Simply having an e-mail on one of these domains implies access to e.g. free GitHub accounts. We could have something akin to .bank.uk for banking purposes (you are only allowed go have one if you have a banking license).
  - davchana 7y ago
    I think the new gTld .bank is marketing itself for banks in that way, making sure only real banks get.bank
ocdtrekkie 7y ago
Fixing EV would mostly entail making it a more exclusive club (not an "I have $400 to blow" club, but a "this is a household name" club) and shoring up the requirements to get one. Far from an insurmountable task. Everyone should not have an EV, but everyone should know that if you're doing business with a bank or a major store they should have an EV.
- aeternus 7y ago
  The problem with EV is how do you handle companies with the same name? Many banks have similar and in some cases the same name. The domain name system already handles this by enforcing uniqueness and leveraging the market.
  - ocdtrekkie 7y ago
    There's no reason EV policy can't be modified to also enforce uniqueness. In fact, that's what I'd expect if we're only giving EVs to household names. Banks which have the same name as other banks should change their name, but we should tie EVs for banks to existing financial system institutions. For example, most banks in the US have an FDIC number, so our EV validators in the US can tie a bank to it's FDIC registration, and the user can cross-reference their bank with that as well. Basically if I'm a bank customer, I should have a unique identifier on my check or debit card which can be cross-referenced with the EV cert.
    - aeternus 7y ago
      How do you decide which one needs to change its name? There's no objective measure for which is 'larger'. The vast majority of consumers are not going to lookup an FDIC number, and even if they did, it is still not optimal since banks regularly merge which would cause confusion.
      - yjftsjthsd-h 7y ago
        I don't think we really care, do we? I'm not really worried that I connected to First Bank rather than Second Bank, since both are legitimate banks; what I want is to ensure that I didn't accidentally connect to Second Bannk, the local fraud shop. "Is this site controlled by a FDIC-registered organization" is probably good enough™.
qwerty456127 7y ago
I doubt many users care about certificates beyond it's not red.
lone_haxx0r 7y ago
URL <=> Brand relationships are purely human politics. I prefer technology to deal with technical issues and present a relatively formal interface to the end user. Human politics are complex. Any interface that abstracts human politics and legal issues will have to deal with so many corner cases that its interface will either be unreliable or more complex than URLs.
3xblah 7y ago
Thought experiment: Let's say you decide to phone someone who works for the bank. How do you know the phone number you have is correct? What if phone numbers were perceived to be "dynamic" -- subject to change at any time, even by the hour, without notice to you -- such that you could not rely on a consistent, stable phone number for any reasonable length of time. What if, instead, you would need to look up the number every time you make a call? What if phone numbers were thought to be too difficult for people to remember, so someone decided that all you needed was the name of the person at the bank. (Even though that name may belong to many different people across the world.) What if someone further decided that the lookup should handled by someone else. No need for you to be involved in that process. How could you be sure you were calling the intended bank employee?
- eridius 7y ago
  It sounds like you're describing IP addresses, except people don't type in IP addresses to go to their bank. They type in domains. In fact, phone numbers are absolutely the equivalent of domains, and the equivalent of IP addresses in the telephone system is IMSI (I think). You can transfer phone numbers between subscribers, and so the number that you thought was going to your bank could actually some day go somewhere completely different.
  - 3xblah 7y ago
    In the hypothetical, assume you are calling a bank employee on a landline. IMSI is for mobile.
    - eridius 7y ago
      Ok, then whatever the equivalent is for landlines. I don't know how telephone numbers are assigned to particular physical lines, but however that's done, it can be changed.
      - 3xblah 7y ago
        So, a landline phone number that theoretically changes so frequently and without notice to you such that you are encouraged to keep looking it up again everyday. Except you are not expected to perform or monitor that process. Instead it is automated and hidden from you. Imagine this creates risk of fraud by someone pretending to be the bank employee, so then you rely on a third party to "validate" the number you obtain for the bank employee.
rini17 7y ago
Yes it's kind of ridiculous DNS ignores whole existing trademark system, except when there's a direct conflict.

robocat 7y ago

It would require an international register. You can surely get "Stripe Inc" in another country i.e. it isn't just an issue that can be solved at a federal level. Neither are trademarks useful because they are: per nation, per class (of goods or services), and are not pure text (icon matters).

Ajedi32 7y ago
In theory, there's no reason why an icon couldn't be signed and displayed alongside the pure text label.
- rocqua 7y ago
  Near collisions of logos (i.e. off by a few pixels) would register as different. You don't want to rely on trademark suits to kill those logos, as it takes a lot less effort to create a logo than it does to sue it out of existence.
nailer 7y ago
Stripe (Financial Services) [US] works pretty well. It's been suggested to Google by DigiCert. Google is not interested.
- iancarroll 7y ago
  Yes, displaying "Stripe (The Real One)" would work pretty well too. Nobody (that I have seen) has proposed any way to summarize the asinine world of trademarks into either. And that is just one, US-centric, piece of the puzzle. We got into a terrible situation with corporate legal entities; trademarks will not help either. (Also pretty disappointed you are not going to point out the fact you run a company dedicated to selling EV certificates: https://certsimple.com/ https://certsimple.com/)
  - nailer 7y ago
    Hi Ian, I pointed my job out in the first sentence of my first reply on this page. I've also discussed how trademark information could be incorporated into verification markers extensively with Ryan Sleevi on Twitter. You should follow us both if you missed the discussion.
- novaleaf 7y ago
  That doesn't seem to stop the article's example though.
  - nailer 7y ago
    Stripe (the one you love) has a trademark on financial services in the US, granting them a monopoly on the name 'Stripe' here.
    - akerl_ 7y ago
      Who decides the categories? For example, what would the category say next to a cert for Amazon? Google? Netflix? What would the cert say for Slack (who pivoted from one industry to another)? Attempting to embed additional visible info in the cert requires some centralized consensus, and trusted validation that certs being provisioned match the consensus. And all of this occurs despite the continued fact that end users do not even look at the certificate information anyways, so we’ve deployed a new central body with a bunch of administrative overhead and not moved the needle on actual security.

ozim 7y ago

It does not matter. Main point is: "reliance on the absence of a positive visual indicator was simply never a good idea in the first place". Even if you would have reasonable alternative such as brand name or else, simply having this in address bar in green does not help people to differentiate phishing sites without brand name in progress bar. People see the same layout and colors on the page and assume it is correct one.

Ajedi32 7y ago
Sure, but a few years ago the same was true of the visual indicators for plain DV https. Browsers responded with an effort to increase adoption of DV certs to the point where positive indicators for encrypted connections could be replaced by negative indicators for unencrypted connections. Could a similar approach not also work with EV certs? I acknowledge it's a bit harder, since not every site necessarily _needs_ full identity verification. (I don't really care about the legal entity that owns Hacker News, for example, I just care that it's the same site I signed up for back when I first created my account.) But for the sites where it _does_ matter, there's no reason why efforts couldn't be made to shift towards negative security indicators. (For example, perhaps browsers could warn users when the legal entity that owns a site changes.)
nailer 7y ago
Literally everyone on the Chrome Security UX team tweets from a verified account. Even Troy Hunt does.
- rocqua 7y ago
  That would be a pretty decent approach, but an EV cert does not assert that: > This key belongs to the owner of this domain name AND this domain name matches this business name. Instead, an EV cert comes with an extra name (the official business name) and then asserts: > This key belongs to the owner of this domain name AND this key belongs to the owner of this other business name Hence you get the image [1] of a website www.thesslstore.com but EV business name 'Rapid Web Services LLC'. Should that really mean that this counts as a 'verfied' domain that gets a tick-mark? That said, switching to a system more like the first assertion, and going with the 'verified' tick mark could work. It would make validating EV certs a lot harder though, as it requires a more subjective judgement to make. (e.g. could you validate windows.com for the company microsoft? What about youtu.be for youtube) Making a wrong judgement here should look pretty bad for a cert-issuer. [1] https://www.troyhunt.com/content/images/2019/08/image-4.png https://www.troyhunt.com/content/images/2019/08/image-4.png

skybrian 7y ago

The names that people are familiar with come from branding and publicity - that is, advertising, news, social media, and so on. This affects the web pages that search engines crawl, what users search for, and also which websites rank higher. I'm not sure how someone would do better than search engines? Searching for the company you're looking for usually works. You can imagine inventing a more systematic approach to assigning names, but it would be like using scientific names for animals instead of common names. Domain names serve this purpose already. What we really want is to document popular usage. One systematic approach to tracking popular usage might be to treat this like creating a dictionary. However the dictionary compilers are always going to lag popular usage. This is why Yahoo's directory-based approach lost out to Google. The closest thing we have now is Wikipedia and Google gets that data via crawling. I guess you could say that human languages are not entirely secure due to being a bit nebulous, but it's the best we have for humans referring to things they remember. If you want to be precise, you need to remember, record, or communicate the domain name.

Ajedi32 7y ago
Yes, search engines do serve a similar purpose. It's not a very rigorous solution though, and there are plenty of ways to get to a website that don't involve going through a search engine. Leaving aside the UX, I think there's also some value in providing legal authorities with a smoking gun in situations where phishing or other illegal activity does occur using a domain with a EV certificate. The extent to which current EV certs serve that purpose is debatable, but the idea is has merit.
heavenlyblue 7y ago
.ac.uk is reserved only for education. Simply having an e-mail on one of these domains implies access to e.g. free GitHub accounts. We could have something akin to .bank.uk for banking purposes (you are only allowed go have one if you have a banking license).
- davchana 7y ago
  I think the new gTld .bank is marketing itself for banks in that way, making sure only real banks get.bank

ocdtrekkie 7y ago

Fixing EV would mostly entail making it a more exclusive club (not an "I have $400 to blow" club, but a "this is a household name" club) and shoring up the requirements to get one. Far from an insurmountable task. Everyone should not have an EV, but everyone should know that if you're doing business with a bank or a major store they should have an EV.

aeternus 7y ago
The problem with EV is how do you handle companies with the same name? Many banks have similar and in some cases the same name. The domain name system already handles this by enforcing uniqueness and leveraging the market.
- ocdtrekkie 7y ago
  There's no reason EV policy can't be modified to also enforce uniqueness. In fact, that's what I'd expect if we're only giving EVs to household names. Banks which have the same name as other banks should change their name, but we should tie EVs for banks to existing financial system institutions. For example, most banks in the US have an FDIC number, so our EV validators in the US can tie a bank to it's FDIC registration, and the user can cross-reference their bank with that as well. Basically if I'm a bank customer, I should have a unique identifier on my check or debit card which can be cross-referenced with the EV cert.
  - aeternus 7y ago
    How do you decide which one needs to change its name? There's no objective measure for which is 'larger'. The vast majority of consumers are not going to lookup an FDIC number, and even if they did, it is still not optimal since banks regularly merge which would cause confusion.
    - yjftsjthsd-h 7y ago
      I don't think we really care, do we? I'm not really worried that I connected to First Bank rather than Second Bank, since both are legitimate banks; what I want is to ensure that I didn't accidentally connect to Second Bannk, the local fraud shop. "Is this site controlled by a FDIC-registered organization" is probably good enough™.

qwerty456127 7y ago

I doubt many users care about certificates beyond it's not red.

lone_haxx0r 7y ago

URL <=> Brand relationships are purely human politics. I prefer technology to deal with technical issues and present a relatively formal interface to the end user. Human politics are complex. Any interface that abstracts human politics and legal issues will have to deal with so many corner cases that its interface will either be unreliable or more complex than URLs.

3xblah 7y ago

Thought experiment: Let's say you decide to phone someone who works for the bank. How do you know the phone number you have is correct? What if phone numbers were perceived to be "dynamic" -- subject to change at any time, even by the hour, without notice to you -- such that you could not rely on a consistent, stable phone number for any reasonable length of time. What if, instead, you would need to look up the number every time you make a call? What if phone numbers were thought to be too difficult for people to remember, so someone decided that all you needed was the name of the person at the bank. (Even though that name may belong to many different people across the world.) What if someone further decided that the lookup should handled by someone else. No need for you to be involved in that process. How could you be sure you were calling the intended bank employee?

eridius 7y ago
It sounds like you're describing IP addresses, except people don't type in IP addresses to go to their bank. They type in domains. In fact, phone numbers are absolutely the equivalent of domains, and the equivalent of IP addresses in the telephone system is IMSI (I think). You can transfer phone numbers between subscribers, and so the number that you thought was going to your bank could actually some day go somewhere completely different.
- 3xblah 7y ago
  In the hypothetical, assume you are calling a bank employee on a landline. IMSI is for mobile.
  - eridius 7y ago
    Ok, then whatever the equivalent is for landlines. I don't know how telephone numbers are assigned to particular physical lines, but however that's done, it can be changed.
    - 3xblah 7y ago
      So, a landline phone number that theoretically changes so frequently and without notice to you such that you are encouraged to keep looking it up again everyday. Except you are not expected to perform or monitor that process. Instead it is automated and hidden from you. Imagine this creates risk of fraud by someone pretending to be the bank employee, so then you rely on a third party to "validate" the number you obtain for the bank employee.

rini17 7y ago

Yes it's kind of ridiculous DNS ignores whole existing trademark system, except when there's a direct conflict.