5 ms·

Why push for extended validation of there is no security benefits and the user experience is the same? I remember that someone had successfully got an extended

by Znafon 7y ago

Why push for extended validation of there is no security benefits and the user experience is the same? I remember that someone had successfully got an extended certificate for "Stripe, Inc". Things like certificate transparency log monitoring seems better than EV to improve security.

stefan_ 7y ago
Maybe EV isn't the answer. But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when you have Firefox, Chrome et al. kotau to company proxies and all kinds of dubious state CAs in the trust root. That's before you get to the UI failures, where phishers can trivially get that lock for their microssoft.com domains.
- hsk823 7y ago
  Yes but none of those issues are fixed via extended validation of TLS certs. Extended validation was simply a cash grab and a human component to validating you are who you are beyond a domain name mismatch. EV process was the same as any other cert process, what ever company out there issues the EV was just doing extra leg work and making sure business registration paperwork was legit, etc. etc. It didn't make it more safe, it just added extra steps to validate ownership of a domain. MITM TLS proxies and shady root CAs are and will continue to exist in the enterprise and for state actors for the foreseeable future. EV does not challenge this, in fact EV certs like any cert that's intercepted properly, the end user will never know that it happened.
- hannob 7y ago
  > But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when you have Firefox, Chrome et al. kotau to company proxies and all kinds of dubious state CAs in the trust root. There's already a lot of things being done to improve the situation. Honest question: Are you aware of them? Do you know Certificate Transparency? Have you followed the intense discussion about Dark Matter? Do you know what the Baseline Requirements are? Do you know how Webauthn prevents Phishing?
snowwrestler 7y ago
There is a security benefit to EV: the paper trail to which the CA attests. That provides a tool that law enforcement can use to track you down if you use your EV-cert-provisioned site to commit a crime. To get an EV cert, you must prove to the CA your identity, portions of which are then encoded in the cert itself. This is analogous to how a fraud is discouraged in physical stores. A street address and business license won't prevent a store from ripping you off. But it gives you plenty of info to pursue a complaint if it happens.
- eridius 7y ago
  That's assuming you even get an EV cert though. EV failed because it didn't provide any benefit, as evidenced by sites like PayPal (which you would think is the poster child for EV) ditching it. Because it didn't matter to users if you had an EV cert, you didn't need to get one. The reason why "Stripe, Inc." is interesting is because it disproves the whole claim that users can trust the business name displayed, because they can't. It doesn't matter if the CA has a paper trail for the EV cert, because nobody's saying people will use EV certs for large-scale phishing attacks (users don't even notice its absence to begin with so there's no point). But since you can't trust the business name, it means EV is actually an attack vector for spearfishing. Pick a single high-value target, get a misleading EV cert, get them on that site. EV is now a significant negative.
  - snowwrestler 7y ago
    > The reason why "Stripe, Inc." is interesting is because it disproves the whole claim that users can trust the business name displayed, because they can't. The only people who made this claim, did it so they could attack it. The only claim of the EV system is that the display name matches a real legal entity, which is not the same thing as being consumer-recognizable. The intent with EV was that the presence of its UI element--regardless of what it said--would confer trust. The idea does not rely on users recognizing the company name any more than trust in physical stores relies on users memorizing street addresses. The concept is that a legit company would opt to tie its online presence back to its legal entity (via an EV cert), but a scam would not because doing so would take more effort and make it harder to escape. Again: this is analogous to the effort that it takes to set up a physical store. You can buy things off the back of a truck, but everyone knows that is sketchy. You don't know where that stuff came from, and you have no recourse once the truck drives away. Setting up a store is a lot harder than driving up a truck--a company has to establish a legal presence in the jurisdiction, sign a lease, get a business license, comply with all sorts of regulations, pay taxes, etc. But they go through that effort because doing so confers trust. It is this system that is behind the social convention that it's ok to walk into a new store and hand them your credit card to buy something. The goal of EV, of the CA system in general, was to try to create a similar set of trust signifiers and conventions online.

by Znafon 7y ago

stefan_ 7y ago

Maybe EV isn't the answer. But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when you have Firefox, Chrome et al. kotau to company proxies and all kinds of dubious state CAs in the trust root. That's before you get to the UI failures, where phishers can trivially get that lock for their microssoft.com domains.

hsk823 7y ago
Yes but none of those issues are fixed via extended validation of TLS certs. Extended validation was simply a cash grab and a human component to validating you are who you are beyond a domain name mismatch. EV process was the same as any other cert process, what ever company out there issues the EV was just doing extra leg work and making sure business registration paperwork was legit, etc. etc. It didn't make it more safe, it just added extra steps to validate ownership of a domain. MITM TLS proxies and shady root CAs are and will continue to exist in the enterprise and for state actors for the foreseeable future. EV does not challenge this, in fact EV certs like any cert that's intercepted properly, the end user will never know that it happened.
hannob 7y ago
> But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when you have Firefox, Chrome et al. kotau to company proxies and all kinds of dubious state CAs in the trust root. There's already a lot of things being done to improve the situation. Honest question: Are you aware of them? Do you know Certificate Transparency? Have you followed the intense discussion about Dark Matter? Do you know what the Baseline Requirements are? Do you know how Webauthn prevents Phishing?

snowwrestler 7y ago

There is a security benefit to EV: the paper trail to which the CA attests. That provides a tool that law enforcement can use to track you down if you use your EV-cert-provisioned site to commit a crime. To get an EV cert, you must prove to the CA your identity, portions of which are then encoded in the cert itself. This is analogous to how a fraud is discouraged in physical stores. A street address and business license won't prevent a store from ripping you off. But it gives you plenty of info to pursue a complaint if it happens.

eridius 7y ago
That's assuming you even get an EV cert though. EV failed because it didn't provide any benefit, as evidenced by sites like PayPal (which you would think is the poster child for EV) ditching it. Because it didn't matter to users if you had an EV cert, you didn't need to get one. The reason why "Stripe, Inc." is interesting is because it disproves the whole claim that users can trust the business name displayed, because they can't. It doesn't matter if the CA has a paper trail for the EV cert, because nobody's saying people will use EV certs for large-scale phishing attacks (users don't even notice its absence to begin with so there's no point). But since you can't trust the business name, it means EV is actually an attack vector for spearfishing. Pick a single high-value target, get a misleading EV cert, get them on that site. EV is now a significant negative.
- snowwrestler 7y ago
  > The reason why "Stripe, Inc." is interesting is because it disproves the whole claim that users can trust the business name displayed, because they can't. The only people who made this claim, did it so they could attack it. The only claim of the EV system is that the display name matches a real legal entity, which is not the same thing as being consumer-recognizable. The intent with EV was that the presence of its UI element--regardless of what it said--would confer trust. The idea does not rely on users recognizing the company name any more than trust in physical stores relies on users memorizing street addresses. The concept is that a legit company would opt to tie its online presence back to its legal entity (via an EV cert), but a scam would not because doing so would take more effort and make it harder to escape. Again: this is analogous to the effort that it takes to set up a physical store. You can buy things off the back of a truck, but everyone knows that is sketchy. You don't know where that stuff came from, and you have no recourse once the truck drives away. Setting up a store is a lot harder than driving up a truck--a company has to establish a legal presence in the jurisdiction, sign a lease, get a business license, comply with all sorts of regulations, pay taxes, etc. But they go through that effort because doing so confers trust. It is this system that is behind the social convention that it's ok to walk into a new store and hand them your credit card to buy something. The goal of EV, of the CA system in general, was to try to create a similar set of trust signifiers and conventions online.