4 ms·

Another tale from a developer on their experience getting a code signing certificate from a certificate authority: https://twitter.com/hanspagel/status/1262317

• kbenson 6y ago
  Eh, honestly, that's what getting an SSL cert used to be like 15 years ago. They can knock it all they want, but really, the process functioned pretty much as expected. Like a lock on your front door, the purpose is not to prevent unwanted people from ever getting inside (no lock will ever accomplish that), but to both make it take long enough the likelihood of being noticed is high, and to put enough hurdles in place that the attacker looks for a more lucrative target. This is done through time, capability, and money. It takes time to jump through the steps. This presents risk to an attacker as it leaves them exposed for much longer, and susceptible to being tracked down in various ways as they expose themselves. It takes capability to jump through the steps, requiring the attacker having compromised the target in multiple different ways (phone system, employee, etc). This increases the complexity of the attach and thus the risk to the attacker. It takes money. This helps the providing company recoup the cost of verification (and if it's anything like web SSL certs is also about insurance), but money also provides another path to racking down an attacker, and provides a cost to them that isn't just their time. It also makes it less feasible to attempt a bunch of these attacks at once, as it's expensive. People can complain about the inconvenience all they want, but the inconvenience is part of the point, so I doubt you'll see it change all that much.
  • falcolas 6y ago
    Funny how Let’s Encrypt is so popular because it doesn’t inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.
    • fh973 6y ago
      There is a huge difference of what kind of identity is established: Let's Encrypt tells you basically that you are actually talking to the right server, whereas EV certs for signing binaries tell you which company that actually exists in the real world owns the certificate.
      • kbenson 6y ago
        Also, for a lot of sites they've outsourced their payment systems (which was the main reason for SSL certs in the past), so you can place less importance on the SSL cert if the payment gateway is PayPal, or Amazon, or Squarespace, and they are essentially providing the same assurance (and are a responsible party you can contact to reverse charges if you suspect fraud). At this point, I'm very hesitant to enter any credit card info into a site itself, even if it's secured through an SSL cert. It doesn't really signify what it used to.
      • kevingadd 6y ago
        And aside from signing certs being a racket, it makes sense for LE to be easier than getting a code signing cert! If the server I land on is a malicious website, I can close the tab. If the app I installed turns out to be malicious odds are good that I have to reformat my machine and restore an old backup, plus change all my security credentials because the malware exfiltrated them.
      • fomine3 6y ago
        But no one cares DV/OV/EV differences for web certs.
    • kbenson 6y ago
      That's because the purpose of SSL encryption changed. It used to be primarily to protect payment information and sometimes also used for logins, but it was considered too heavy for all traffic in the past. Now it's used primarily to ensure all traffic is secure, and payment is along for the ride. In the past you used to be fairly sure a company was somewhat legitimate and responsible if they has an SSL cert and could supply card information to them without too much worry, as someone had vetted them as a real company (to some degree). These days, that doesn't happen, and whether I'm willing to give a company my credit card has nothing to do with if they are secured with a cert (which is a bare minimum to use the site). That cert doesn't really imply much anymore though. These days, I'll only enter my card into large reputable sites, or if they are using a payment service I trust (PayPal, Amazon, Square, etc), as they've presumably done a lot of the vetting that the SSL companies traditionally did.
• missedthecue 6y ago
  When I tried to get one for a project I was working on, it was a horrible convoluted hell. They needed all kinds of things scanned and sent to them. They wanted 2 government IDs, 2 financial documents and 2 non-financial documents. Everything had to be notarized. I had to get my financial documents notarized on a different day than the other documents, and had to have a different notary do those. They would not accept two different notaries that worked in the same office, or for the same organization. (In my case, my local banking branch). Finally was able to get everything sent in and then they asked me to notarize and sign an additional document called the "face-to-face". So I get that in. All told, it takes them over a month to verify the certificate. They send me the link and key to download it. In the email they send, they say that I can use IE, Firefox or Chrome. I use Chrome. The certificate is corrupted upon download. I tell them and they say it's because I used Chrome. I forward them the email they had sent me that specifically stated chrome could be used. They refuse own up to it and re-issue and because it had been 30 days since purchase, I could not get a refund. It was such a horrible pain that I just gave up on my project and never published it, rather than go through the whole process again. There has got to be an easier way to verify someone is in fact a human.
  • Avamander 6y ago
    > There has got to be an easier way to verify someone is in fact a human. Yeah, there is, digital signatures. Estonia started with it's digital signatures back in early 2000s, a physical signature is practically considered caveman-tier tech. Just recently the EU created the eIDAS regulation. I really can't predict how long it'll take for the US to catch up though :/