4 ms·

This is one of the reasons why I think it was a mistake for the web browsers to de-emphasize EV certificates. Precisely because they are expensive and difficul

This is one of the reasons why I think it was a mistake for the web browsers to de-emphasize EV certificates. Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. I fear that because of these kind of URL issues, and with the deemphasis of EV certificates which would have provided a somewhat decentralized solution, we will end up in a world where the author of the browser becomes the ultimate authority on what is a trustworthy URL. That means for most of the users, Google will be the arbiter of what is and is not a trust worthy URL.

recursive 6y ago
Even better: Rather than all the red-tape, you can just use an indicator between `$` and `$$$$$` to indicate how much the subject paid for the certificate. This is better because it establishes more than just two (five!) tiers of credibility. I briefly considered adding a sixth tier, but I think that would be distasteful.
- kbenson 6y ago
  That is essentially what you used to be paying for with certs back in the day. You bought yourself a $500, $1000, or $1500 cert based on the level of liability insurance you needed if someone "broke the encryption". The extra money does help pay for extra betting by the issuing authority, theoretically. The thing is, just charging extra money would probably work for the most part, even if it isn't all that fair. Also, how do I set myself up as the authority you need to pay $$$$$ to for a certificate? That seems like a pretty sweet market to be in. ;)
jcranmer 6y ago
> Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. And the requirement for an EV certificate is that it has to be registered specifically in the corporate name, which isn't necessarily the well-known trade name. Furthermore, anyone could choose to register their company as, say, "Microsoft" if it's not in the same jurisdiction as the actual Microsoft, and you get this lovely verified checkmark saying that the phishing site is, indeed, Microsoft. (Just not the Microsoft they were expecting).
- bleepblorp 6y ago
  The concept of TLS certs validating the identity of a business entity--rather than just ownership of a domain name--has merit even though the implementation of EVs was poorly considered. A system that presented the end user with a business card of relevant information regarding a given website could be very effective if done properly. Presenting a list of industries and trademarks that the site does business under in the user's current jurisdiction would be a good start.
- ClumsyPilot 6y ago
  "specifically in the corporate name, which isn't necessarily the well-known trade name" If you 'verifying' without knowing the legal identity, what on earth have you verified? Perhaps we could include trademarks somehow, but at the end of the day having weired names is down to the firm. The example with google blogs was particularly apt - all URLs are legit, but only one belongs to Google. I want to know which one.
jacobsenscott 6y ago
An EV cert basically screams you have no idea what you are doing in the security realm. "We can't make our site secure, but we can make it look secure.". Like when people put those little "security seal" gifs all over the place.
captn3m0 6y ago
Sadly research has proven otherwise: 1. Users do not understand the difference between an EV and a DV cert. We spent a decade training users that the padlock is all you need. 2. Company registration norms are not standardised across the world, and you can easily get a certificate for Microsoft Corp, see https://news.ycombinator.com/item?id=15904513 https://news.ycombinator.com/item?id=15904513 for eg.

recursive 6y ago

Even better: Rather than all the red-tape, you can just use an indicator between `$` and `$$$$$` to indicate how much the subject paid for the certificate. This is better because it establishes more than just two (five!) tiers of credibility. I briefly considered adding a sixth tier, but I think that would be distasteful.

kbenson 6y ago
That is essentially what you used to be paying for with certs back in the day. You bought yourself a $500, $1000, or $1500 cert based on the level of liability insurance you needed if someone "broke the encryption". The extra money does help pay for extra betting by the issuing authority, theoretically. The thing is, just charging extra money would probably work for the most part, even if it isn't all that fair. Also, how do I set myself up as the authority you need to pay $$$$$ to for a certificate? That seems like a pretty sweet market to be in. ;)

jcranmer 6y ago

> Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. And the requirement for an EV certificate is that it has to be registered specifically in the corporate name, which isn't necessarily the well-known trade name. Furthermore, anyone could choose to register their company as, say, "Microsoft" if it's not in the same jurisdiction as the actual Microsoft, and you get this lovely verified checkmark saying that the phishing site is, indeed, Microsoft. (Just not the Microsoft they were expecting).

bleepblorp 6y ago
The concept of TLS certs validating the identity of a business entity--rather than just ownership of a domain name--has merit even though the implementation of EVs was poorly considered. A system that presented the end user with a business card of relevant information regarding a given website could be very effective if done properly. Presenting a list of industries and trademarks that the site does business under in the user's current jurisdiction would be a good start.
ClumsyPilot 6y ago
"specifically in the corporate name, which isn't necessarily the well-known trade name" If you 'verifying' without knowing the legal identity, what on earth have you verified? Perhaps we could include trademarks somehow, but at the end of the day having weired names is down to the firm. The example with google blogs was particularly apt - all URLs are legit, but only one belongs to Google. I want to know which one.

jacobsenscott 6y ago

An EV cert basically screams you have no idea what you are doing in the security realm. "We can't make our site secure, but we can make it look secure.". Like when people put those little "security seal" gifs all over the place.

captn3m0 6y ago

Sadly research has proven otherwise: 1. Users do not understand the difference between an EV and a DV cert. We spent a decade training users that the padlock is all you need. 2. Company registration norms are not standardised across the world, and you can easily get a certificate for Microsoft Corp, see https://news.ycombinator.com/item?id=15904513 https://news.ycombinator.com/item?id=15904513 for eg.