4 ms·

I think you're broadly right; I would agree the article comes for DigiCert when it should come for browsers, and this pretty embarrassing for the web. And I th

I think you're broadly right; I would agree the article comes for DigiCert when it should come for browsers, and this pretty embarrassing for the web. And I think you're right about EV? Ignoring gross CAs trying to juice the web, it makes sense to try to link the web's web of trust to our... non-web web of trust. The web is still pretty new, it's still pretty unfamiliar, and a lot of the signals we use to suss out a fraudulent physical shop don't really apply to the web. I would counterargue, though, that you're really mythologizing physical stores. I think tons of fraud and abuse happen in physical stores, up and down the stack. The "paper trail" is like 45 minutes on LegalZoom. I think it's worth separating things like banks and bank websites from like, illegal casinos and gambling websites (crypto exchanges are what I mean here). When you kind of pick away at the "physical stores have no fraud" pillar, then I think the web's security/trust model actually holds up. I don't simply rely on TLS to tell me that bankofamerica.com is legit, and I don't think anyone does, which is good because it doesn't! I also have totally different behavior when I'm doing online banking than when I'm [insert risky/shady thing here], because the threat model is different. And there's where I think we hit a crossroads, because that "risky/shady" thing for everyone is "getting an email that looks like it's from your bank". This is an attack that doesn't really have an analogue in meatspace, but it's super effective because again, we don't have all the signals we normally do. If it were meatspace, I'd notice this wasn't my usual branch and then probably notice some other differences that might give me pause, but the web makes it possible to create a very convincing copy. So, I think you're right in the large and I super agree. I just think that phishing is very bad and you shouldn't say you solved it when you in fact haven't solved anything. That's (almost certainly) browsers' fault, but that's a little irrelevant imo.

caylus 5y ago
> This is an attack that doesn't really have an analogue in meatspace Here's a potential analogue - sometimes people stand in parking lots and collect fees, claiming to be representatives of the lot's owner, but in reality pocketing the money. Some lots counter this by posting signs along the lines of "do not pay any attendant; pay only via kiosk/online". But since some lots do in fact collect payment via attendants, a potential way to secure this would be for the attendant to present proof that they are employed by a certain company. While the customer might not be able to verify that "ABC Parking, Inc." is in fact the owner of the lot, at least they would have a trail to follow if they were scammed. This is an area where cyberspace has an advantage - the closest analogue to an EV certificate in the physical world would be a piece of paper with some official seal on it, which can still be forged in a way not easily detectable by the average person.
- camgunz 5y ago
  Oooh, good example yeah. I recently saw a short list of grift/scam taxonomy; I wonder if there's a similar list for stuff like this.
- lazide 5y ago
  Well, people do still pretend to be representatives, and do still scam people successfully. The underlying issue internet wise is unlike the scam you’re referring to, the people can be in another random jurisdiction and impossible to even arrest and still succeed at doing it online. In fact, in many cases it’s even economically preferable to do so (regardless of potential punishment) due to lower costs of living. So you aren’t dealing with 5 lots in SF the owner is trying to avoid the problem on (and for which at least in theory someone could be caught and prosecuted by looking at a camera or walking there), you’re dealing with potentially every lot everywhere all at once, and that it is in theory scammable by people anywhere. And that there is no lot the owner can walk over to and see if it’s happening easily.

caylus 5y ago

> This is an attack that doesn't really have an analogue in meatspace Here's a potential analogue - sometimes people stand in parking lots and collect fees, claiming to be representatives of the lot's owner, but in reality pocketing the money. Some lots counter this by posting signs along the lines of "do not pay any attendant; pay only via kiosk/online". But since some lots do in fact collect payment via attendants, a potential way to secure this would be for the attendant to present proof that they are employed by a certain company. While the customer might not be able to verify that "ABC Parking, Inc." is in fact the owner of the lot, at least they would have a trail to follow if they were scammed. This is an area where cyberspace has an advantage - the closest analogue to an EV certificate in the physical world would be a piece of paper with some official seal on it, which can still be forged in a way not easily detectable by the average person.

camgunz 5y ago
Oooh, good example yeah. I recently saw a short list of grift/scam taxonomy; I wonder if there's a similar list for stuff like this.
lazide 5y ago
Well, people do still pretend to be representatives, and do still scam people successfully. The underlying issue internet wise is unlike the scam you’re referring to, the people can be in another random jurisdiction and impossible to even arrest and still succeed at doing it online. In fact, in many cases it’s even economically preferable to do so (regardless of potential punishment) due to lower costs of living. So you aren’t dealing with 5 lots in SF the owner is trying to avoid the problem on (and for which at least in theory someone could be caught and prosecuted by looking at a camera or walking there), you’re dealing with potentially every lot everywhere all at once, and that it is in theory scammable by people anywhere. And that there is no lot the owner can walk over to and see if it’s happening easily.