3 ms·

"Nobody Looks Beyond the Lock" I did. A high-value (to me) service used a cert with the green banner and I'd look to it to be reassured I was in the right plac

by billpg 5y ago

"Nobody Looks Beyond the Lock" I did. A high-value (to me) service used a cert with the green banner and I'd look to it to be reassured I was in the right place. Then one day, it disappeared. Alarm bells started ringing and I tried to find out what was going on. I called their help desk and asked if they had changed their TLS certificate but the helper I spoke to had no idea what I was talking about and couldn't be persuaded to escalate my query. Just in case my connection was being hacked by someone who managed to register a lesser TLS certificate, I left it a day until I could try again from my home broadband. In the end, I did go ahead and use the site without the green banner, which makes me my own worse enemy.

mananaysiempre 5y ago
Browsers stopped showing the banner a couple of years ago[1-3], around the time of the Ian Carroll’s Stripe, Inc. of Kentucky demonstration[4]; maybe that was it? It caused a great outcry from CAs, and I would’ve normally been against a single-sided, mostly Google-driven change like this, but the discussion[5] shows, at least as I read it, that CAs are unwilling to clearly communicate that the EV “green bar” does not imply “trustworthy”, it just upgrades “you have been securely connected to satan.com”, an authenticated DNS name, to “you have been securely connected to Satan LLC”, an authenticated legal-entity name. And as Stripe, Inc., of Kentucky shows, it’s not clear this is an upgrade at all, because while the rules for domain uniqueness in the DNS are relatively (barring IDNA) straightforward and well-known, the rules for uniqueness for names of legal entities are complex and dependent on jurisdiction to such an extent that neither users nor even CAs can be reasonably expected to follow them all. (I think one discussion on the CA/Browser Forum list mentioned that—forget state-scoped legal names in the US Stripe case—Germany has township-scoped legal names, so jurisdictionOfIncorporation would literally have to record, and UAs to show, the address of a specific town hall in Germany. Sure you know which one it should be?) Even today you will find CA websites[6-8] proudly proclaiming “customers think the EV green bar means trustworthy” (and, presumably, if they don’t, you should teach them to). Except it doesn’t, and believing it does is harmful for users, so into the dustbin of history it goes. (Of course, the conventional legal system is not completely clueless about this namespace issue and in most countries implements “field of endeavour”-scoped trademarks as a solution, but the issue of jurisdiction on a global Internet, as opposed to a billboard in your hometown, is only somewhat attenuated, and the discussion seems to show CAs were unwilling to move away from “green bar = secure” marketing, which is harmful however you spin it.) There’s a more general line of research on the uselessness of positive security indicators, that first entered the public eye perhaps with Moxie Marlinspike’s green-padlock-favicon demonstration[9] at Black Hat 2009. The Google announcement page[1] links to some later developments in that respect. Chrome later phased out “secure” for HTTPS sites completely in favour of showing “not secure” for HTTP ones, highlighted in red once a password input or similar appears[10]. Fortunately for you if you want your EV TLS certs back, the corpse seems to be in the process of being raised[11,12] through the necromantic power of money and government coercion. (What is it about PKI that drives everywhere bureaucrats so wild?..) [1] https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/ev-to-page-info.md https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1572936 https://bugzilla.mozilla.org/show_bug.cgi?id=1572936 [3] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... [4] https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... [5] https://groups.google.com/g/mozilla.dev.security.policy/c/iVCahTyZ7aw/m/ysfOGRFBEwAJ https://groups.google.com/g/mozilla.dev.security.policy/c/iV... [6] https://www.digicert.com/faq/when-to-use-ev-ssl.htm https://www.digicert.com/faq/when-to-use-ev-ssl.htm [7] https://www.globalsign.com/en/blog/why-ev-ssl-is-here-to-stay https://www.globalsign.com/en/blog/why-ev-ssl-is-here-to-sta... [8] https://www.thesslstore.com/new-to-ssl/is-ev-worth-it.aspx https://www.thesslstore.com/new-to-ssl/is-ev-worth-it.aspx [9] https://vimeo.com/50018478 https://vimeo.com/50018478, slides at https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/... [10] https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here... [11] https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-like-a-duck-probably-an-ev-certifiacate/ https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck... [12] https://www.eff.org/deeplinks/2022/02/what-duck-why-eu-proposal-require-qwacs-will-hurt-internet-security https://www.eff.org/deeplinks/2022/02/what-duck-why-eu-propo...
Melatonic 5y ago
This is the reason I honestly sometimes prefer buying from smaller online businesses who are too small to do their own payment processing and instead outsource it to a processor like Shopify or similar. They are probably taking a bigger loss than they would if they could process it themselves long term but at least I have relative peace of mind that I have used the service before, the certs stay consistent, and that they are likely doing a decent job with security in general (given that processing is their whole thing). A lot of times the look and feel of some of the process will be customized but for the most part you can quickly identify when its a payment process you have used before given the web forms. And of course it is easy to verify the cert after this.

by billpg 5y ago

mananaysiempre 5y ago

Browsers stopped showing the banner a couple of years ago[1-3], around the time of the Ian Carroll’s Stripe, Inc. of Kentucky demonstration[4]; maybe that was it? It caused a great outcry from CAs, and I would’ve normally been against a single-sided, mostly Google-driven change like this, but the discussion[5] shows, at least as I read it, that CAs are unwilling to clearly communicate that the EV “green bar” does not imply “trustworthy”, it just upgrades “you have been securely connected to satan.com”, an authenticated DNS name, to “you have been securely connected to Satan LLC”, an authenticated legal-entity name. And as Stripe, Inc., of Kentucky shows, it’s not clear this is an upgrade at all, because while the rules for domain uniqueness in the DNS are relatively (barring IDNA) straightforward and well-known, the rules for uniqueness for names of legal entities are complex and dependent on jurisdiction to such an extent that neither users nor even CAs can be reasonably expected to follow them all. (I think one discussion on the CA/Browser Forum list mentioned that—forget state-scoped legal names in the US Stripe case—Germany has township-scoped legal names, so jurisdictionOfIncorporation would literally have to record, and UAs to show, the address of a specific town hall in Germany. Sure you know which one it should be?) Even today you will find CA websites[6-8] proudly proclaiming “customers think the EV green bar means trustworthy” (and, presumably, if they don’t, you should teach them to). Except it doesn’t, and believing it does is harmful for users, so into the dustbin of history it goes. (Of course, the conventional legal system is not completely clueless about this namespace issue and in most countries implements “field of endeavour”-scoped trademarks as a solution, but the issue of jurisdiction on a global Internet, as opposed to a billboard in your hometown, is only somewhat attenuated, and the discussion seems to show CAs were unwilling to move away from “green bar = secure” marketing, which is harmful however you spin it.) There’s a more general line of research on the uselessness of positive security indicators, that first entered the public eye perhaps with Moxie Marlinspike’s green-padlock-favicon demonstration[9] at Black Hat 2009. The Google announcement page[1] links to some later developments in that respect. Chrome later phased out “secure” for HTTPS sites completely in favour of showing “not secure” for HTTP ones, highlighted in red once a password input or similar appears[10]. Fortunately for you if you want your EV TLS certs back, the corpse seems to be in the process of being raised[11,12] through the necromantic power of money and government coercion. (What is it about PKI that drives everywhere bureaucrats so wild?..) [1] https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/ev-to-page-info.md https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1572936 https://bugzilla.mozilla.org/show_bug.cgi?id=1572936 [3] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... [4] https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... [5] https://groups.google.com/g/mozilla.dev.security.policy/c/iVCahTyZ7aw/m/ysfOGRFBEwAJ https://groups.google.com/g/mozilla.dev.security.policy/c/iV... [6] https://www.digicert.com/faq/when-to-use-ev-ssl.htm https://www.digicert.com/faq/when-to-use-ev-ssl.htm [7] https://www.globalsign.com/en/blog/why-ev-ssl-is-here-to-stay https://www.globalsign.com/en/blog/why-ev-ssl-is-here-to-sta... [8] https://www.thesslstore.com/new-to-ssl/is-ev-worth-it.aspx https://www.thesslstore.com/new-to-ssl/is-ev-worth-it.aspx [9] https://vimeo.com/50018478 https://vimeo.com/50018478, slides at https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/... [10] https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here... [11] https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-like-a-duck-probably-an-ev-certifiacate/ https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck... [12] https://www.eff.org/deeplinks/2022/02/what-duck-why-eu-proposal-require-qwacs-will-hurt-internet-security https://www.eff.org/deeplinks/2022/02/what-duck-why-eu-propo...

Melatonic 5y ago

This is the reason I honestly sometimes prefer buying from smaller online businesses who are too small to do their own payment processing and instead outsource it to a processor like Shopify or similar. They are probably taking a bigger loss than they would if they could process it themselves long term but at least I have relative peace of mind that I have used the service before, the certs stay consistent, and that they are likely doing a decent job with security in general (given that processing is their whole thing). A lot of times the look and feel of some of the process will be customized but for the most part you can quickly identify when its a payment process you have used before given the web forms. And of course it is easy to verify the cert after this.