5 ms·

>To be clear, an EV or OV cert would not magically prevent scams. But they would provide cryptographic guarantees that an advocate or law enforcement could trac

>To be clear, an EV or OV cert would not magically prevent scams. But they would provide cryptographic guarantees that an advocate or law enforcement could trace back to an entity, to prosecute or make you whole. Just like in a real life store. i don't see how it follows from this that the UI browsers provide for EV certs is bad. you claim that the value is not in inspecting the cert before a transaction, but in the logging of that data. the UI that browsers provide for EV certs allows you to inspect a cert if you really want to, but goes out of its way to avoid any implication that an EV cert is doing anything to prevent you from being scammed. that's a good thing. the browsers are honestly representing the effectiveness of EV certs.

snowwrestler 5y ago
Browsers accurately render the fields of the cert for your current website session in a debugging view; that’s the best I can say. That is technically a “UI” but it does nothing for most users. Click on the lock in Chrome. It shows you the domain name. There’s no reason it could not read the cert fields and give you the parent org name and where it is registered. As opposed to clicking twice more and pulling those fields out of dozens of technical fields. It doesn’t pull the human info out, for a human to look at easily. Or take a look through your browser history. Is site metadata logged with each entry? Can you look back at what the browser logged from the cert or network data when you visited a site last month? Is there a nice UI to help you find the problem site and package that info up so you can send it to someone else? Browsers suck at safety UI in general. Let’s say I do find a phishing site. Where is the button to “report a problem with this site”? Chrome has a screen to report browser bugs; in Firefox “deceptive site” is the last item in the help submenu. Compare to the prominent “report spam” button in email clients or the report features of social media. Even if browser providers don’t want to take these complaints, the browser itself knows the domain registrar, DNS provider, and host for every website I visit. Each of those is a company that should have a process to handle abuse complaints. Registrars are required to supply abuse contact info in WHOIS. The browser could give me a nice UI to make use of that info.
- lazide 5y ago
  How is that materially different than the traditional difficulty in pulling up any official record on a corporation for instance? If anything, it seems way easier? It also isn’t showing a potentially overly sure view of who the cert is really registered to for everyone. Could it be made easier? Sure. But most folks aren’t going to be able to usefully process that information anyway. There are a ton of ways of making Whois information look plausibly like it’s owned by a bank when it’s not.
  - snowwrestler 5y ago
    You don’t need the official corporate record to file a complaint, you just need enough info that someone else can look it up. If you get food poisoning, you just tell the city the name and address of the restaurant. They take care of figuring out who is legally responsible. Of course you don’t have to go to a restaurant; you can buy burritos from a guy in an unmarked van by the river. But we understand that in doing so, we’re taking on more risk than going to a restaurant in a storefront. That was the idea behind OV and EV certs: give businesses a tool by which they could overtly make themselves more accountable to consequences. Like leasing space and opening a storefront. > There are a ton of ways of making Whois information look plausibly like it’s owned by a bank when it’s not. You can’t affect the WHOIS fields where your registrar lists their own contact info, like abuse@godaddy.com, 480-624-2505.
    - lazide 5y ago
      What database/records do you think the cops check when you call in a complaint? You can call in a complaint about a bogus website to them too, and it’s even easier to figure this out? (From being familiar with those databases) The issue is that unlike someone with a physical presence in a specific place which makes someone vulnerable to being physically arrested, the internet makes it easy to do something that would otherwise result in that consequence from a place where that consequence is impossible. And no amount of traditional records and ‘call the cops’ type processes are going to address that. And no amount of extra visible information somewhere in a place that will be overwhelming and ignored is going to fix it either. Cops are about physical restraint (generally), aka ‘arrest’, which is the only proven ‘lowest common denominator’ way anyone seems to have figured out to ACTUALLY stop someone from doing something. You take them physically, put them in a cell where they can’t access anything but the things you hope they can’t abuse, and hold them until another resolution is figured out or you have to release them anyway. To avoid problems like a random cop in rural Arkansas from going to Washington and arresting the president, the area different police are able to do this in is restricted, various rules and laws, etc. further restrict when, where, and how they can do it, etc. Fundamentally that means most cops are helpless in this scenario unless said bogus website scammer is dumb enough to scam people in his same town/city/state/whatever. And unless everyone takes a ‘scam unless proven innocent’ approach which pretty fundamentally breaks the internet’s usefulness, CA signing and the like doesn’t really solve any of that problem, no matter how accurate the information is.

snowwrestler 5y ago

Browsers accurately render the fields of the cert for your current website session in a debugging view; that’s the best I can say. That is technically a “UI” but it does nothing for most users. Click on the lock in Chrome. It shows you the domain name. There’s no reason it could not read the cert fields and give you the parent org name and where it is registered. As opposed to clicking twice more and pulling those fields out of dozens of technical fields. It doesn’t pull the human info out, for a human to look at easily. Or take a look through your browser history. Is site metadata logged with each entry? Can you look back at what the browser logged from the cert or network data when you visited a site last month? Is there a nice UI to help you find the problem site and package that info up so you can send it to someone else? Browsers suck at safety UI in general. Let’s say I do find a phishing site. Where is the button to “report a problem with this site”? Chrome has a screen to report browser bugs; in Firefox “deceptive site” is the last item in the help submenu. Compare to the prominent “report spam” button in email clients or the report features of social media. Even if browser providers don’t want to take these complaints, the browser itself knows the domain registrar, DNS provider, and host for every website I visit. Each of those is a company that should have a process to handle abuse complaints. Registrars are required to supply abuse contact info in WHOIS. The browser could give me a nice UI to make use of that info.

lazide 5y ago
How is that materially different than the traditional difficulty in pulling up any official record on a corporation for instance? If anything, it seems way easier? It also isn’t showing a potentially overly sure view of who the cert is really registered to for everyone. Could it be made easier? Sure. But most folks aren’t going to be able to usefully process that information anyway. There are a ton of ways of making Whois information look plausibly like it’s owned by a bank when it’s not.
- snowwrestler 5y ago
  You don’t need the official corporate record to file a complaint, you just need enough info that someone else can look it up. If you get food poisoning, you just tell the city the name and address of the restaurant. They take care of figuring out who is legally responsible. Of course you don’t have to go to a restaurant; you can buy burritos from a guy in an unmarked van by the river. But we understand that in doing so, we’re taking on more risk than going to a restaurant in a storefront. That was the idea behind OV and EV certs: give businesses a tool by which they could overtly make themselves more accountable to consequences. Like leasing space and opening a storefront. > There are a ton of ways of making Whois information look plausibly like it’s owned by a bank when it’s not. You can’t affect the WHOIS fields where your registrar lists their own contact info, like abuse@godaddy.com, 480-624-2505.
  - lazide 5y ago
    What database/records do you think the cops check when you call in a complaint? You can call in a complaint about a bogus website to them too, and it’s even easier to figure this out? (From being familiar with those databases) The issue is that unlike someone with a physical presence in a specific place which makes someone vulnerable to being physically arrested, the internet makes it easy to do something that would otherwise result in that consequence from a place where that consequence is impossible. And no amount of traditional records and ‘call the cops’ type processes are going to address that. And no amount of extra visible information somewhere in a place that will be overwhelming and ignored is going to fix it either. Cops are about physical restraint (generally), aka ‘arrest’, which is the only proven ‘lowest common denominator’ way anyone seems to have figured out to ACTUALLY stop someone from doing something. You take them physically, put them in a cell where they can’t access anything but the things you hope they can’t abuse, and hold them until another resolution is figured out or you have to release them anyway. To avoid problems like a random cop in rural Arkansas from going to Washington and arresting the president, the area different police are able to do this in is restricted, various rules and laws, etc. further restrict when, where, and how they can do it, etc. Fundamentally that means most cops are helpless in this scenario unless said bogus website scammer is dumb enough to scam people in his same town/city/state/whatever. And unless everyone takes a ‘scam unless proven innocent’ approach which pretty fundamentally breaks the internet’s usefulness, CA signing and the like doesn’t really solve any of that problem, no matter how accurate the information is.