3 ms·

You don’t need the official corporate record to file a complaint, you just need enough info that someone else can look it up. If you get food poisoning, you jus

You don’t need the official corporate record to file a complaint, you just need enough info that someone else can look it up. If you get food poisoning, you just tell the city the name and address of the restaurant. They take care of figuring out who is legally responsible. Of course you don’t have to go to a restaurant; you can buy burritos from a guy in an unmarked van by the river. But we understand that in doing so, we’re taking on more risk than going to a restaurant in a storefront. That was the idea behind OV and EV certs: give businesses a tool by which they could overtly make themselves more accountable to consequences. Like leasing space and opening a storefront. > There are a ton of ways of making Whois information look plausibly like it’s owned by a bank when it’s not. You can’t affect the WHOIS fields where your registrar lists their own contact info, like abuse@godaddy.com, 480-624-2505.

lazide 5y ago
What database/records do you think the cops check when you call in a complaint? You can call in a complaint about a bogus website to them too, and it’s even easier to figure this out? (From being familiar with those databases) The issue is that unlike someone with a physical presence in a specific place which makes someone vulnerable to being physically arrested, the internet makes it easy to do something that would otherwise result in that consequence from a place where that consequence is impossible. And no amount of traditional records and ‘call the cops’ type processes are going to address that. And no amount of extra visible information somewhere in a place that will be overwhelming and ignored is going to fix it either. Cops are about physical restraint (generally), aka ‘arrest’, which is the only proven ‘lowest common denominator’ way anyone seems to have figured out to ACTUALLY stop someone from doing something. You take them physically, put them in a cell where they can’t access anything but the things you hope they can’t abuse, and hold them until another resolution is figured out or you have to release them anyway. To avoid problems like a random cop in rural Arkansas from going to Washington and arresting the president, the area different police are able to do this in is restricted, various rules and laws, etc. further restrict when, where, and how they can do it, etc. Fundamentally that means most cops are helpless in this scenario unless said bogus website scammer is dumb enough to scam people in his same town/city/state/whatever. And unless everyone takes a ‘scam unless proven innocent’ approach which pretty fundamentally breaks the internet’s usefulness, CA signing and the like doesn’t really solve any of that problem, no matter how accurate the information is.
- xg15 5y ago
  So what is the solution then? On the one hand, we're supposed to trust no one on the web, on the other hand the web is only useful if we're effectively trusting everyone (except the most obvious scammers). So how do you verify trust on the web?
  - lazide 5y ago
    Right now we have no solution, we’re relying on ‘mostly works’ real world stuff to stop the biggest scams, and lots of small scammers are running around scamming lots of people and not being punished for it. If someone does a big enough scam on a big enough target (like a crypto ransom on a major oil pipeline), they’ll get the attention of someone who can ‘bend the rules’ enough to make their life hell and get you anyway, no matter where you are. But that doesn’t stop them from ruining a ton of people who aren’t that noticeable. Because those people aren’t noticeable, it’s also a lot of value that can be extracted that way, which makes the problem worse. Most people currently consider it working well enough to be better than the alternatives based on overall numbers. however as the scam economy develops, which it has been doing, something is going to break. it’s not going to go in the direction of random police officer in Vietnam, Nigeria, or Russia arresting his buddy (no matter how solid the evidence looks) because someone in the US wants it to happen. Think what happened with email and spam in the late 90’s - up until that point, spam filtering was a niche thing only nerds did. Then it got to the point email was useless without it, and thankfully for email, spam filtering worked and the providers provided it. Phones, phone providers haven’t been interested in, so except for some business cases almost no one uses phones directly any more (it’s texts or everything to voicemail first or whatever). So no idea how this is going to go - curated marketplaces for anyone online? Federal/EU Gov’t certs to do business online? ‘Great firewalls’ to keep the scammers out/limit traffic to where it can be policed? Consumers bailing on online purchases except for specific already known and ‘trusted’ names?
  - notatoad 5y ago
    >so what's the solution then? this is not a solved problem - that's the whole point. there is no general way to verify trust on the web. We can verify trust in certain connections or transactions, but it's not possible to trust "the web". and until the problem is solved, anybody trying to sell a way to do that is selling snake oil.

lazide 5y ago

What database/records do you think the cops check when you call in a complaint? You can call in a complaint about a bogus website to them too, and it’s even easier to figure this out? (From being familiar with those databases) The issue is that unlike someone with a physical presence in a specific place which makes someone vulnerable to being physically arrested, the internet makes it easy to do something that would otherwise result in that consequence from a place where that consequence is impossible. And no amount of traditional records and ‘call the cops’ type processes are going to address that. And no amount of extra visible information somewhere in a place that will be overwhelming and ignored is going to fix it either. Cops are about physical restraint (generally), aka ‘arrest’, which is the only proven ‘lowest common denominator’ way anyone seems to have figured out to ACTUALLY stop someone from doing something. You take them physically, put them in a cell where they can’t access anything but the things you hope they can’t abuse, and hold them until another resolution is figured out or you have to release them anyway. To avoid problems like a random cop in rural Arkansas from going to Washington and arresting the president, the area different police are able to do this in is restricted, various rules and laws, etc. further restrict when, where, and how they can do it, etc. Fundamentally that means most cops are helpless in this scenario unless said bogus website scammer is dumb enough to scam people in his same town/city/state/whatever. And unless everyone takes a ‘scam unless proven innocent’ approach which pretty fundamentally breaks the internet’s usefulness, CA signing and the like doesn’t really solve any of that problem, no matter how accurate the information is.

xg15 5y ago
So what is the solution then? On the one hand, we're supposed to trust no one on the web, on the other hand the web is only useful if we're effectively trusting everyone (except the most obvious scammers). So how do you verify trust on the web?
- lazide 5y ago
  Right now we have no solution, we’re relying on ‘mostly works’ real world stuff to stop the biggest scams, and lots of small scammers are running around scamming lots of people and not being punished for it. If someone does a big enough scam on a big enough target (like a crypto ransom on a major oil pipeline), they’ll get the attention of someone who can ‘bend the rules’ enough to make their life hell and get you anyway, no matter where you are. But that doesn’t stop them from ruining a ton of people who aren’t that noticeable. Because those people aren’t noticeable, it’s also a lot of value that can be extracted that way, which makes the problem worse. Most people currently consider it working well enough to be better than the alternatives based on overall numbers. however as the scam economy develops, which it has been doing, something is going to break. it’s not going to go in the direction of random police officer in Vietnam, Nigeria, or Russia arresting his buddy (no matter how solid the evidence looks) because someone in the US wants it to happen. Think what happened with email and spam in the late 90’s - up until that point, spam filtering was a niche thing only nerds did. Then it got to the point email was useless without it, and thankfully for email, spam filtering worked and the providers provided it. Phones, phone providers haven’t been interested in, so except for some business cases almost no one uses phones directly any more (it’s texts or everything to voicemail first or whatever). So no idea how this is going to go - curated marketplaces for anyone online? Federal/EU Gov’t certs to do business online? ‘Great firewalls’ to keep the scammers out/limit traffic to where it can be policed? Consumers bailing on online purchases except for specific already known and ‘trusted’ names?
- notatoad 5y ago
  >so what's the solution then? this is not a solved problem - that's the whole point. there is no general way to verify trust on the web. We can verify trust in certain connections or transactions, but it's not possible to trust "the web". and until the problem is solved, anybody trying to sell a way to do that is selling snake oil.