4 ms·

EV certificates have no tie to a person. They have a tie to a corporate entity, which especially in Western countries, is basically intractable to an actual per

EV certificates have no tie to a person. They have a tie to a corporate entity, which especially in Western countries, is basically intractable to an actual person. It takes a few minutes and $100 to create an anonymous LLC in the US.

derefr 5y ago
From Namecheap's article on EV certs: > [Criterion 2] Physical existence > To check the organization's physical existence and business presence, the Certificate Authority must verify that the physical address provided by the Applicant is an address where the organization conducts business operations (not a mail drop, P.O. box or an address for an agent of the Organization). This address will be included into the body of the SSL certificate after verification. That effectively translates to "there should be an address that criminal investigators can be sent to find and detain employees of the company." > [Criterion 4] Operational existence > To make sure that an organization is financially active and engaged in business activities, the Certificate Authority must verify that at least one of the following requirements is met: > The Organization has been in existence for at least three years > The Organization is registered in the Dun & Bradstreet database or Qualified Government Tax database > The Organization has an active demand deposit account which can be proved by a bank statement. That effectively translates to "you can't just make up an LLC and immediately get an EV cert for it, even if you do tell them your house is the headquarters. You'd have to put a good amount of time and effort into simulating a real business. So much that, if this were a spoofing attempt, you'd be noticed as in breach of trademark by the company you're trying to spoof, long before you got away with it." > Professional Opinion Letter > If you need to obtain an EV certificate urgently or prefer keeping the company details confidential, it is possible to send a professional opinion letter signed by a Lawyer, Public Notary or Certified Public Accountant. The person who signed the legal opinion or accountant letter should have a valid license within the country where the organization is registered or the country where the organization maintains an office or a physical facility. To expedite the validation process, we highly recommend requesting a Professional Opinion from a person who speaks English so that he or she can confirm the signature during phone verification with a Comodo (now Sectigo CA) validation agent. And this, finally, translates to "you can mask your identity, but only behind someone who's notoriously signed a Code of Ethics that requires them to surrender your identity to criminal investigators when asked, without needing a subpoena."
- iancarroll 5y ago
  Respectfully, you have a very optimistic view of how this plays out in practice, or even just from what is written in that article. Having obtained several EV certificates for "Stripe Inc", a company I created for $100 on the internet, this is a very basic process with very minimal safeguards. For example, Dun & Bradstreet really does not verify anything at all in its database, and most of the system is based around it for US-based certificates. https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-...

derefr 5y ago

From Namecheap's article on EV certs: > [Criterion 2] Physical existence > To check the organization's physical existence and business presence, the Certificate Authority must verify that the physical address provided by the Applicant is an address where the organization conducts business operations (not a mail drop, P.O. box or an address for an agent of the Organization). This address will be included into the body of the SSL certificate after verification. That effectively translates to "there should be an address that criminal investigators can be sent to find and detain employees of the company." > [Criterion 4] Operational existence > To make sure that an organization is financially active and engaged in business activities, the Certificate Authority must verify that at least one of the following requirements is met: > The Organization has been in existence for at least three years > The Organization is registered in the Dun & Bradstreet database or Qualified Government Tax database > The Organization has an active demand deposit account which can be proved by a bank statement. That effectively translates to "you can't just make up an LLC and immediately get an EV cert for it, even if you do tell them your house is the headquarters. You'd have to put a good amount of time and effort into simulating a real business. So much that, if this were a spoofing attempt, you'd be noticed as in breach of trademark by the company you're trying to spoof, long before you got away with it." > Professional Opinion Letter > If you need to obtain an EV certificate urgently or prefer keeping the company details confidential, it is possible to send a professional opinion letter signed by a Lawyer, Public Notary or Certified Public Accountant. The person who signed the legal opinion or accountant letter should have a valid license within the country where the organization is registered or the country where the organization maintains an office or a physical facility. To expedite the validation process, we highly recommend requesting a Professional Opinion from a person who speaks English so that he or she can confirm the signature during phone verification with a Comodo (now Sectigo CA) validation agent. And this, finally, translates to "you can mask your identity, but only behind someone who's notoriously signed a Code of Ethics that requires them to surrender your identity to criminal investigators when asked, without needing a subpoena."

iancarroll 5y ago
Respectfully, you have a very optimistic view of how this plays out in practice, or even just from what is written in that article. Having obtained several EV certificates for "Stripe Inc", a company I created for $100 on the internet, this is a very basic process with very minimal safeguards. For example, Dun & Bradstreet really does not verify anything at all in its database, and most of the system is based around it for US-based certificates. https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-...