3 ms·

It's so weird that we ended up with a system that converges whether or not the server's name is trustworthy. Who cares about server names? Better would be if y

It's so weird that we ended up with a system that converges whether or not the server's name is trustworthy. Who cares about server names? Better would be if you configured your browser to trust data based on which people had signed that data.

earnesti 2y ago
That is not the issue stated here (looking at the comments, not at the article itself which is very unclear). THe problem is, allegedly, that ad platforms allow displaying on their ad a domain they don't own. For example, you can have ad that displays the link text "mozilla.org" while the link actually directs to "scam-mozilla.org"
- __MatrixMan__ 2y ago
  But why would anybody want to do that? It's because the domain name they're displaying is more trustworthy than the one they're actually directing you to. So you gotta ask: How hard should we work to defend the trustworthiness of domain names? The author thinks we should work harder. Names are notoriously a weak spot when it comes to software. So many attacks converge on tampering with the referential integrity of names. It has been a problem for decades. Trust, by contrast, is a deeply human thing. We have been deciding who to trust and who not to for millennia. Those instincts though, they don't work for domain names. They work for humans, and a domain name is a lousy proxy for a trustworthy human. So these "vanity URLs", or "link fraud" as the author puts it, are a reminder that defending the trustworthiness of a domain name is a rather awkward position to be in. And I'm proposing that we find a different position to defend, rather than digging in where we are.
nailer 2y ago
Google removed the match between legal entities and public keys when they removed EV display from chrome. EV had issues, but Google chose to completely remove the idea of verification rather than address them.
- zrm 2y ago
  EV was never really good for anything because names aren't unique. The Beatles' record label is called Apple. So is a large tech company. Either of them could get an EV cert that says "Apple" on it. You can form a brand new entity that has the same name as an existing one. Trademarks are specific to the region and industry. Many individuals have the same first, middle and last name as another person. ICANN domain names are one of the rare type of names that are actually globally uniquely assigned.
  - nailer 2y ago
    Yes, naming conflicts within the United States where multiple companies can register the same name in different states are one of the issues I mentioned that Google did not address. Your point about trademarks is also valid.
    - account42 2y ago
      There is also the point that people fooled by app1e.com will also be fooled by some similarily creative company name hack. And that's even before realizing that there are legit companies whose name has little to do with the brands customers know. In the end EV certs only pushed the name verification issue from one protection racket (ICANN) to another protection racket (EV certs providers) without actually providing much additional security. I'm glad that they are gone.
      - nailer 2y ago
        It's more likely www.apple.com.shop/buy-mac/macbook-pro. And yes, DNS is much harder for regular people to understand than company names.

earnesti 2y ago

That is not the issue stated here (looking at the comments, not at the article itself which is very unclear). THe problem is, allegedly, that ad platforms allow displaying on their ad a domain they don't own. For example, you can have ad that displays the link text "mozilla.org" while the link actually directs to "scam-mozilla.org"

__MatrixMan__ 2y ago
But why would anybody want to do that? It's because the domain name they're displaying is more trustworthy than the one they're actually directing you to. So you gotta ask: How hard should we work to defend the trustworthiness of domain names? The author thinks we should work harder. Names are notoriously a weak spot when it comes to software. So many attacks converge on tampering with the referential integrity of names. It has been a problem for decades. Trust, by contrast, is a deeply human thing. We have been deciding who to trust and who not to for millennia. Those instincts though, they don't work for domain names. They work for humans, and a domain name is a lousy proxy for a trustworthy human. So these "vanity URLs", or "link fraud" as the author puts it, are a reminder that defending the trustworthiness of a domain name is a rather awkward position to be in. And I'm proposing that we find a different position to defend, rather than digging in where we are.

nailer 2y ago

Google removed the match between legal entities and public keys when they removed EV display from chrome. EV had issues, but Google chose to completely remove the idea of verification rather than address them.

zrm 2y ago
EV was never really good for anything because names aren't unique. The Beatles' record label is called Apple. So is a large tech company. Either of them could get an EV cert that says "Apple" on it. You can form a brand new entity that has the same name as an existing one. Trademarks are specific to the region and industry. Many individuals have the same first, middle and last name as another person. ICANN domain names are one of the rare type of names that are actually globally uniquely assigned.
- nailer 2y ago
  Yes, naming conflicts within the United States where multiple companies can register the same name in different states are one of the issues I mentioned that Google did not address. Your point about trademarks is also valid.
  - account42 2y ago
    There is also the point that people fooled by app1e.com will also be fooled by some similarily creative company name hack. And that's even before realizing that there are legit companies whose name has little to do with the brands customers know. In the end EV certs only pushed the name verification issue from one protection racket (ICANN) to another protection racket (EV certs providers) without actually providing much additional security. I'm glad that they are gone.
    - nailer 2y ago
      It's more likely www.apple.com.shop/buy-mac/macbook-pro. And yes, DNS is much harder for regular people to understand than company names.