5 ms·

Interesting. Perhaps an alternative to the keyword warning system you describe (for SSL certs only) could be to scan the candidate CN for existing SSL certs. If

Interesting. Perhaps an alternative to the keyword warning system you describe (for SSL certs only) could be to scan the candidate CN for existing SSL certs. If any are found, flag it for manual review, or possibly come up with a proof system whereby the applicant proves he is the holder of the former certificate.

michaelbuckbee 12y ago
The problem is that phishers register sound alike domains like info-secure-apple.com or atlanta-usbank.com, that were completely clean prior to issuance.
- ademarre 12y ago
  One could argue that should be okay for a class of certificate without identity/organization verification.
  - MichaelGG 12y ago
    Actually, yeah, they should. Info Secure Apple. Make a comment forum about fruit-borne illness. Why should that be denied because there are companies using one of those words? What we "need" more of is EV-style validation, so I can see that the site I'm on is an actual company registered in whichever territory. Otherwise all it indicates is that an email address with the associated domain is linked to the private key for this site. Not really what most people are looking for.
- womble 12y ago
  Anything that includes a trademark (like info-secure-apple.com) or "risky" term (like atlanta-usbank.com) typically ends up getting manually verified, even for domain-validated certs. Not saying that plenty of dodgy stuff doesn't slip through the cracks, but it isn't quite a wild-west free-for-all...
  - michaelbuckbee 12y ago
    Quite old now, but this was actually my point. That there is NOT really a level of validation that is/can be wholly automated and to try and develop a co-op or service with that assumption is bound for trouble.
    - womble 12y ago
      I'm not developing the co-op based on the assumption that domain validation can be wholly automated -- but it can be automated for the 99+% of domains that don't try to phish people. I'd say the degree of phishing certificate requests made via the co-op will be lower than the "general population", simply because only members can request certificates. That isn't to say that the CA's policies will be any less stringent because of that, but I don't expect to be spending all of my day clicking "reject" on shady CSRs.

michaelbuckbee 12y ago

The problem is that phishers register sound alike domains like info-secure-apple.com or atlanta-usbank.com, that were completely clean prior to issuance.

ademarre 12y ago
One could argue that should be okay for a class of certificate without identity/organization verification.
- MichaelGG 12y ago
  Actually, yeah, they should. Info Secure Apple. Make a comment forum about fruit-borne illness. Why should that be denied because there are companies using one of those words? What we "need" more of is EV-style validation, so I can see that the site I'm on is an actual company registered in whichever territory. Otherwise all it indicates is that an email address with the associated domain is linked to the private key for this site. Not really what most people are looking for.
womble 12y ago
Anything that includes a trademark (like info-secure-apple.com) or "risky" term (like atlanta-usbank.com) typically ends up getting manually verified, even for domain-validated certs. Not saying that plenty of dodgy stuff doesn't slip through the cracks, but it isn't quite a wild-west free-for-all...
- michaelbuckbee 12y ago
  Quite old now, but this was actually my point. That there is NOT really a level of validation that is/can be wholly automated and to try and develop a co-op or service with that assumption is bound for trouble.
  - womble 12y ago
    I'm not developing the co-op based on the assumption that domain validation can be wholly automated -- but it can be automated for the 99+% of domains that don't try to phish people. I'd say the degree of phishing certificate requests made via the co-op will be lower than the "general population", simply because only members can request certificates. That isn't to say that the CA's policies will be any less stringent because of that, but I don't expect to be spending all of my day clicking "reject" on shady CSRs.