4 ms·

Don't EV certs create a net increase in security risk (if any web users understood what they were supposed to mean)? I'm not expert in these issues, but I've al

Don't EV certs create a net increase in security risk (if any web users understood what they were supposed to mean)? I'm not expert in these issues, but I've always doubted their security value: EV certs are supposed to communicate certainty[1] to typical web users about identity, confidentiality, and integrity. But, if I understand correctly, obtaining EV certs in someone else's name (or something close enough to fool web users) is possible without great cost, and so that message of high security is misleading. If EV certs were believed by end users, wouldn't we merely be creating a social engineering security hole? Competent thieves also would use EV certs and increase trust in their websites too. Thankfully, I've never met an end user without technical knowledge who understood what an EV cert was. I do know what they are and I don't trust them more than regular certs (which is not much for identity, but I do as protection against low-cost confidentiality and integrity attacks). [1] Re: "certainty": I know EV certs are supposed to be more secure and not perfectly secure, and that there is no perfect or 'certain' security. However, few end users understand the latter, and of the ones that do few would take the time to learn the degree of increased security EV provides. We shouldn't say, 'trust the green bar' unless we expect people to do it.

iancarroll 12y ago
Could you explain more about obtaining it under someone else's name? There are many checks in place to prevent this.
- hackuser 12y ago
  > Could you explain more about obtaining it under someone else's name? There are many checks in place to prevent this. Here's what I know, which is not conclusive but possibly persuasive, and as I say below, I've never seen someone call the checks effective: 1) In my experience obtaining regular certs, the identity verification looked ineffective (though I wasn't trying to fool anyone). 2) Regarding both EV and regular certs, I've read several times about ineffectiveness of the verification, and I've never seen someone say otherwise. 3) Finally, effective verification is hard and manually intensive; it's hard to believe it's economical or practical for the large volume of certs issued.
  - iancarroll 12y ago
    Organizationally validated certificates do not require a lot of paperwork or manual validation. The effectiveness of the verification is still a topic for discussion. However the last point is dubious at best, as CAs make >$30-40 per certificate and validation takes max 30 minutes spread out over a day or two (typically). I will say there are very few maliciously issued EV certificates.
    - hackuser 12y ago
      Thanks for responding. I get the sense that you have some expertise in this field? As I said above, I don't, so if you do please forgive any ignorance on my part: > CAs make >$30-40 per certificate and validation takes max 30 minutes spread out over a day or two (typically). $30-40 isn't much, and 30 minutes doesn't seem nearly sufficient to reliably verify someone's identity. > I will say there are very few maliciously issued EV certificates. How do we know? And is there a lower fraud rate for EV certs than for standard certs? (Probably there is little fraud in any set of business transactions -- otherwise nobody would participate -- but I don't think that's what you mean.)
      - iancarroll 12y ago
        Sorry for the late reply: > 30 minutes doesn't seem nearly sufficient to reliably verify someone's identity. It's actually not that long of a process once you read over the CPS's of a few CAs and the EV baseline. > How do we know? Ah, the golden question! Hopefully CT (certificate transparency) will sort this out within the next 3 years. My statement is an assumption but any high level fraud (e.g. Google/MSFT) is caught immediately (chrome pinning/reporting and internal CA logs, if you're not DigiNotar). I don't know about small companies though. I don't think there's ever been a maliciously issued EV cert in the context of the ComodoHacker and other very public hacks. They typically have tighter internal controls, that I know (e.g. RAs have very limited EV issuance power) but I have no numbers. :( You should note that EV implies DV validation, so to, without hacking, maliciously issue a certificate an attacker would probably settle for a DV cert.
michaelbuckbee 12y ago
You could consider EV certs as an economic attack by the Certificate Authorities and Browser vendors against phishing operations. As a baseline, it is fairly difficult now to receive a certificate for any well known company, charity or government entity. For example, even a standard non EV request for something like 'C1tybank.com' would be flagged for manual review and rejected. EV cert requests just up the amount, types and means of communication that must be done which (hopefully) raises costs more for phishers attempting to setup hundreds of scam sites than legit purchasers.

iancarroll 12y ago

Could you explain more about obtaining it under someone else's name? There are many checks in place to prevent this.

hackuser 12y ago
> Could you explain more about obtaining it under someone else's name? There are many checks in place to prevent this. Here's what I know, which is not conclusive but possibly persuasive, and as I say below, I've never seen someone call the checks effective: 1) In my experience obtaining regular certs, the identity verification looked ineffective (though I wasn't trying to fool anyone). 2) Regarding both EV and regular certs, I've read several times about ineffectiveness of the verification, and I've never seen someone say otherwise. 3) Finally, effective verification is hard and manually intensive; it's hard to believe it's economical or practical for the large volume of certs issued.
- iancarroll 12y ago
  Organizationally validated certificates do not require a lot of paperwork or manual validation. The effectiveness of the verification is still a topic for discussion. However the last point is dubious at best, as CAs make >$30-40 per certificate and validation takes max 30 minutes spread out over a day or two (typically). I will say there are very few maliciously issued EV certificates.
  - hackuser 12y ago
    Thanks for responding. I get the sense that you have some expertise in this field? As I said above, I don't, so if you do please forgive any ignorance on my part: > CAs make >$30-40 per certificate and validation takes max 30 minutes spread out over a day or two (typically). $30-40 isn't much, and 30 minutes doesn't seem nearly sufficient to reliably verify someone's identity. > I will say there are very few maliciously issued EV certificates. How do we know? And is there a lower fraud rate for EV certs than for standard certs? (Probably there is little fraud in any set of business transactions -- otherwise nobody would participate -- but I don't think that's what you mean.)
    - iancarroll 12y ago
      Sorry for the late reply: > 30 minutes doesn't seem nearly sufficient to reliably verify someone's identity. It's actually not that long of a process once you read over the CPS's of a few CAs and the EV baseline. > How do we know? Ah, the golden question! Hopefully CT (certificate transparency) will sort this out within the next 3 years. My statement is an assumption but any high level fraud (e.g. Google/MSFT) is caught immediately (chrome pinning/reporting and internal CA logs, if you're not DigiNotar). I don't know about small companies though. I don't think there's ever been a maliciously issued EV cert in the context of the ComodoHacker and other very public hacks. They typically have tighter internal controls, that I know (e.g. RAs have very limited EV issuance power) but I have no numbers. :( You should note that EV implies DV validation, so to, without hacking, maliciously issue a certificate an attacker would probably settle for a DV cert.

michaelbuckbee 12y ago

You could consider EV certs as an economic attack by the Certificate Authorities and Browser vendors against phishing operations. As a baseline, it is fairly difficult now to receive a certificate for any well known company, charity or government entity. For example, even a standard non EV request for something like 'C1tybank.com' would be flagged for manual review and rejected. EV cert requests just up the amount, types and means of communication that must be done which (hopefully) raises costs more for phishers attempting to setup hundreds of scam sites than legit purchasers.