3 ms·

Obviously you know 1000x more about this than I do, so I'm interesting in your take on: "CAs do not provide value". Is it really the case that anyone can get a

Obviously you know 1000x more about this than I do, so I'm interesting in your take on: "CAs do not provide value". Is it really the case that anyone can get a CA to issue a certificate for "Wellsfargo.com?" Doesn't the CA provide some level of value to the consumer, that they really are connecting to someone who was able to prove they have control over the "wellsfargo" domain, or at least their DNS server? And, likewise, doesn't the CA provide some level of value to the Bank, who wants the nice "Green Lock" appearing in the URL bar? Nobody is arguing that the system is bulletproof, that all consumers are educated to watch for a "green" HTTPS connection, and that 100% of certificates have always been assigned to the proper party, and only the proper party - but, by and large, isn't the job of a CA (and the value that they offer), to provide some level of assurance that you really are connecting to the website that you think you are connecting to? And, haven't they provided a lot of that value over the last decade or so?

iancarroll 12y ago
No. Wells Fargo is on every CA's high risk list. Even if you were able to pass the validation for the domain it would be flagged and you would have to go through a lot more checks.
michaelbuckbee 12y ago
SSL/TLS Certs are trying to deal with two separate problems: 1. Over the wire encryption - where most of the criticisms in this thread are focused. Which I will also defer to tptacek's knowledge. 2. Site identification as an anti-phishing mechanism. For even the cheapest certs (domain+email validated) - the CAs will reject SSL cert requests for anything that might be a phishing target. Detecting "wellsfargo.com" is pretty easy, where it gets tricky is things like "wellsforgo.com", "wellsfàrgo.com" etc. This has even gotten weird as the browser makers have started to really de-emphasize domain certs vs ev certs (cheap vs expensive), to the point where in most cases now having a domain cert does not know green at all. Screenshots: https://www.expeditedssl.com/pages/visual-security-browser-ssl-icons-and-design https://www.expeditedssl.com/pages/visual-security-browser-s...

iancarroll 12y ago

No. Wells Fargo is on every CA's high risk list. Even if you were able to pass the validation for the domain it would be flagged and you would have to go through a lot more checks.

michaelbuckbee 12y ago

SSL/TLS Certs are trying to deal with two separate problems: 1. Over the wire encryption - where most of the criticisms in this thread are focused. Which I will also defer to tptacek's knowledge. 2. Site identification as an anti-phishing mechanism. For even the cheapest certs (domain+email validated) - the CAs will reject SSL cert requests for anything that might be a phishing target. Detecting "wellsfargo.com" is pretty easy, where it gets tricky is things like "wellsforgo.com", "wellsfàrgo.com" etc. This has even gotten weird as the browser makers have started to really de-emphasize domain certs vs ev certs (cheap vs expensive), to the point where in most cases now having a domain cert does not know green at all. Screenshots: https://www.expeditedssl.com/pages/visual-security-browser-ssl-icons-and-design https://www.expeditedssl.com/pages/visual-security-browser-s...