4 ms·

summary of article: no... assuming you've got £15 to set up a company (such as the pirate one in the article), and £149 for a cert, anyone can have one

by blibble 11y ago

nailer 11y ago
That's not an accurate summary. The certificate is that you're at that company: only someone with sufficient authority in that specific company can acquire a certificate saying you're that company. As the article mentions, that not to say there isn't flaws in the process. But most attacks against EV have come in the form of DV downgrades rather than falsely issued EV certificates. Actually, if you have info on any falsely issued EV certificates I'd be really interested.
- blibble 11y ago
  right, so if I have £15, I can pay £15 to Companies House to start a company, and then I can authorise anything. EV offers nothing over normal certs, other than the company name and the green bar, and I can control the company name if I have another £15...
  - nailer 11y ago
    You can authorise a certificate only for the company you just created, which is most definitely not 'anything'
    - sbierwagen 11y ago
      What stops a Russian EV cert vendor for authorizing a EV cert for impostor company Example LLC, when the real corp is Example Inc?
      - nailer 11y ago
        > What stops a Russian EV cert vendor for authorizing a EV cert for impostor company Example LLC, when the real corp is Example Inc? - The Registry of Companies & Intellectual Property in Russia must accept Example LLC as a valid business name which may be difficult if Example Inc was well known. - The issuing CA must manually inspect all requested domain names in the EV cert and ensure there is no phishing attempt. A certificate request for the hostname 'example.com.example.ru' would be rejected. Depending on how well known Example Inc is - eg, say they were Bank of America - even 'example.ru' may be rejected. - If for some reason this failed and a certificate for the identically named Russian company was issued, it would read 'Example LLC [RU]' in the address bar rather than 'Example Inc [US]'

summary of article: no... assuming you've got £15 to set up a company (such as the pirate one in the article), and £149 for a cert, anyone can have one

by blibble 11y ago

summary of article: no... assuming you've got £15 to set up a company (such as the pirate one in the article), and £149 for a cert, anyone can have one

nailer 11y ago

That's not an accurate summary. The certificate is that you're at that company: only someone with sufficient authority in that specific company can acquire a certificate saying you're that company. As the article mentions, that not to say there isn't flaws in the process. But most attacks against EV have come in the form of DV downgrades rather than falsely issued EV certificates. Actually, if you have info on any falsely issued EV certificates I'd be really interested.

blibble 11y ago
right, so if I have £15, I can pay £15 to Companies House to start a company, and then I can authorise anything. EV offers nothing over normal certs, other than the company name and the green bar, and I can control the company name if I have another £15...
- nailer 11y ago
  You can authorise a certificate only for the company you just created, which is most definitely not 'anything'
  - sbierwagen 11y ago
    What stops a Russian EV cert vendor for authorizing a EV cert for impostor company Example LLC, when the real corp is Example Inc?
    - nailer 11y ago
      > What stops a Russian EV cert vendor for authorizing a EV cert for impostor company Example LLC, when the real corp is Example Inc? - The Registry of Companies & Intellectual Property in Russia must accept Example LLC as a valid business name which may be difficult if Example Inc was well known. - The issuing CA must manually inspect all requested domain names in the EV cert and ensure there is no phishing attempt. A certificate request for the hostname 'example.com.example.ru' would be rejected. Depending on how well known Example Inc is - eg, say they were Bank of America - even 'example.ru' may be rejected. - If for some reason this failed and a certificate for the identically named Russian company was issued, it would read 'Example LLC [RU]' in the address bar rather than 'Example Inc [US]'