Hacker News Reader

Comment by mavdi | Hacker News Reader

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

View on HN

That's .02% of all certs issued. A road might enable a bank robber to get away faster, but nobody is complaining that we shouldn't build roads because of it.

That's only Paypal :) There are hundreds more instances of abuse

And 99,900,000 instances of non-abuse. A free service gets abused, surprise surprise. As LE have said, it's not their problem to solve typo-squatters, or IP infringement.

I did some work in this space. The cert authorities were never really designed to be a backstop against phishers as that threat really rose up in prominence after they were setup. And it placed them in a weird gatekeeper role.

As designed, it was supposed to be that:

Domain Validation (DV) certs would indicate that your connection was secure.

Extended Validation (EV) certs would indicate that your connection was secure and you were connecting to the proper site.

In reality, the problems with phishing and mis-issued DV certs got so bad that that issuers like GeoTrust (owned by Symantec) began keyword checking DV certs for major company trademarks, phishing targets, etc. that depending on what it was would put your through varying degrees of scrutiny.

Examples:

- Some used bookstore had a domain like "the-good-book.com" which got flagged for manual review b/c of the "book.com" string and so many "facebook.com" phishing attempts.

- Anytime people would request certs for BMW, HBO, would trigger requests for contact information within those organizations and often a phone call from GeoTrust

- It was basically impossible to get anything issued with the term "paypal", "bank" or "apple" in the domain.

Please note that these were all for run of the mill - $15 single domain, DV certs.

This was for a fairly high end service that required credit card accounts, etc and we still saw around 5% of requests get pulled (rightly or wrongly) into one of these manual review filters.

It was a fairly unsung and unappreciated part of the what the cert issuers were doing - but it absolutely 100% helped.

LetsEncrypt is forcing the Cert and Browser industry back to the original DV/EV split and it's unclear where we're going to land.

Right now even technical people _trust_ the green lock and it's wildly easy to miss the fact that you're on a domain that is paypal-login-security-usa-1.com

I think we're going to see a future where the browser indicators are:

Red -> No SSL

Gray -> DV SSL

Green -> EV SSL

Browsers should also completely drop that lock icon for any type of connection as it's connotated wrongly in too many heads (even for EV because what you really need to check is that it is issued to the right company).

Damn it, those people creating those safety belts. Now drug dealers use them too and they don't die when they run away with drugs in their fast cars !

Why is nobody complaining about the fraudulent domain names and the registries that enable them? This is where the problem starts. The certificate only proves that the owner has access to the domain, nothing more.

That's not going to do much, because subdomains are a thing. Aren't a lot of phishing domains like:

fake-paypal.phish.com

I think you misunderstand how domain validated certs work. DV certs have always been issued with the simple check that you own the domain (either by email or by DNS). The email check was always a bit scary because email is so readily forgeable.

damage they've done? Or damage phishers have done? Are we not to advance technology because some scumbags might abuse the technology?

https://letsencrypt.org/2015/10/29/phishing-and-malware.html

0.02% is a lot less than I thought there'd be. There's also nothing stopping people from buying certificates from legacy CAs, do you have the stats on how many non-letsencrypt phishing certificates there are?

Do you really think the world is worse off because of Let's Encrypt?

What prevented Paypal phishing sites from buying certificates from other providers?

checks they're supposed to be performing. Some are ignoring them but being punished for it. http://www.bbc.com/news/technology-39365315

I'd definitely recommend clicking through that article and reading the source of the announcement:

https://groups.google.com/a/chromium.org/forum/m/#!msg/blink...

> As captured in Chrome’s Root Certificate Policy, root certificate authorities are expected to perform a number of critical functions commensurate with the trust granted to them. This includes properly ensuring that domain control validation is performed for server certificates, to audit logs frequently for evidence of unauthorized issuance, and to protect their infrastructure in order to minimize the ability for the issuance of fraudulent certs.

> On the basis of the details publicly provided by Symantec, we do not believe that they have properly upheld these principles, and as such, have created significant risk for Google Chrome users. Symantec allowed at least four parties access to their infrastructure in a way to cause certificate issuance, did not sufficiently oversee these capabilities as required and expected, and when presented with evidence of these organizations’ failure to abide to the appropriate standard of care, failed to disclose such information in a timely manner or to identify the significance of the issues reported to them.

i.e. they apparently weren't even checking requesters controlled the domain they requested a certificate for in some instances!! And that's pretty much the only requirement for DV certificates?

My point is that the legacy ssl providers you're referring to were doing less checks than Lets Encrypt!

DV certificates were never required to have different checks than what LE is doing, so what checks are you talking about?

Both Mozilla[1] and Google[2] are on the record as saying that they don't believe CAs should be the ones to detect and block domains used for phishing and malware. Both are also platinum sponsors of Let's Encrypt.

[1]: https://groups.google.com/forum/#!msg/mozilla.dev.security.p...

[2]: https://groups.google.com/forum/#!msg/mozilla.dev.security.p...

The part where it wasn't scalable because it wasn't free.

Reply on news.ycombinator.com