The Power to Revoke Lies with the Certificate Authority

On EV certs, Troy Hunt rightly pointed that no one really cares about them and many major websites (amazon, youtube, facebook) don't even bother:

https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...

Here in the UK there is another problem with EV certs, there is no way of registering a "trading name" or "doing business as (DBA) name" against a company so you can only have an EV cert issues against your actual registered business name. If that is different from your trading name and what you use as your domain name then they are less than worthless. For example, if the company is "Widgets of London Limited" but trade online as "Widgets Online" with the domain "widgetsonline.com" they cant get an EV cert with "Widgets Online" as the name - even if they own the registered trademark of it.

The idea behind EV's (to tie domain ownership to real-world legal entities) is sound, it's just that the implementation is poor.

If the EV badge identifies a legal entity plus its country of origin, then how is it supposed to be the CA's fault that there's this leaky abstraction of multiple legal entities with the same name in the same country? If we have a good idea and a poor implementation, then the correct response is to fix the implementation, not throw out the whole idea as fundamentally broken.

Unfortunately, there's also not much that the CAs can do to fix this by themselves. If we want to have a digital representation of a legal entity's identity, the best way to do that is to have a first-class digital identity rather than the hack of a system we have today which attempts to create a poorly supported, non-portable identity on the basis of emailed paperwork and phone calls. Such a first class identity - with private keys controlled by the legal entity, entrusted to the entity when it was first created - will allow clients to verify the identity against the source which actually governs it.

I can understand the privacy concerns surrounding the creation of legal digital personal identities - the creation of a definitive population ledger that goes along with it etc. But for companies? That the US doesn't have such a solution for companies in this day and age is just myopic.

I agree with the fundamental conclusion that, due to changes in the Internet, CAs are quickly becoming arbiters of what content is valid or not in the public's eyes -- a job they aren't ready for and never asked for. The article linked goes about discussing this issue in a hyperbolic manner and it commits a few critical thinking mistakes despite arriving at a valid conclusion.

Briefly, I'm going to focus on just one of these. I leave it to the reader to spot the others.

Ian Carroll got an Extended Validation (EV) for Stripe in another state to prove that EVs are forge-able. That is, although he followed the guidelines, he believed those guidelines weren't enough to safeguard an EV.

Then when the Certificate Authority (CA) finds out about this and revokes his deliberately misleading EV, Scott Helme writes the article linked accusing and detailing how CAs have too much power, because they can revoke an EV based on arbitrary decisions. He defines arbitrary decisions as "not following the guidelines".

To summarize: Ian Carroll abuses the guidelines to register a deceptive EV to prove that the guidelines aren't enough. Then Scott Helme accuses the CA of not following its own guidelines and of taking an arbitrary decision to revoke Carroll's abusive certificate.

They just can't win.

I'm not sure how EV certs have continued to be a thing for so long.

Does anybody trust an EV cert more than a DV cert? It's hard enough to get the average person to check for the green padlock before they enter their password, how can we hope to convince anybody to check the company details in the certificate?

I think it's fine that they revoked the cert because Ian's site looked exactly like Stripe. The point he made still stands though: That the EV is pretty much only lipstick.

I thought they had a bit more background checks for EV certificates but apparently it looks more like some placebo effect than anything else.

EV's are a waste of time. Sites should focus on HSTS, DNSSEC and a CAA record and all the other things that make a difference and actually provide some material benefit and some protection to the end user rather than a green traffic light approach to security.

I always like the idea of what EV Certs are intended to be, I just don't think the browser exposure to general public users has any value.

Factoring in EV Certs for systems that are scanning the internet and trying to separate things that might need more validation...think news agencies and the search engines or social media that distribute their content. This illustrates both the benefit and the consequence of that model at the same time.

It would be ideal if there were some type of EV appeals committee to deal with revoked certs that could mandate a revoked EV be reinstated in a situation like this.

There is a place where using the EV model of more comprehensive verification can be beneficial...it's just not to the general public in a browser bar.

I don't see the problem. If it was really a phishing site, law enforcement now has the legal address of your registered company and whatever metadata they collect as part of incorporation. I'd say EV worked perfectly.

The only thing you need to know about EV is this: If an attacker puts up a MITM site with a valid DV cert, your browser will be like, cool, let's use this less-verified cert instead, because a CA signed it, even though the last time I visited it was an EV cert. Your browser doesn't care, users don't care, it doesn't actually improve security.

When I pay with PayPal I usually ask myself if the website I'm on right now is genuine. I check if it's https, I check if the name is on the cert (the green lipstick) and, most important, if my password manager trusts this site by let it search for credentials matching the current url. Oh,of course I'm not on a public wlan... Can't it be easier?

Revoking lies sounds like an amazing power.

At my work (all B2B SaaS), we have a lot of financial customers that go far down the rabbit hole with us on security and never once have any of them given us grief on DV certs. Most of them also use DV certs. What I don't see much of is LetsEncrypt.

Previous discussion: https://news.ycombinator.com/item?id=15904513

Why don't US EV certs specify the state, if that's important in distinguishing US company names?

A green security badget is easier to sell then SSL/TLS/encryption .

There are several points in this post but the bulk of it is, I feel, one of those classic fallacies that journalists or security hobbyists often engage in:

"I found what looks like a flaw in a system but I didn't try to exploit it for real, look how clever I am"

So his mate registered a company with the same name as another company and got an EV cert. Well done. Everyone knew that was possible already, at least everyone who has gone through the process. It doesn't matter much:

1. Ian wasn't actually a phisher or criminal. If he had been, and had used that EV cert to phish Stripe customers, he'd have been reported to the police using the details from the CA and possibly prosecuted. Bear in mind he had to register a company in the USA, not Kazakhstan.

2. Therefore in reality it is very rare for phishers to use EV SSL certificates. Actually I've never seen it.

So is this a demo that the system is horribly flawed? I don't think so. It's rather similar to people who send 10 spams to some accounts they just registered themselves and claim they've found a way to beat a spam filter so the whole thing is useless ... well, no, you weren't actually a spammer so the filter did the right thing. You're testing a flaw you think sounds realistic but isn't. Another common case of this, someone who beats a DRM system on a game 6 months after it was released and then talks about how useless copy protection is, not realising that after 6 months almost all sales happened already so the system worked just fine from the developers perspective.

What about revocation? Is the CA exercising undue control here? Probably not. CAs have language in the contracts you agree to at the time about how you're not trying to misrepresent yourself as if you were someone else. Ian's argument that he registered a name that happens to be identical to a well known payment processor, but in another state, is technically correct, which is of course the best kind of correct. But the underlying purpose was clearly impersonation, which is a violation of the agreements and thus not only grounds for revocation, but to not do so would rather undermine the whole system - why should Ian get away with it when others do not?

If stripe.ian.sh had been an actual operating company that happened to have experienced an unfortunate naming conflict with the other Stripe, I bet the CAs would not have revoked. They'd have found some reasonable solution - probably by letting the cert continue, on the grounds that no malicious behaviour was taking place in violation of the agreements. But it wasn't - it was just a dummy site.

Overall I don't understand Scott or Ian's point. Yes, legal names aren't globally unique. Did anyone think they were? Yes, Chrome's EV UI is rubbish and the big players other than Apple tend to have an institutional dislike of EV certs because of historical clumsy attempts at market segmentation pricing by CAs, that were totally unreasonable for companies with lots of servers. Yes, EV is imperfect.

The alternative though is paypal-customer-centerr.com ... which is better, how, exactly? It isn't.

If Scott Helme or Ian Carroll don't like how EV works today, why not go find actual criminal abusers and propose specific improvements that would stop them - perhaps making Chrome's address bar work more like Safari's. Otherwise this is just another blog pointing out security stuff that doesn't really matter.