Hacker News Reader

Comment by Ajedi32 | Hacker News Reader

This seems like a good move long-term. It always did seem a little misleading to me for Chrome to be labeling a site as "Secure" when really all it's talking about is the security of your connection to the site.

I wonder how they're planning to handle EV certificates. They don't seem to be mentioned anywhere in this post. I seem to recall at least one person at Google advocating for removing EV indicators entirely.

View on HN

EV certificates are nothing other than a way for the CAs to make money now that people have realized that the CAs' core product is worth approximately $0.

Argument 1: this person was able to get an EV cert for "Stripe, Inc. [US]", an entity they registered in Kentucky, no relation to the Stripe, Inc. of California whose website is stripe.com. They were not able to get a certificate for stripe.com. (The CA revoked it, and then later apologized for revoking it because there was no reason by their policy to do so.) https://stripe.ian.sh/

Argument 2: the actual website for MasterCard's SecureCode is https://www.mycardsecure.com/ , whose EV cert is "Arcot Systems LLC [US]". The fact that it has a meaningless domain name is in no way fixed by it having a meaningless (but technically accurate, Arcot is the contractor for SecureCode) EV cert. How do you know you're actually supposed to type your personal information there?

Argument 3: the web's security model is based on origins (domain names), not on EV certs. If Stripe switches tomorrow to stripeiscool.com and a domain squatter gets stripe.com, my browser will still send cookies to stripe.com, even though it no longer has an EV cert, and it certainly won't send cookies to stripeiscool.com, even if it has an EV cert with the same organization. Even if EV were a good idea in the abstract, it lacks a plan to make it work with the web as actually deployed.

Counter-argument: domain names are notoriously bad at conveying the identity of real-world entities. How is a user supposed to know that my-bank.com is the domain for their bank, as opposed to mybank.com or my-bank.org? EV certs can serve much the same role that the "Verified" indicator does on social media sites; it provides some assurance that the name you're seeing on screen really _does_ belong to the person or company you think it does.

There are obviously issues with EV as it's currently implemented, but I believe the solution to that is to fix those issues, not to eliminate the indicator entirely.

A better long-term solution (although maybe too long-term) is to move to some auth mechanism that knows about your origin. When you get a bank account, you should get a U2F device (which should cost <$20, which should be far less than the amount the bank is already spending on securing your account) that you enroll then and there, and so if you end up at my-bank.org by mistake, it doesn't matter, your U2F device doesn't have a shared key with the origin and you can't log in. Or do the same sort of thing with WebAuthn. Or you scan a QR code with your phone and get a link to the bank's mobile website and bookmark it, or whatever.

Attack 1 makes me worry about whether this is solvable at all. There's a lot of "First Bank and Trust"s out there, and they'd all need an EV certificate for the same string, so avoiding the attack seems genuinely hard. Like social media (or curated app stores), the only way it can really work is if the "verified" marker creates first-class and second-class entities: the entities approved by the powerful as reasonable to do business with, and the entities that aren't. Someone makes a decision about which First Banks and Trusts are "real" and which ones aren't, and you can't appeal it.

That’s interesting. I wonder if it would help to show a couple more certificate fields alongside the authentic-sounding name, or if it would all just be equally ignored.

All equally ignored. Moreover, as the original comment points out the Browser doesn't care about any of it. A typical web site involves dozens, even hundreds of resources each of which might have involved a separate connection, separate certificate. Images, scripts, style, and of course dynamic content. But the EV display summarises just one, the one for the original document fetch.

A site you're looking at with an EV cert you're happy with might have an image that's supposed to say "Sorry, we're closed for maintenance" with the site's logo. But bad guys, who have a DV cert have substituted "Welcome, please use our new login system". They've also replaced the cool live map and fancy animated carousel below that with their "new" login form. So the site has the EV visuals, but bad guys who broke only DV can subvert it almost totally.

AFAIK you can configure this in chrome://flags to see what it looks like.

Do you know the thinking behind getting rid of the EV indicator? Is EV considered useless?

Edit: Just as I posted this, someone else answered my question: https://news.ycombinator.com/item?id=17093737

Reply on news.ycombinator.com