Hacker News Reader

> It's quite unlikely that an EV cert would be issued for washingtonpostnews.com

I think the https://stripe.ian.sh story argues otherwise - it would be pretty easy to start an LLC named "Washington Post News" in some other state and have the government agencies be fine with that. (In fact, for the specific case of Washington Posts, half of all US states have a city/town named "Washington.")

Also the more practical problem with the Washington Post is the existence of the Washington Times, established in 1982 by Sun Myung Moon well before the web or SSL.

This is one example, sure, but EV does, in general, work. And the reason why is not because it's an ironclad indefeatable process for proving you are legitimately a major trustworthy party: It's a frustrating pile of hoops to jump through. The arcane and archaic nature of getting an EV gates out malicious actors pretty effectively.

If you go through all of the process to get an EV (often involving scanned/faxed documents and phone calls), and then do something malicious with it, you're going to end up burning it (getting it revoked, generally, though, obviously the nightmare of revocation being still effectively broken comes into play) or even just the domain blocked by web filters and marked unsafe in the Safe Browsing list, setting you back to square one. All an EV vendor has to do for this to work is remember not to issue an EV again to anyone who uses the same credentials or proofs, whether or not they verified them with other authorities.

Whereas a domain-validated cert can, of course, be automated (as can domain purchasing), meaning DV certs can scale. As with spam, malware, etc., you just publish it in volume, keep changing addresses, content, etc. to evade automated filtering, and press on.

Meanwhile, if someone gets a Washington Post News EV, and starts impersonating WaPo, they only have one target to shut down a malicious actor.

I could give non-CA-related examples, but I've come to the belief recently that security and trust is often a matter of creating solutions which don't scale.

https://stripe.ian.sh addresses this objection:

> First, from incorporation to issuance of the EV certificate, I spent less than an hour of my time and about $177. $100 of this was to incorporate the company, and $77 was for the certificate. It took about 48 hours from incorporation to the issuance of the certificate.

> The primary point raised by advocates of extended validation is that obtaining EV certificates would leave behind a signifigant paper trail of the bad actor's identity. However, there is minimal individual identity verification in the process. Dun & Bradstreet1 is the only entity who attempted to verify my identity, and did so with a few trivial identity verification questions. Purchasing identities with answers to common verification questions is neither hard nor expensive.

> Otherwise, there was no attempt at identity verification from the state of Kentucky or the registered agent I used in the process. This is typical of company formation in the United States.

Given the use of a registered agent, and given that registered agents are a pretty common thing, I don't think that anything is actually being burned here, unless you want to say that any registered agent who incorporates a phishing company gets all their other companies banned. Which, like the CASC's "You can't have EV if you haven't existed for 18 months" suggestion, will technically work at the cost of making EV useless.

Also, a lot of attacks don't care that they're burning credentials anyway. You don't need to spoof MyEtherWallet more than once to walk off with hundreds of thousands in Ethereum. You don't need to spoof the Washington Post more than once to spread fake news 48 hours before a presidential election.

Your first quote proves my point: $177 times... how many malicious attempts? That isn't a cost that scales, because in the case of a multitude of malicious activities online, the number of attempts, at $177 a try, would not be worth it. You are using an example of singular high profile attempts, such as "I incorporated a company for this demo" or "I am a state actor trying to derail a Presidential election". While you fail to recognize that EV would likely protect users from 99% of attacks caused by malicious actors spoofing domains, which could trivially be domain validated otherwise.

I find this a particular trend amongst security discussion, particularly here on HN: Focus on the most possibly sophisticated and capable attack, while ignoring that tens of millions of users are afflicted by pretty rudimentary attacks that are more or less automated on a daily basis. If EV were to solely succeed in ensuring an actual human had to go through the registration process, it would almost certainly be worth it.

Additionally, as a point of note, EV certificates could be made vastly more effective by easily addressing your concerns: Raise the price of EV certs significantly, which CAs would be more than happy to do, and ensure you needed to go to one of the upper levels of the CA system (say, having to go to Comodo for them, rather than your Trustico nonsense) to reduce the number of parties which could issue them as much as possible, and raise the mutual requirements between them to issue them.

Our scales of economics must be totally off. I'd argue that an attack that costs $177 a try is entirely scalable - presumably you should gain more than $177 in value from a single spoofed domain, right?

I do agree that if $177 is too high a cost, then the problem is solvable by just setting a price floor on certificates (modulo CA/Browser Forum antitrust concerns). I do not think that solution is likely to work, except at a price point at which EV becomes unusably expensive for legitimate users.

EV only works if we are reasonably confident that users will refuse to enter credentials into a site without EV. As EV stands today - with EV costing less than $177 for a legitimate user (because they've already incorporated) - that isn't happening. Making EV harder to acquire doesn't actually solve phishing. That's my objection. Sure, you can make it harder to get an EV cert for a phishing site, but, so what?

(A better solution that actually works against rudimentary attacks is to just give everyone a U2F security key.)

I don't agree EV should be the bar for "entering credentials". I currently don't consider it a requirement that I only "enter credentials" in HTTPS sites either, insofar as "credentials" is a very wide term. (I find the fact that simple password boxes on low security sites now pester me with a dropdown warning on Firefox. I know they're HTTP sites, but I don't care.)

As an example I do not care about: My HN account. I would not care if it was intercepted and "hacked", because the damage it can do to me personally is minimal. It would probably annoy the mods somewhat, but the handful of spam posts would get cleaned up, I'd have to reach out to the mods to get unbanned, and life would move on. I don't really care that HN has a cert at all, I certainly don't think HN needs an EV cert, I have no real concern about either my password being intercepted, or me being phished into believing a fake site is HN.

If we move DV certificates to be the bare minimum a site is expected to have, then EV should be a bar for important credentials. Aka, your Gmail account, your Bank of America account, etc. You know, Fortune 500 level companies which could afford, I don't know, a $5,000 or more annual investment. The higher cost would also justify higher requirements to get one. At that sort of cost, they could literally fly someone out to your office to check you out directly.

Whereas people have mistakenly corroborated the lock icon with "legitimate websites", an EV cert should ideally be the sort of thing household name companies have, which someone trustworthy has directly ensured is actually the keepers of that certificate.

I don't think placing the burden on my grandma to have a U2F security key is reasonable, but we should have a process so that google.com is clearly marked as being owned by Google, LLC, and that it is, in fact, the real google.com.

I support DV as the bare minimum for sites, and agree that sites with specific concerns should have something stronger.

I don't think that EV for "important credentials" is likely to be a workable option or a good one for society for the following reasons:

- Simply displaying EV and not using it as part of some automated should-the-browser-pass-credentials flow is, I believe, unlikely to deter phishing. (If you disagree, let's find studies, which probably exist, and I'll concede the point if the studies show that it works. But given that Verified by Visa uses this site with this EV cert https://www.mycardsecure.com/ and expects you to enter personal info there, I'm not optimistic.)

- I do not see how a web browser can determine whose credentials are important to whom. I would expect that there are people on HN who do care deeply about their account not being compromised (e.g., founders and VCs).

- If we simply state that the only people with EV certs are current Fortune 500 companies and current household names, that seems like a bad political decision for the web - first, it is political, and second, it seems like a position that's pretty strongly at odds with the web's political values, insofar as they exist: the web has long been a place for upstarts to compete on an equal footing with companies that have been around for years.

- There are solutions other than EV for these problems, like U2F and also password managers. The fact that the MyEtherWallet BGP attackers were able to steal user login credentials without even getting a valid SSL cert makes me not optimistic about "make certs harder to get" being the answer - we should stop the mechanism by which those credentials were sent in the first place.

I do think placing the burden on your grandma to have a U2F security key is entirely reasonable - she has a key to get into her house, right? A fob to get into her car? A credit card with an EMV chip? I think your grandma is perfectly capable of plugging something into a USB port.

How does a U2F key even solve the problem of knowing that a website associates with a real identity? It may stop a phishing attack, but where do you get the initial trust to begin with?

I think the issue is that we need to know that google.com can be shown to clearly be owned by Google, LLC, and not GoogleCo in a small African nation. (And also, presumably, that google.com is actually google.com, and not some weird substitutions in there like https://www.xn--80ak6aa92e.com/ which shows as apple.com on Firefox.) That's going to be the EV system or something like it, and it's inherently impossible to keep that in line with "the web's political values", if you describe those values as requiring that "anyone can get one". There will always be some justification that someone, somewhere, can find to call themselves something.

> I think the issue is that we need to know that google.com can be shown to clearly be owned by Google, LLC, and not GoogleCo in a small African nation.

Google, LLC? Why not Google, Inc.? Wait, is it Alphabet, Inc.? Why do I trust companies from Palo Alto (or Delaware?) more than I trust companies from small African nations?

I don't trust google.com because they're run by some Delaware corporation named "Alphabet." I trust them because I have come to trust G O O G L E dot C O M, generally by being told by other people that G O O G L E dot C O M is a good site (or perhaps in the case of Google, because it's baked into my web browser, which I've figured out how to bootstrap trust for). I trust - and want to enter credentials into - gmail.com because they're the owners of the website gmail.com, and when I give out my email address to people, I say "gmail.com", not "an email service run by a subsidiary of an American corporation named Alphabet."

Anyone can call themselves anything - that is and has long been part of the web's values. The other one is that, once you get a name, you get to keep that name as long as you want. Dropbox didn't originally have dropbox.com, but they still have getdropbox.com, the name I saw on marketing and on referrals from friends about 10 years ago. I don't care if getdropbox.com was started by some of my college classmates or by people from a small African nation, as long as I can type the letters "getdropbox.com" into my browser, I've successfully bootstrapped trust.

If you personally trust companies because they're from the United States and not from small African nations, you do you, but I see no reason that the web should design itself around your politics, when the web already has a perfectly good system for bootstrapping trust - typeable domain names.

It is perhaps ironic that your primary objection to my line of thinking is that it gates out smaller players and startups, potentially, but then you mention trusting google.com because it's baked into your browser, which of course, gates out everyone but one centralized monopoly deeming itself trustworthy. (Note: I have removed a litany of malicious Chromium-based browser installs from people's PCs in the last year, I am not sure convincing the average user to trust their browser is a good plan.)

And what about https://www.xn--80ak6aa92e.com/? How is the average user supposed to keep up with the latest and greatest ways to pretend to be someone else's URL? I mean, goog1e.com is likely to still be a reasonably effective deception to the average user. Should nobody ever click a link from anywhere, and solely find websites by memorizing the URLs and typing them in?

That's a flaw (specific to the US, where the same name can be registered in different states) but DigiCert (the subject of the article) is proposing remedies to fix it.

As Troy Hunt has been at pains to point out, some of the largest, most important and most spoofed/phished sites on the internet use only DV certs.

Google, Amazon, Facebook, and eBay are all DV. If they don't see value in EV/OV, then who on earth is it meant for?

Like any security/UX thing there are issues all the way down. One of them being that you can't get an EV wildcard (because they want them to be "more secure" in certain respects) and so they're harder to manage - in particular harder to manage in big heterogenous environments.

OTOH: your bank, Apple, GitHub, npm, most fintech companies do.

And yes your bank account is a higher value target than your gmail.

Getting access to someone's personal email account is often sufficient to gain access to everything else they use, including banks and other financial services, at least for long enough to clean out some money.

In some cases - most banks use 2FA, compromising email wouldn't be sufficient to handle that, but a phishing site can do a pass through attack and get both from the user.

But the point still stands: getting access to someone's bank account is far more direct way of getting access to their money than their gmail.

It's all very well that my bank does, but it displays "National Savings and Invest..." which isn't its full name and would also be shown for any number of businesses with the same start to their name.

My mother's bank says "Lloyd's Banking Group PLC" which isn't its name, you'd have to know that it's owned by another group of banks to decode that.

Another of my accounts says "first direct (HSBC Bank plc)". It so happens I know that First Direct is owned by HSBC, but if I didn't shouldn't that further concern me?

This all ends up as extra cognitive load for humans, and it barely contributes to helping with the problem, because this information is only (can only be) displayed after all the backend stuff has finished happening, so it's too late to tell me that wasn't really my bank after I tell them my password...

It's a seperate topic, but yes, there's definitely a need to improve how names map to human understanding. Most people know 'Coke' or 'Coca Coca' than 'The Coca Cola Company' or 'CCA Amatil' or cocacola.com.im. There's discussion (mainly led by DigiCert) now about making EV use trademarks.

Google, Amazon, Facebook and eBay all use OV certs, but you're probably right in that they don't see value in EV.

What percentage of users do you think routinely check for the presence of an EV or OV certificate on the sites they're browsing?

I think it's much, much higher in the aging population.

The only place where the presence of an OV certificate is exposed is in the certificate details dialog -- the same dialog that will typically display arcane technical details like the public key and signature of the certificate. Non-technical users never look at this.