Hacker News Reader

>To be clear, an EV or OV cert would not magically prevent scams. But they would provide cryptographic guarantees that an advocate or law enforcement could trace back to an entity, to prosecute or make you whole. Just like in a real life store.

i don't see how it follows from this that the UI browsers provide for EV certs is bad. you claim that the value is not in inspecting the cert before a transaction, but in the logging of that data. the UI that browsers provide for EV certs allows you to inspect a cert if you really want to, but goes out of its way to avoid any implication that an EV cert is doing anything to prevent you from being scammed. that's a good thing. the browsers are honestly representing the effectiveness of EV certs.

Browsers accurately render the fields of the cert for your current website session in a debugging view; that’s the best I can say. That is technically a “UI” but it does nothing for most users.

Click on the lock in Chrome. It shows you the domain name. There’s no reason it could not read the cert fields and give you the parent org name and where it is registered. As opposed to clicking twice more and pulling those fields out of dozens of technical fields. It doesn’t pull the human info out, for a human to look at easily.

Or take a look through your browser history. Is site metadata logged with each entry? Can you look back at what the browser logged from the cert or network data when you visited a site last month? Is there a nice UI to help you find the problem site and package that info up so you can send it to someone else?

Browsers suck at safety UI in general. Let’s say I do find a phishing site. Where is the button to “report a problem with this site”?

Chrome has a screen to report browser bugs; in Firefox “deceptive site” is the last item in the help submenu. Compare to the prominent “report spam” button in email clients or the report features of social media.

Even if browser providers don’t want to take these complaints, the browser itself knows the domain registrar, DNS provider, and host for every website I visit. Each of those is a company that should have a process to handle abuse complaints. Registrars are required to supply abuse contact info in WHOIS. The browser could give me a nice UI to make use of that info.

How is that materially different than the traditional difficulty in pulling up any official record on a corporation for instance?

If anything, it seems way easier? It also isn’t showing a potentially overly sure view of who the cert is really registered to for everyone.

Could it be made easier? Sure. But most folks aren’t going to be able to usefully process that information anyway. There are a ton of ways of making Whois information look plausibly like it’s owned by a bank when it’s not.

You don’t need the official corporate record to file a complaint, you just need enough info that someone else can look it up. If you get food poisoning, you just tell the city the name and address of the restaurant. They take care of figuring out who is legally responsible.

Of course you don’t have to go to a restaurant; you can buy burritos from a guy in an unmarked van by the river. But we understand that in doing so, we’re taking on more risk than going to a restaurant in a storefront.

That was the idea behind OV and EV certs: give businesses a tool by which they could overtly make themselves more accountable to consequences. Like leasing space and opening a storefront.

> There are a ton of ways of making Whois information look plausibly like it’s owned by a bank when it’s not.

You can’t affect the WHOIS fields where your registrar lists their own contact info, like abuse@godaddy.com, 480-624-2505.

What database/records do you think the cops check when you call in a complaint?

You can call in a complaint about a bogus website to them too, and it’s even easier to figure this out? (From being familiar with those databases)

The issue is that unlike someone with a physical presence in a specific place which makes someone vulnerable to being physically arrested, the internet makes it easy to do something that would otherwise result in that consequence from a place where that consequence is impossible.

And no amount of traditional records and ‘call the cops’ type processes are going to address that. And no amount of extra visible information somewhere in a place that will be overwhelming and ignored is going to fix it either.

Cops are about physical restraint (generally), aka ‘arrest’, which is the only proven ‘lowest common denominator’ way anyone seems to have figured out to ACTUALLY stop someone from doing something. You take them physically, put them in a cell where they can’t access anything but the things you hope they can’t abuse, and hold them until another resolution is figured out or you have to release them anyway.

To avoid problems like a random cop in rural Arkansas from going to Washington and arresting the president, the area different police are able to do this in is restricted, various rules and laws, etc. further restrict when, where, and how they can do it, etc.

Fundamentally that means most cops are helpless in this scenario unless said bogus website scammer is dumb enough to scam people in his same town/city/state/whatever.

And unless everyone takes a ‘scam unless proven innocent’ approach which pretty fundamentally breaks the internet’s usefulness, CA signing and the like doesn’t really solve any of that problem, no matter how accurate the information is.

So what is the solution then?

On the one hand, we're supposed to trust no one on the web, on the other hand the web is only useful if we're effectively trusting everyone (except the most obvious scammers).

So how do you verify trust on the web?

Right now we have no solution, we’re relying on ‘mostly works’ real world stuff to stop the biggest scams, and lots of small scammers are running around scamming lots of people and not being punished for it.

If someone does a big enough scam on a big enough target (like a crypto ransom on a major oil pipeline), they’ll get the attention of someone who can ‘bend the rules’ enough to make their life hell and get you anyway, no matter where you are. But that doesn’t stop them from ruining a ton of people who aren’t that noticeable. Because those people aren’t noticeable, it’s also a lot of value that can be extracted that way, which makes the problem worse.

Most people currently consider it working well enough to be better than the alternatives based on overall numbers.

however as the scam economy develops, which it has been doing, something is going to break.

it’s not going to go in the direction of random police officer in Vietnam, Nigeria, or Russia arresting his buddy (no matter how solid the evidence looks) because someone in the US wants it to happen.

Think what happened with email and spam in the late 90’s - up until that point, spam filtering was a niche thing only nerds did. Then it got to the point email was useless without it, and thankfully for email, spam filtering worked and the providers provided it.

Phones, phone providers haven’t been interested in, so except for some business cases almost no one uses phones directly any more (it’s texts or everything to voicemail first or whatever).

So no idea how this is going to go - curated marketplaces for anyone online? Federal/EU Gov’t certs to do business online? ‘Great firewalls’ to keep the scammers out/limit traffic to where it can be policed? Consumers bailing on online purchases except for specific already known and ‘trusted’ names?

>so what's the solution then?

this is not a solved problem - that's the whole point. there is no general way to verify trust on the web. We can verify trust in certain connections or transactions, but it's not possible to trust "the web". and until the problem is solved, anybody trying to sell a way to do that is selling snake oil.

Ok, but then why actively block attempts to tackle this problem?

Yes, there are edge cases in which EV certs can be confusing, but in general they give a guarantee that you're dealing with a registered company from a country with generally respected business standards. That's a lot better than the current state where the site might as well be served from a raspberry pi in some teenager's basement.

If the company's name is not sufficient to identify them, put an address in there, too, or registration number or whatever. I don't get what's so hard about this.

And as for "people are ignoring them", I'm sorry, but this is largely the browser vendors' fault. For a long time, people were ignoring cert errors as well. Browser vendors reacted with a massive UI revamp up to intentional dark patterns to change behaviour here - and it worked.

Meanwhile, with EV certs, UX went into the exact opposite direction: Browsers were increasingly de-emphasizing the EV data, to the point that people are actively discouraged from looking it up. No wonder then that no one checks EV information.

>in general they give a guarantee

"in general, except for the edge cases" is the opposite of a guarantee. they create a situation where users assume a level of trust that can't be actually guaranteed, which is exactly what fraudsters exploit.

browsers aren't actively blocking attempts to tackle this problem. browsers are blocking schemes which falsely claim to tackle the problem.

I think you're broadly right; I would agree the article comes for DigiCert when it should come for browsers, and this pretty embarrassing for the web.

And I think you're right about EV? Ignoring gross CAs trying to juice the web, it makes sense to try to link the web's web of trust to our... non-web web of trust. The web is still pretty new, it's still pretty unfamiliar, and a lot of the signals we use to suss out a fraudulent physical shop don't really apply to the web.

I would counterargue, though, that you're really mythologizing physical stores. I think tons of fraud and abuse happen in physical stores, up and down the stack. The "paper trail" is like 45 minutes on LegalZoom. I think it's worth separating things like banks and bank websites from like, illegal casinos and gambling websites (crypto exchanges are what I mean here).

When you kind of pick away at the "physical stores have no fraud" pillar, then I think the web's security/trust model actually holds up. I don't simply rely on TLS to tell me that bankofamerica.com is legit, and I don't think anyone does, which is good because it doesn't! I also have totally different behavior when I'm doing online banking than when I'm [insert risky/shady thing here], because the threat model is different.

And there's where I think we hit a crossroads, because that "risky/shady" thing for everyone is "getting an email that looks like it's from your bank". This is an attack that doesn't really have an analogue in meatspace, but it's super effective because again, we don't have all the signals we normally do. If it were meatspace, I'd notice this wasn't my usual branch and then probably notice some other differences that might give me pause, but the web makes it possible to create a very convincing copy.

So, I think you're right in the large and I super agree. I just think that phishing is very bad and you shouldn't say you solved it when you in fact haven't solved anything. That's (almost certainly) browsers' fault, but that's a little irrelevant imo.

> This is an attack that doesn't really have an analogue in meatspace

Here's a potential analogue - sometimes people stand in parking lots and collect fees, claiming to be representatives of the lot's owner, but in reality pocketing the money.

Some lots counter this by posting signs along the lines of "do not pay any attendant; pay only via kiosk/online". But since some lots do in fact collect payment via attendants, a potential way to secure this would be for the attendant to present proof that they are employed by a certain company. While the customer might not be able to verify that "ABC Parking, Inc." is in fact the owner of the lot, at least they would have a trail to follow if they were scammed.

This is an area where cyberspace has an advantage - the closest analogue to an EV certificate in the physical world would be a piece of paper with some official seal on it, which can still be forged in a way not easily detectable by the average person.

Oooh, good example yeah. I recently saw a short list of grift/scam taxonomy; I wonder if there's a similar list for stuff like this.

Well, people do still pretend to be representatives, and do still scam people successfully.

The underlying issue internet wise is unlike the scam you’re referring to, the people can be in another random jurisdiction and impossible to even arrest and still succeed at doing it online. In fact, in many cases it’s even economically preferable to do so (regardless of potential punishment) due to lower costs of living.

So you aren’t dealing with 5 lots in SF the owner is trying to avoid the problem on (and for which at least in theory someone could be caught and prosecuted by looking at a camera or walking there), you’re dealing with potentially every lot everywhere all at once, and that it is in theory scammable by people anywhere. And that there is no lot the owner can walk over to and see if it’s happening easily.

> And most techies went along with it because they shared the vested interest, or did not appreciate the existing system that creates the real life shopping experience we see every day.

I don't agree. I think a lot of tech people (like me) felt like the whole system was a grift and that nothing of value was lost when LE offered an alternative. If you start a business in my jurisdiction your paperwork is going to get a lot more scrutiny than what the certificate authorities were (or are) providing.

Have you done it in your jurisdiction? Here in CA you can form an LLC or Corp without even providing your ID or doing a notarized anything. You do have to provide a real physical address at least (no pmb forwarders or Poboxes - kinda). Delaware I know is the same.

I'm fairly sure you need to provide ID and notarized docs where I am, but I've never done anything more than a sole proprietorship since we're allowed to conduct business under our personal name up to a certain point.