31–40 of 89 posts
Earlier quoted context omitted.
Looks at the domain can be deceiving because of IDN homograph attacks.
IDN homograph attack should not be an issue in your address bar - unicode letter trickery e.g. pаypal.com with a cyrillic а should be shown as xn--pypal-4ve.com ; it's something that can be solved and is being solved on the UI level.
Here in the UK there is another problem with EV certs, there is no way of registering a "trading name" or "doing business as (DBA) name" against a company so you can only have an EV cert issues against your actual registered business name. If that is different from your trading name and what you use as your domain name then they are less than worthless. For example, if the company is "Widgets of London Limited" but t…
Seems like you can, by registering a DUNS number, e.g. "Trade and DBA names are verified directly with registration agency or through a verified third party database such as D&B, Bloomberg, or Hoovers." ( https://support.comodo.com/index.php?/Knowledgebase/Article/... )
Visit https://certsimple.com from the UK and you'll even see the UI change to remove the DBA option.
Trademarks aren't the same thing as DBAs, but a number of folks would like to get the EV guidelines extended to include trademarks.
Here in the UK there is another problem with EV certs, there is no way of registering a "trading name" or "doing business as (DBA) name" against a company so you can only have an EV cert issues against your actual registered business name. If that is different from your trading name and what you use as your domain name then they are less than worthless. For example, if the company is "Widgets of London Limited" but t…
Earlier quoted context omitted.
right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe could take this up with the courts about how ian is confusing consumers and so forth, and they would win. but they didn't - they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not…
they went straight to the CAs Is there any evidence that Stripe had anything to do with this?
Earlier quoted context omitted.
Yeah but I thought EV certificates involved phone calls, manual checks of the website, some basic security compliance... All the kind of manual paperwork & background checks that the standard certificate would not do.
right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe could take this up with the courts about how ian is confusing consumers and so forth, and they would win. but they didn't - they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not…
Bullshit.
It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" https://web.archive.org/web/20171211181630/https://stripe.ia...
It is also utterly ridiculous to describe this as "helping protect people from fraud". There was no fraud.
>there's no reason to be worried about having your legitimate cert revoked because of things like this, just like there's no reason to be worried about having your legitimate website kicked off cloudflare because of daily stormer
FWIW I've had my website kicked off Cloudflare and countless of domain names suspended because a SF BigCo hired an very big international law firm to keep my site offline at any cost.
I wouldn't put it past them to try and get certificates revoked too, but they tend to be able to put out enough pressure to get the domain names suspended pretty fast.
(My site sells legally scraped public data from that BigCo's website, instead of suing me they prefer to just keep my site offline)
Earlier quoted context omitted.
But how would that help? Both Stripes would have a valid first class identity with valid keys. How are clients supposed to then check?
At least it could allow automating retrieving public information of the actual entity by whatever system checks the certification. Now, how to interact with the user to improve cognisance of the entity considered based on the newly available data is another problem.
PayPal, Inc. # Street: 2211 N 1st St # Locality: San Jose # State: California # Postal Code: 95131-2021 # Registered: Delaware, US
And we could include other information if we needed.
Earlier quoted context omitted.
IDN homograph attack should not be an issue in your address bar - unicode letter trickery e.g. pаypal.com with a cyrillic а should be shown as xn--pypal-4ve.com ; it's something that can be solved and is being solved on the UI level.
Oh nice, they've fixed it in every major browser?
Earlier quoted context omitted.
right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe could take this up with the courts about how ian is confusing consumers and so forth, and they would win. but they didn't - they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not…
>they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- Bullshit. It is utterly insane to accus…
Scroll down a bit on that page, and you'll see this image: https://web.archive.org/web/20171211213402im_/https://stripe...
Maybe that page was updated later in the day, but before the Web Archive captured it.
Earlier quoted context omitted.
>they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- Bullshit. It is utterly insane to accus…
It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" Scroll down a bit on that page, and you'll see this image: https://web.archive.org/web/20171211213402im_/https://stripe... Maybe that page was updated later in the day, but before the Web Archive captured it.
https://crt.sh/?id=393002115&opt=ocsp
Just compare the revocation date and the archive.org date. At best they revoked the cert after it had been used to serve a completely different site for many months.
