Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Power to Revoke Lies with the Certificate Authority

scotthelme.co.uk

Post reply on HN
Print view View original

41–50 of 89 posts

Re: The Power to Revoke Lies with the Certificate Authority

#41

Post by felipelemos »

ryanlol wrote: post #35
tribby wrote: post #5

Earlier quoted context omitted.

right. and he passed the checks because his perfectly legitimate company is also called stripe inc and is also in the US, just in a different state. now stripe could take this up with the courts about how ian is confusing consumers and so forth, and they would win. but they didn't - they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not…

>they went straight to the CAs, and the CAs folded on an arbitrary rather than legal decision, which is a little concerning, but also not too concerning. the CAs were probably were just alerted to the fact that ian was running a website in an obvious bid to confuse people, and decided to revoke his cert. and honestly I think that's a fine, reasonable response to what ian did -- Bullshit. It is utterly insane to accus…

> It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" [...]

And what about this? https://stripe.ian.sh/firefox.png

Re: The Power to Revoke Lies with the Certificate Authority

#42

Post by Promarged »

dingo_bat wrote: post #36

I don't see the problem. If it was really a phishing site, law enforcement now has the legal address of your registered company and whatever metadata they collect as part of incorporation. I'd say EV worked perfectly.

> I'd say EV worked perfectly.

Ian run a legit site, not phishing, so what's perfect in revoking his EV cert and not giving back cash?

Re: The Power to Revoke Lies with the Certificate Authority

#44

Post by bartread »

cm2187 wrote: post #21

On EV certs, Troy Hunt rightly pointed that no one really cares about them and many major websites (amazon, youtube, facebook) don't even bother: https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...

Well that certainly makes me feel a lot better about cheaping out on non-EV certs. Thanks for sharing.

Re: The Power to Revoke Lies with the Certificate Authority

#45

Post by dingo_bat »

Promarged wrote: post #42
dingo_bat wrote: post #36

I don't see the problem. If it was really a phishing site, law enforcement now has the legal address of your registered company and whatever metadata they collect as part of incorporation. I'd say EV worked perfectly.

> I'd say EV worked perfectly. Ian run a legit site, not phishing, so what's perfect in revoking his EV cert and not giving back cash?

> Ian run a legit site, not phishing

He originally had a site that looked extremely similar to stripe's official website: https://news.ycombinator.com/item?id=16939094

Re: The Power to Revoke Lies with the Certificate Authority

#47

Post by tialaramex »

icebraining wrote: post #37
jgtrosh wrote: post #30

Earlier quoted context omitted.

At least it could allow automating retrieving public information of the actual entity by whatever system checks the certification. Now, how to interact with the user to improve cognisance of the entity considered based on the newly available data is another problem.

The certificate itself already automates the retrieval of public information. For example, Paypal's cert includes its full address, which has been verified by the CA: PayPal, Inc. # Street: 2211 N 1st St # Locality: San Jose # State: California # Postal Code: 95131-2021 # Registered: Delaware, US And we could include other information if we needed.

Indeed for organisations that have one, the serial number field for the Subject (not to be confused with the serial number of the _certificate_) will be a unique number in some register of companies. In the UK you can mechanically turn those into a URL that gives you the (meagre) Companies House listing, there's no reason the same couldn't be true in the US.

For PayPal this number is 3014267 and it'll be their registration number with the state of Delaware.

The EV rules require a CA to figure out if there is such a number and if so fill it in on the certificate. If there is no number, they're supposed to write something else (a registration date maybe? I don't remember)

(Sometimes a country has some companies that are so crazy old they pre-date the idea of registering companies, or turn out not to exist in their company register because the country created them by passing a law instead of formally registering them, or whatever, and these don't have serial numbers, e.g. I wouldn't be surprised if the Bank of England has no registered company number)

Re: The Power to Revoke Lies with the Certificate Authority

#48

Post by tialaramex »

mehrdadn wrote: post #31
PeterisP wrote: post #28

Earlier quoted context omitted.

IDN homograph attack should not be an issue in your address bar - unicode letter trickery e.g. pаypal.com with a cyrillic а should be shown as xn--pypal-4ve.com ; it's something that can be solved and is being solved on the UI level.

Oh nice, they've fixed it in every major browser?

The browser vendors disagree about what the rule should be, to avoid homograph attacks, but it's reasonable to say that if you suffer a Unicode homograph attack in your browser, the first people to blame are at the browser vendor.

Some feel that the correct approach is to whitelist TLDs that have a responsible homograph rule (so, not .com) and show punycode in all other TLDs. Others want to detect whether a name seems "confusing" by some heuristic and show the punycode instead only in that case.

Re: The Power to Revoke Lies with the Certificate Authority

#49

Post by EVCAca »

I agree with the fundamental conclusion that, due to changes in the Internet, CAs are quickly becoming arbiters of what content is valid or not in the public's eyes -- a job they aren't ready for and never asked for. The article linked goes about discussing this issue in a hyperbolic manner and it commits a few critical thinking mistakes despite arriving at a valid conclusion.

Briefly, I'm going to focus on just one of these. I leave it to the reader to spot the others.

Ian Carroll got an Extended Validation (EV) for Stripe in another state to prove that EVs are forge-able. That is, although he followed the guidelines, he believed those guidelines weren't enough to safeguard an EV.

Then when the Certificate Authority (CA) finds out about this and revokes his deliberately misleading EV, Scott Helme writes the article linked accusing and detailing how CAs have too much power, because they can revoke an EV based on arbitrary decisions. He defines arbitrary decisions as "not following the guidelines".

To summarize: Ian Carroll abuses the guidelines to register a deceptive EV to prove that the guidelines aren't enough. Then Scott Helme accuses the CA of not following its own guidelines and of taking an arbitrary decision to revoke Carroll's abusive certificate.

They just can't win.

Re: The Power to Revoke Lies with the Certificate Authority

#50

Post by kuschku »

PeterisP wrote: post #28
mehrdadn wrote: post #13

Earlier quoted context omitted.

Looks at the domain can be deceiving because of IDN homograph attacks.

IDN homograph attack should not be an issue in your address bar - unicode letter trickery e.g. pаypal.com with a cyrillic а should be shown as xn--pypal-4ve.com ; it's something that can be solved and is being solved on the UI level.

IDN is not that simple. Sometimes you want punycode (flüge.de) sometimes you don't (xn--pypal-4ve.com).

It's not like you can just disable punycode for all sites, because now you just create a new phishing risk for those sites that used it (xn--pypal-something and xn-flge-something look close enough)

Post reply on HN