Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Power to Revoke Lies with the Certificate Authority

scotthelme.co.uk

Post reply on HN
Print view View original

61–70 of 89 posts

Re: The Power to Revoke Lies with the Certificate Authority

#61

Post by icebraining »

solatic wrote: post #56
icebraining wrote: post #24

Earlier quoted context omitted.

But how would that help? Both Stripes would have a valid first class identity with valid keys. How are clients supposed to then check?

In the current system, the client must query the CA that issued the EV cert for the legal entity data. This presents a number of problems: a) not all CAs will present enough distinguishing data to the client. Case in point: "Stripe Inc. [US]" b) No consensus between CAs as to who will issue a cert for a given legal entity. In other words, there is such a thing as a CAA record for DNS and DV certs, but no such thing f…

(a) Actually, the CA sends Stripe's actual business registration number in Delaware (4675506). It's the browser who chooses what to present.

(b) Why is this a problem?

(c) Is there any evidence of demand for those usecases? How would you even present them to the users in an understandable way?

"Certificate Authorities are not in the business of establishing identity and so they are fundamentally doomed to doing a poor job of verifying identity."

I don't see how that follows. In fact, I don't see how that's even possible. Whenever you do business with any entity besides the national registry - be it a bank, insurance company, notaries, or even another governmental department - they have to verify your identity. CAs just happens to give you a digital affidavit of the results.

Instead of trying to coerce CAs into the identity business because of the inflexible and glacial pace at which government moves, we should be pressuring government to adopt more modern identification practices.

I disagree; we already have problems with too-big-to-fail CAs; governments are even worse. A CA can be told "follow the CAB Forum rules or get kicked out". But you can't distrust a government when they're the only issuer for the sites of the whole country.

Low-coupling is not just good in software development.

Re: The Power to Revoke Lies with the Certificate Authority

#62

Post by waterbomb0 »

notatoad wrote: post #12

I'm not sure how EV certs have continued to be a thing for so long. Does anybody trust an EV cert more than a DV cert? It's hard enough to get the average person to check for the green padlock before they enter their password, how can we hope to convince anybody to check the company details in the certificate?

Ordinary SSL certificates only require you to have access to domain's DNS records, or to the server where they point to. They only prevent MITM attacks, and you cannot really know who is behind some domain.

With the EV certs, you can be assured that it actually belongs to the company it claims to belong. If I see "PayPal, Inc. (US)" in the address bar, I'm sure I'm accessing the correct server. However, I didn't really know that business names are not unique between different US states, but I assume this is not the case for other countries.

The issue with EV certs is how they are presented in the browser, since they are indistinguishable to the ordinary certs, at least to the majority of the users.

Re: The Power to Revoke Lies with the Certificate Authority

#63

Post by crdoconnor »

regecks wrote: post #14
notatoad wrote: post #12

I'm not sure how EV certs have continued to be a thing for so long. Does anybody trust an EV cert more than a DV cert? It's hard enough to get the average person to check for the green padlock before they enter their password, how can we hope to convince anybody to check the company details in the certificate?

I did a contract in a corporate environment where the SSL interception proxy passed-through any site with an EV certificate. I first noticed that it wasn't intercepting my connection to my bank, and then after some experimentation, that turned out to be the pattern. Sounds stupid, but there you go, somebody uses EV as a signal for something.

You made me curious - I work at a company that does that.

As it turns out it appears to intercept everything except connections to major high street banks.

Re: The Power to Revoke Lies with the Certificate Authority

#64

Post by Scott_Helme_ »

MichaelGG wrote: post #54
EVCAca wrote: post #49

I agree with the fundamental conclusion that, due to changes in the Internet, CAs are quickly becoming arbiters of what content is valid or not in the public's eyes -- a job they aren't ready for and never asked for. The article linked goes about discussing this issue in a hyperbolic manner and it commits a few critical thinking mistakes despite arriving at a valid conclusion. Briefly, I'm going to focus on just one…

Your argument hinges on your word "abuse". Except there's no abuse. Nothing stops Ian from conducting business legally with that company name. If CAs have a problem, they need to fix the cert system. What should those guidelines look like? "You need to have a legal entity, but not one that conflicts with any big brand names people might know, even if you're legally entitled to conduct business under that name"? There…

This is kind of the point really isn't it. There was no forgery or abuse here, the certificate was issued in full accordance to the rules set out in the CA/Browser Forum Baseline Requirements and the EV SSL Guidelines.

If there were any abuse or forgery taking place here the certificate would have been revoked for those reasons and the CA would be held to account for mis-issuing a certificate. That's not what happened.

Given the name of the account that made the comment I'm curious about the affiliation of the author, perhaps they would share that in the interest of transparency?

Re: The Power to Revoke Lies with the Certificate Authority

#66

Post by Scott_Helme_ »

dingo_bat wrote: post #45
Promarged wrote: post #42

Earlier quoted context omitted.

> I'd say EV worked perfectly. Ian run a legit site, not phishing, so what's perfect in revoking his EV cert and not giving back cash?

> Ian run a legit site, not phishing He originally had a site that looked extremely similar to stripe's official website: https://news.ycombinator.com/item?id=16939094

I can't find any copies of that in any cache showing it was ever actually online, simply mocked-up photos posted to social media.

Re: The Power to Revoke Lies with the Certificate Authority

#67

Post by Scott_Helme_ »

peoplewindow wrote: post #25

There are several points in this post but the bulk of it is, I feel, one of those classic fallacies that journalists or security hobbyists often engage in: "I found what looks like a flaw in a system but I didn't try to exploit it for real, look how clever I am" So his mate registered a company with the same name as another company and got an EV cert. Well done. Everyone knew that was possible already, at least every…

Phishing using EV, documented in 2011: https://news.netcraft.com/archives/2011/12/30/phishing-sites...

Re: The Power to Revoke Lies with the Certificate Authority

#69

Post by peterwwillis »

The only thing you need to know about EV is this: If an attacker puts up a MITM site with a valid DV cert, your browser will be like, cool, let's use this less-verified cert instead, because a CA signed it, even though the last time I visited it was an EV cert. Your browser doesn't care, users don't care, it doesn't actually improve security.
Post reply on HN