At my work (all B2B SaaS), we have a lot of financial customers that go far down the rabbit hole with us on security and never once have any of them given us grief on DV certs. Most of them also use DV certs. What I don't see much of is LetsEncrypt.
The Power to Revoke Lies with the Certificate Authority
81–89 of 89 posts
Re: The Power to Revoke Lies with the Certificate Authority
#82Earlier quoted context omitted.
I care :-(
Do you? Are you going to stop going to a site because it's missing a EV certificate?
No, but if I'm going to log in it forces me to check to make sure the domain is not something deceptively similar to what I expect, which takes mental energy and is therefore annoying.
Also, unlike apparently everyone else, I care who I'm communicating with, not what their domain is.
Re: The Power to Revoke Lies with the Certificate Authority
#83Earlier quoted context omitted.
I did a contract in a corporate environment where the SSL interception proxy passed-through any site with an EV certificate. I first noticed that it wasn't intercepting my connection to my bank, and then after some experimentation, that turned out to be the pattern. Sounds stupid, but there you go, somebody uses EV as a signal for something.
You made me curious - I work at a company that does that. As it turns out it appears to intercept everything except connections to major high street banks.
I wonder whether they're doing it by IP, DNS, SNI, or certificate. because if it's by SNI or DNS, it's pretty easy to get pass the intercepting proxy.
Re: The Power to Revoke Lies with the Certificate Authority
#84Why don't US EV certs specify the state, if that's important in distinguishing US company names?
Apparently they do [1]; browsers just choose not to show this.
Though I don't know that most people could tell you in which state Stripe is registered, even if they know it's probably Delaware. Heck I think a lot of people could look at the state name, say "hunh, I didn't realize Stripe was a Montana company!", and proceed to be phished.
Re: The Power to Revoke Lies with the Certificate Authority
#85Earlier quoted context omitted.
You made me curious - I work at a company that does that. As it turns out it appears to intercept everything except connections to major high street banks.
I wonder whether they're doing it by IP, DNS, SNI, or certificate. because if it's by SNI or DNS, it's pretty easy to get pass the intercepting proxy.
It's by certificate although the company does run an HTTP proxy for techies that doesn't MITM certs.
These days I can't be bothered to circumvent. If I want to do any sort of sensitive browsing at work (e.g. online banking) I just tether my laptop to my phone.
Re: The Power to Revoke Lies with the Certificate Authority
#86I'm not sure how EV certs have continued to be a thing for so long. Does anybody trust an EV cert more than a DV cert? It's hard enough to get the average person to check for the green padlock before they enter their password, how can we hope to convince anybody to check the company details in the certificate?
Ordinary SSL certificates only require you to have access to domain's DNS records, or to the server where they point to. They only prevent MITM attacks, and you cannot really know who is behind some domain. With the EV certs, you can be assured that it actually belongs to the company it claims to belong. If I see "PayPal, Inc. (US)" in the address bar, I'm sure I'm accessing the correct server. However, I didn't real…
However, I didn't really know that business names are not unique between different US states, but I assume this is not the case for other countries.
Uniqueness of business entity names is something you should never ever assume or rely on.
Re: The Power to Revoke Lies with the Certificate Authority
#87Earlier quoted context omitted.
Oh nice, they've fixed it in every major browser?
The browser vendors disagree about what the rule should be, to avoid homograph attacks, but it's reasonable to say that if you suffer a Unicode homograph attack in your browser, the first people to blame are at the browser vendor. Some feel that the correct approach is to whitelist TLDs that have a responsible homograph rule (so, not .com) and show punycode in all other TLDs. Others want to detect whether a name seem…
Interesting, thanks. Is it difficult to just try to DNS-query for all possible confusing homographs, and display punycode unless all responses are negative? Not sure if that would overload DNS servers too much (maybe limit it to 3 characters and display punicode otherwise to avoid exponential blowup?), but it should be very cacheable.
Re: The Power to Revoke Lies with the Certificate Authority
#88Earlier quoted context omitted.
> Bullshit. no, not bullshit. see the screenshots in this thread and the tweet in the post itself where the two stripe sites are compared side by side. making a "look how useless EV SSL is" site through a phishing example isn't a good strategy for maintaining an EV SSL cert, clearly. he was practically asking them to revoke it, and they gave him what he wanted. > (My site sells legally scraped public data from that B…
>the screenshots in this thread and the tweet in the post itself where the two stripe sites are compared side by side It's not at all clear whether or not the page was ever publicly accessible like that. It certainly doesn't appear that he was distributing the link to the page if/when it looked like that. https://web.archive.org/web/20171211181630/https://stripe.ia... https://crt.sh/?id=393002115&opt=ocsp The site lo…
[deleted]
Re: The Power to Revoke Lies with the Certificate Authority
#89That's whati think