Ian Carroll

> [1]HTTPS encryption itself doesn't meaningfully require public key infrastructure, it's just that without PKI, you don't know who sent the encrypted traffic. Since domains are terrible "identities" and it's common for large organizations to use many of them that sound similar to scam domains, domain validation really doesn't tell anyone anything about whether or not they're talking to a trustworthy entity. It is trivial to get an EV cert for a company that has the same name as a trustworthy entity[0]. There is nothing in the design of EV that prevents this, and name collisions between corporate entities are common and acceptable practice[1]. [0] https://stripe.ian.sh/ [1] Trademarks are a different matter, but getting an EV cert for a company that has the same incorporated name as a different company in a different state is completely legal.

Well, the CA system for HTTPS is a false sense of Identity protection. Is great for encryption. 0: https://stripe.ian.sh/

I disagree that what Safari is doing is good for the user. Safari used to show https://stripe.ian.sh/ as "Stripe, Inc". By hiding the URL, it significantly increased the phishing potential of the website. Feel free to visit the above false stripe site, its not malicious and has a great write up in the issue. In this case they are putting a lot of blame on EV Certificates - which I agree causes more harm then good - but Safari's decision to cover up the URL made the issue significantly worse.

EV certificates are nothing other than a way for the CAs to make money now that people have realized that the CAs' core product is worth approximately $0. Argument 1: this person was able to get an EV cert for "Stripe, Inc. [US]", an entity they registered in Kentucky, no relation to the Stripe, Inc. of California whose website is stripe.com. They were not able to get a certificate for stripe.com. (The CA revoked it, and then later apologized for revoking it because there was no reason by their policy to do so.) https://stripe.ian.sh/ Argument 2: the actual website for MasterCard's SecureCode is https://www.mycardsecure.com/ , whose EV cert is "Arcot Systems LLC [US]". The fact that it has a meaningless domain name is in no way fixed by it having a meaningless (but technically accurate, Arcot is the contractor for SecureCode) EV cert. How do you know you're actually supposed to type your personal information there? Argument 3: the web's security model is based on origins (domain names), not on EV certs. If Stripe switches tomorrow to stripeiscool.com and a domain squatter gets stripe.com, my browser will still send cookies to stripe.com, even though it no longer has an EV cert, and it certainly won't send cookies to stripeiscool.com, even if it has an EV cert with the same organization. Even if EV were a good idea in the abstract, it lacks a plan to make it work with the web as actually deployed.

With EV the checks basically care about: 1. Does this entity exist, e.g. it's in an official government business directory and the address details match what was specified 2. Use a third party directory (e.g. Dunn & Bradstreet) to look up this entity, and phone them. Ask to talk to some specific role at the company e.g. "Head of the IT department" and then confirm the details with that person. This involves actual humans, albeit basically call centre employees, looking at paperwork, making telephone calls, that sort of thing. I guess you could label it "best effort" but to me that signifies much less. For Americans a surprise problem with EV is that your country doesn't _have_ a central business directory. Each State runs its own directory, most businesses are registered in Delaware, regardless of their actual home state. https://stripe.ian.sh/ has a completely genuine Stripe, Inc. EV certificate, issued to a Stripe, Inc. just not the one that's famous.

That researcher was Ian Carroll, who created a new "Stripe, Inc" company in Kentucky, a clone of the one registered in Delaware, and was therefore able to get an EV certificate issued for his new company that looked very similar to one issued for the Delaware company. His original research site appears to no longer be online (https://stripe.ian.sh/), but you can read more about it in these articles: https://www.bleepingcomputer.com/news/security/extended-validation-ev-… https://arstechnica.com/information-technology/2017/12/nope-this-isnt-…

Not really. "Legal Entity" doesn't mean much, it's cheap to register a company and the name doesn't have to be unique. One guy registered a company called "Stripe" and got an EV cert for his site.[1] Modern web browsers don't show anything different for EV certs (try it). They stopped last year, mostly because EV certs were ineffective. [1] https://stripe.ian.sh/

I don't have any solutions to your last statement, but one of the problem is that legal name of the entity matching doesn't really mean its the same entiy you think it is - the example ( also in the original page): https://stripe.ian.sh/

Which worked really well with https://stripe.ian.sh/ Granted, they revoked his cert after he published, but it goes to show how easy it would be to fake an EV cert and have safari users have no idea.

> https://stripe.ian.sh/ is a prime example of this. It used to be. All his EV certs were revoked.

Browsers are moving away from showing differences between EV and DV certs nowadays though. And anyone can register a company name and get an EV cert - that doesn't make it trusted. https://stripe.ian.sh/ is a prime example of this. HTTPS is a nice reassurance, sure, but an EV cert isn't.

Isn't that the OP's point? What if no accredited .com registrar wants to serve them for fear of being criticized in the media? Gab would be SOL and lose the ability to meaningfully exist on the internet. Why are private companies the gatekeepers to being able to express yourself online, all of a sudden? Domain registration that is immune to knee-jerk responses like GoDaddy's would be nice. I am reminded of the time that GoDaddy revoked that "fake" Stripe EV cert (https://stripe.ian.sh/) because of media reporting, even though it was acceptable under the CABF EV guidelines. In other words, arbitrary.

>seeing the EV certificate gives my more confidence that I did not make a typo in the URL not really. there's nothing preventing an attacker from creating a legal entity with the same name and legitimately getting a EV certificate. https://stripe.ian.sh/

Took this guy $177 to register a Delaware corporation called Stripe Inc and get Comodo to issue him an EV certificate that looks exactly like the real payment gateway. After Comodo revoked his cert, GoDaddy gave him one. https://stripe.ian.sh/ EV certificates tell you that a site is owned by a company with a particular name, not that it is the company you actually want. There's a reason browser vendors are de-emphasising EV: it isn't very useful.

Given someone could register Stripe, Inc. in a different US state than where Stripe, Inc. is incorporated: https://stripe.ian.sh/ I would suggest... arguably, yes? Presumably within the realm of NZ, Neighbourly could go after Google for trademark infringement of some sort, if Google launches it in NZ, but from a global standpoint, what authority does anyone have to protect their name worldwide?

By "site", are you referring to the actual site, or the EV indicator? Because the site itself doesn't look anything like Stripe's[1]. [1]: https://stripe.ian.sh/

Or put another way, don't notice the absence of "The Royal Bank of Scotland Group Plc [GB]". Or don't notice if it's been changed to "RBSG [GB]" or "Royal Bank [GB]". Then there's this: https://stripe.ian.sh/

And if you aren't familiar with the details of how web browsers work (eg most people who use them), you would have no idea something was wrong. Not to mention potential problems such as http://stripe.ian.sh

If you click through to the page the article is referring to, his description of the problem is far better than Ars' summary[0], and he basically says some of the things you said. He is however more pessimistic: > There will undoubtedly be many proposed solutions to this issue. Ultimately, though, any method that ends up giving users a legal entity is fatally flawed. As a result of how extended validation certificates work, browsers have few options to fix this. Having said that, they can take steps to ensure EV certificates do not override other critical parts of the user interface, like Safari does. [0] Edit: Actually, on this note, might I suggest the HN link be changed to point to https://stripe.ian.sh/

Check it out here: https://stripe.ian.sh/ - it has an EV cert that makes the browser show "Stripe, Inc" next to the padlock.

This should just link to the site: https://stripe.ian.sh/ The Ars Technica link is just blogspam.

Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/). Do you even read links? https://arstechnica.com/information-technology/2017/12/nope-this-isnt-… EV certs are an expensive boondoggle that add little-to-no value over DV certs. It's why all browser makers (not just Google) dropped any special rendering for them. The real value is pervasive TLS. Phishing and website impersonation should be tackled with a variety of practises, and EV certs don't really come into it. Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Your browser history should have it. You can bookmark it. If you've clicked a phishing link and you're on wellsfargo.com.badguy.com instead of wellsfargo.com, don't you find it odd you can't auto-fill your user/password any more? Maybe you're on the wrong site? Oh yes, there on the URL bar is "wellsfargo.com.badguy.com", I see it now. Can you imagine if we still had that awful special rendering for EV certs, and the wellsfargo.com.badguy.com owners incorporated "Wells Fargo" in Timbuktu and bought an EV cert for their legitimate business, and the entire URL bar was covered up with " Wells Fargo"... lol

You're right in that a working EV system can indeed protect people. However, as this article suggests, even a basic check can be very hard for CAs to implement. If you can't even do a spell check on the state or country name, can you be trusted to verify the identity of those who rely on you to meticulously verify a company? There's also the point https://stripe.ian.sh/ made: it's not just about registering the same name in a different state. People don't know in what state your (parent company) headquarters are so they would need to dig deep into the organisational structure to find out if the EV cert they're presented with isn't from a company with the same name in another state. Want to add more years of registration? Just buy an old, probably no longer used letterbox company and change the legal name. Whois info can be set to anything you want for most domain registrars as well. People will still need to find out if all the data matches. There's also this demonstration of how EV can actually be used to help phishing by using the "green address bar" and the hilariously stupid Apple address bar design: https://www.typewritten.net/writer/ev-phishing/ I believe there is value in EV certificates if you can rely on the identity verification that they come with. Sadly, most providers of EV certificates seem to view them as a way to make more money, not as a tool to bring trust to the web. An EV-like system will probably be reinvented in the future, giving us a fresh start…

EV certs can be spoofed too: https://stripe.ian.sh/

EV doesn't solve that problem though https://stripe.ian.sh

> It is utterly insane to accuse him of running this page in an "obvious bid to confuse people" [...] And what about this? https://stripe.ian.sh/firefox.png