Extended Validation is Broken (opens in new tab)

Check it out here: https://stripe.ian.sh/ - it has an EV cert that makes the browser show "Stripe, Inc" next to the padlock.

Simple. Don't use Safari or any browser that makes the users dumb by making it "friendly" to make them vulnerable to things like this. It's not that EV is broken - it's the bad UX decisions and the mentality behind it.

This is scary, especially safari displaying only the name of the company and not the domain name.

I don't see how we could provide a totally safe network of sites (where you can trust the identity of every site you're visiting), without having a "safe internet" where all the sites are known in advance and you can't leave this walled internet. But I really don't like the idea.

Maybe something like keybase could help, where sites could link their identity to social network accounts (twitter, Facebook, GitHub) or other websites.. and the browser would verify those connections (but it still faces a UI challenge)

The OP was originally pointing to ArsTechnica.

One of the top comments there suggested that the solution lies in relying on DNS which provides "globally unique" names.

But the commercial CA system already relies on domainnames. That is its weakpoint.

The author at ian.sh shows how additional checks by third party CAs, e.g., business registration, do not necessarily solve the problem either.

The best proposals I have seen for solving the problem are ones that have no reliance on third parties, e.g. certificate vendors, domainname vendors, etc. Another way to think of non-reliance on third parties is "middlemen". If they are necessary, then the system is vulnerable.

It is a very old problem that apparently has never been fixed. Today solutions that try to avoid middlemen do exist. But comprehension of why this is necessary is apparently still small-scale because focus remains on the commercial CA business, which seems to be at odds with any system that needs no such middlemen.

This author, who many HN readers know, explains it much better than I can: http://sprunge.us/NHTK

Users or businesses can create and exchange their own public keys directly. (Think of HTTPS like SSH.) They do not have to rely on third parties to assist them.

One does not need a third party CA to perform effective encryption. Have you ever wondered if browser warnings are an insidious way to keep commercial CAs in business?

Public keys are globally unique. Names are not. One could combine them (e.g. key fingerprint plus name) to form an identifier that is better than a name alone.

Recap:

Names alone are not enough to perform effective disambiguation via ICANN DNS or major-browser sponsored CA system. Volunteer-supported Wikipedia actually does a better job of disambiguating names than these commercial services.

Public keys can be generated directly by the named entity they represent instead of by third parties. Middlemen are unnecessary and cause the system to be vulnerable.

I think the only solution to fixing this is for Safari to show the domain again. It is the URL that is unique and known by the visitor, not the business name.

Here in the UK there is another problem with EV certs, there is no way of registering a "trading name" or "doing business as (DBA) name" against a company so you can only have an EV cert issues against your actual registered business name. If that is different from your trading name and what you use as your domain name then they are less than worthless. For example, if the company is "Widgets of London Limited" but trade online as "Widgets Online" with the domain "widgetsonline.com" they cant get an EV cert with "Widgets Online" as the name - even if they own the registered trademark of it.

See https://certsimple.com/help/doing-business-as-or-trading-nam...

Maybe another solution to this is not to show just business name directly, force it to show the domain as well unless there is a registered trademark that is proven to be owned by the organisation and only then go the safari route of showing a shortened name?

Of course EV is broken -- of more like, people's mental model of the benefits that EV confers is broken. As noted in the article, an EV cert asserts that the domain name is controlled by a legal entity in some jurisdiction. This is a very distinct notion from the site that you've arrived at being the site that you were intending to visit, but people use it as a terrible, flawed proxy for such.

On the topic of certs, last year, when Google announced they were now a root CA [1], I remarked that this made a lot of sense, because "who better to say that Google is indeed Google than Google itself?" [2]

I went on to write that not everyone runs a root CA because coordination of trust between various parties is difficult, and so are the mechanics and practices of running a CA, but if your browser (and/or OS) is the final gatekeeper of the trust anyway, why not just push trust towards the edges and out of the middle? Certainly, the most-visited websites could easily be in this boat.

As it stands today, the most-visited websites already don't use EV, because DV certs are good enough for their needs. People trust their website by fiat, simply by mental associations about their domain names, an imperfect process that makes plausibly-looking domain names such an effective tool for phishing. But users already fall for phishing conducted from ridiculous domain names too, so there's not much point.

[1] https://pki.goog/ [2] https://news.ycombinator.com/item?id=13495262

So much for browsers that don't show the full URL. I think the dumbing down of such things has gone way too far and if a browser vendor believes that URLs are now something that can be safely abstracted away then that's not a browser that I would ever use.

Forming a company duplicating a big name in another jurisdiction is a problem. It's a clear trademark violation and may be prosecutable as fraud. At least you know who to sue.

Ran this one through SiteTruth. It does display that the company is in Kentucky, but that's not too helpful.

The EV cert has something I haven't seen before - two StreetAddress fields:

    streetAddress=STE 100
    streetAddress=212 N. 2nd St

Is that allowed? It's out there in the wild now. The SiteTruth engine didn't handle that properly, and ignored the second field. So the picture of the location didn't appear. Something to fix.

[1] http://www.sitetruth.com/fcgi/ratingdetails.fcgi?details=tru...

This should just link to the site: https://stripe.ian.sh/

The Ars Technica link is just blogspam.

Everyone is quick to say "well if you show the url its not a problem"

How? Jimmy B User obviously didnt know the correct url, thats how he got to the wrong site. A url like "htts://stripe-payments.com" in this scenario would look reasonably legit to most people.

For countries that don't have national business registration, browsers perhaps need to show more than just [US] etc.

But even then - how do I know what state Stripe is registered in?

Why can't cybersecurity analysts get such simple things right?

This is a security vulnerability in Safari, and should be reported and assigned a CVE as such.

One thing that browsers could do now to help with this is add the concept of a domain bookmark, with a similar interface to EV but added by the user. Then the user could a a domain bookmark of "My Bank" or whatever, and check for that when visiting any link claiming to be from your bank. Of course, banks like to use a bunch of random sounding domains so you need to do that a few times (when accessed via the main site)[note]. I check for a bookmark in firefox when typing a domain name, but something that works for the whole domain would be great.

The same basic idea with email is helpful as well, creating a visual distinction for senders you expect to receive mail from and unknown senders. I don't think it is perfectly reliable due to issues with email but it does catch all phishing attempts that I've seen personally.

The GNU Name System or similar would help in some cases, but I don't think it really solves this particular problem. To confirm that a site is one the user cares about, the best way to do that is for the user to indicate that a site is one they care about and then look for that in the future. Then they only need to get the correct site once.

[note] Some banks would still defeat this by creating short term marketing campaign domains and then allowing them to expire... I guess to deal with that there would need to be a way to mark the main long term domain and give other domains the ability to ask a different domain to vouch for them as from the same organization. Then the user could just add one domain bookmark and it would just work for all other domains from that organization. At least unless the bank forgets to update that list before the domain expires...

Could this problem be fixed by allowing registered trademarks to be incorporated into EV certificates, and prominently displaying the trademarked name? It seems as though Stripe isn't a registered trademark, but most companies that go for EV I imagine have a legally unique name. It could be incorporated in to the green lock by doing something like "Bank of America Corporation [US] (Bank of America ®)"