Everything we're told about website identity assurance is wrong

191 点作者 nikbackm超过 3 年前

23 条评论

Animats超过 3 年前

I built Sitetruth.com to try to solve that problem. I'm going to shut it down soon.The goal of SiteTruth was to try to find the real-world business behind a web site, and look up information about the business, such as how long it has been in business and its annual revenue. That's become harder and harder over the last decade.First, it's now acceptable to have an online business with no real-world address and no visible legal existence. This is illegal in the European Union and illegal in California if the business accepts payments, but enforcement is nonexistent.Second, more sites have become inaccessible to scraping by servers. I have a system which looks for a human-readable business address on a site. It looks in the obvious places (front page, "about", "legal", "terms", "contact", etc.) and quits after trying the 20 most likely pages. It uses a honest agent ID ("Sitetruth.com site verification system", registered with the now meaningless "bots vs browsers" list) and obeys robots.txt. A sizeable fraction of the time, it can't read the site at all.Third, the data sources for company information have been becoming less accessible. There used to be two reliable data sources: Hoovers, and Dun and Bradstreet. They merged. Dun and Bradstreet for a while became rather corrupt. They licensed a company in Santa Monica, CA to use their name, and sent the small-business part of the business to them. This unit's marketing approach was "Nice credit rating. Be a shame if it something happened to it". After much litigation, DnB HQ bought the Santa Monica company, but the reputational damage was done and DnB is no longer the gold standard of company information. There are lower tier data sources (look up "US Business List"), but the data quality is poor. Anything based on user recommendations, like Yelp, gets spammed, so that's out. Yahoo Directory, which was reasonably spam free, is gone.Fourth, the SSL cert industry became corrupt. OV standards were never very high, and EV standards started slipping. Then there was the Cloudflare problem. Cloudflare is a certificate authority, and they issue certs to themself for domains which run through Cloudflare. So looking up a cert just gets Cloudflare's info.Fifth, Google is making it harder and harder to have Chrome plug-ins that critique their ads. I dropped Chrome support recently, and only have a Firefox add-on at this point.So, after fifteen years, Sitetruth is coming to an end.

评论 #30367468 未加载

评论 #30365055 未加载

评论 #30367094 未加载

ryan29超过 3 年前

OV certificates are even worse. The verification is a hassle and it's extremely difficult to distinguish OV from DV. Try to figure it out. The only way I'm aware of is to make sure the `Policy Identifier` [1] of the certificate is `2.23.140.1.2.2`.I've also never had a good experience with the validation process from any of the CAs. They often push anything that's not immediately discoverable back to the applicant and expect them to do the leg work. I've had both Comodo and DigiCert do this to me in the past. Here's an example from DigiCert. This happened this year (2022).> First, As part of the verification process, we are required to confirm the registration of your organization with the local registering authority.> We have attempted to locate the registration records using online resources, however we have not been able to locate such a document. If you are aware of any government based search tools for your jurisdiction that can be used to locate proof of the organization's registration, please reply to this email with a link and instructions for locating that record. Once received, our validation team will confirm the record and proceed with the validation process.Really? To me that seems like someone who isn't familiar with my jurisdiction because they don't know the process. What's stopping me from sending them a link to a fake, official looking site? It seems like an invitation for social engineering. Code signing certificates are the same. It's infuriating.In my experience, they look for your company on Google Local (or whatever it's called now) or similar and if they can't find it they punt it back to you. I think the whole process is worse than nothing because it's selling a false sense of security for anyone who believes the marketing.From a customer value standpoint, I'd rather pay for a DV certificate where the value comes from helping me to set up proper CAA records to prevent mis-issuance as well as certificate monitoring for any potential lookalike domains. Of course, the margins on that probably wouldn't be as good.Thankfully I only deal with one place that insists on buying expensive certificates because "they're better". Just for fun sometime go look at the TLS certificates used by all of your local government websites and try to figure out what they cost. Then factor in the labor for multiple people to coordinate annual renewals and manual installation. It's frustrating.1. PDF Warning: <a href="https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.1.pdf" rel="nofollow">https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...</a>

billpg超过 3 年前

"Nobody Looks Beyond the Lock"I did. A high-value (to me) service used a cert with the green banner and I'd look to it to be reassured I was in the right place. Then one day, it disappeared.Alarm bells started ringing and I tried to find out what was going on. I called their help desk and asked if they had changed their TLS certificate but the helper I spoke to had no idea what I was talking about and couldn't be persuaded to escalate my query.Just in case my connection was being hacked by someone who managed to register a lesser TLS certificate, I left it a day until I could try again from my home broadband.In the end, I did go ahead and use the site without the green banner, which makes me my own worse enemy.

评论 #30367509 未加载

评论 #30365755 未加载

snowwrestler超过 3 年前

Troy and others have made great hay out of explaining how badly browsers work with EV certs.They spend considerably less time talking about why browsers do such a terrible job of surfacing cert information for website visitors. Yes, cert UI sucks; not sure we needed an enormous article to belabor that. The real question is, why does cert UI suck so bad? (UI design is a choice.)The answer is that everyone who runs a major browser has a vested interest in making sure decentralized site verification sucks. Because they are supported by highly centralized private site verification schemes.Decentralized verification is the norm offline. Do you carefully Google and research every store you walk into? No, because to open a store, the store owner has to establish a paper trail. And if you have a problem at that store, your advocate (a credit card company, insurance company, lawyer, law enforcement, etc) can follow that paper trail to find a party they can negotiate with, or investigate.Over time, the effectiveness of this system—in which all parties have invested—creates a barrier to in-person scams. The result is a society where you can walk into a new store, a restaurant, a bar, etc. with confidence.And note that name collisions don’t matter in this system. There are tons of restaurants called “McDonalds,” all owned by different people. But each one has an address and a unique paper trail that leads to a specific person or business. If you can remember which one you visited, your advocate can follow the paper trail for that one in particular.The idea of EV and OV certs was to use the power of encryption to hook your browser to this same set of offline paper trails. You wouldn’t even need to remember anything; the browser would maintain a log of the sites you visited for you. If you got scammed, you just look back in your history and forward the business info to your advocate or law enforcement.The decentralized nature was a feature; businesses had the choice of which cert to get, who to buy it from, and users had the choice of browser. Competition and mutual distrust would create incentives for parties to hold each other honest.To be clear, an EV or OV cert would not magically prevent scams. But they would provide cryptographic guarantees that an advocate or law enforcement could trace back to an entity, to prosecute or make you whole. Just like in a real life store.Instead, browsers became dominated by companies who run for-profit search engines, app stores, and identity platforms. So today what is the advice for verifying a website’s legitimacy? Google it. Or get their app from the curated App Store.The result is a web dominated by a few huge gatekeepers. SEO is life or death because Google is the only way for a website to be “real” for people.And most techies went along with it because they shared the vested interest, or did not appreciate the existing system that creates the real life shopping experience we see every day.And so where are we today? A new generation of techies trying to use the power of encryption to create a decentralized web. Web3.

评论 #30363315 未加载

评论 #30362047 未加载

评论 #30361985 未加载

y-c-o-m-b超过 3 年前

> nobody is actually going to look beyond the lock anyway. (Yes, I know there'll be someone somewhere who eventually does, let's just agree that "nobody" is a number that rounds to 0%.) I mean seriously, do you ever do this?Yes, yes I do... did. I'm in the US and get a vast array of bills coming from all kinds of different sources (utilities, doctors, etc.) that manage their payments via some random portal. Some of the "payment portals" they send me to are sketchy as hell and it brings me great anxiety to use them even though it's guarantees my payment arrives on time and I don't have to fuss with snail mail (and its associated thefts). I always make sure they are https and I used to look "beyond the lock" to make sure they a well-known CA was being used. Well as Troy mentions, it's effectively a worthless endeavor. I'm glad he's bringing this topic up to gain more visibility and awareness towards the issue.

评论 #30364473 未加载

brightball超过 3 年前

I need to dig it up, but PayPal once did a security presentation on “trust indicators” like EV certs related to user behavior.The conclusion was essentially that trust indicators offer no benefit at all and can even go as far as creating harm since it could encourage a user to trust an entity that they don’t know if the system is abused. The psychology of it boils down to this: people trust lots of sites, services and other people who haven’t paid extra for these trust indicators and because of that it’s not going to change their behavior at all.On the flip side, inline and accurate warning indicators go a long way towards making users more cautious. Big red warnings from Google about users outside your domain for example.

blurker超过 3 年前

I feel like a lot of commenters may not have watched the video of Emily Schecter's that was linked in the article. IMO it actually did a better job of explaining the problem with EV's than the author's post did. Or at least it was very complementary.There are a lot of flaws in EV. I think the biggest one I saw was that it is effectively no more useful than TLD's/subdomains. In fact, it's worse, because unlike domains, there can be multiple owners of the same corporate name!To the people saying there is a paper trail... What good is that? There are "paper trails" for domain registration too. But that isn't very reliable and the same would happen with corporate registration. We know this all too well from how wealthy people use shell corporations to hide. And I'm sure there will be plenty of places around the world where it will be easy to incorporate for bad actors, even if some places do a good job of creating a paper trail.Fundamentally, this is a hard problem to solve and I really don't see EV solving this any better than domains.

评论 #30361597 未加载

nailer超过 3 年前

> Remember, EV only works if people change their behavior in its absence and clearly, that just doesn't happen.Web browsers told me they'd try better verification markers for years. They never did. So we don't know, except to say:a. the 'green bar' verification marker isn't very effective.b. the 'blue tick' logo as used for UIs like <a href="https://twitter.com/troyhunt" rel="nofollow">https://twitter.com/troyhunt</a> hasn't been tried so browser makers have no data here.It's a moot point: the realpolitik is browsers don't care about identity as it's not in their financial interest to do so.Disclaimer: I spent 5 years of my life trying to verify the web.

评论 #30360314 未加载

评论 #30360102 未加载

评论 #30359941 未加载

zuzun超过 3 年前

I don't see what's fundamentally wrong with EV certificates, as long as the certificate authorities do the proper verification. The certificates contain more than just the business name, so I think the criticism should be directed towards browsers that hide the relevant information behind 5 clicks.

评论 #30361122 未加载

评论 #30361144 未加载

评论 #30362424 未加载

zokier超过 3 年前

Sure, ev certs might not be all that great, but I do find Troys long-running crusade against them weird. I mean, it feels pretty disproportionate, like does anyone care that some corpos end up paying few hundred bucks extra for their certs or whatever? Isn't there almost endless amount of more important issues in the security landscape?

评论 #30365278 未加载

评论 #30365176 未加载

bell-cot超过 3 年前

Bluntly put, SSL Certificates exist (or at least are widely promoted and used in their current form) to protect the business models of a few very large corporations. Especially against parties like sleazy ISP's, who might love to (say) replace all the Google Ads on web pages which their customers view with new ads sold by the ISP.Beyond that, it's all FUD, marketing, and hype. And at least 90% of any actual benefits to normal users of the web fall under "convenient side-effect of what the large corporations would have done anyway, for their own benefit".[/cynic]

xg15超过 3 年前

Genuine question: suppose you get a link from a known, nontechnical friend for some interesting product on Amazon. The link goes to:<a href="https://amazon.shopping/" rel="nofollow">https://amazon.shopping/</a>...How do you determine whether this is actually Amazon or a scammer?

zaptheimpaler超过 3 年前

Right now, if what Troy is saying is true, then self-signed certificates are basically every bit as good as a LE cert - because no one actually verifies the chain of authority. But oh no, self-signing is a bad practice, and effectively useless because browsers will throw up warnings. So you go to LetsEncrypt and get a certificate that has a pretty green padlock.. because their `certbot` made it with 0 review of who you are or what the site does? How is this different at all?I'm not an expert, but at high level it seems to me that the only way to get trust is to tie every digital property to a real person, do some sort of KYC on them and allow for dispute resolution. The usual bureaucratic pains of doing anything in the real world would extend to the digital world, and the usual arguments about increase in regulation entrenching existing power structures and slowing innovation apply.

评论 #30367543 未加载

300超过 3 年前

The problem is real and it's not the only one in this space. I was surprised to see so many words and so little substance. If feels like Troy didn't really try about this one.

throwaway984393超过 3 年前

The funniest thing to me was always how any non-EV cert can be used in place of an EV cert if you want to MITM. Just find a way to generate a non-EV cert for a domain (from any of the hundreds of CAs) and go ahead and intercept traffic. Nobody will notice that the domain no longer uses an EV cert. The browser won't care. So it's not actually providing any security at all.I blame the browsers. They could have made it perform some kind of check, give some kind of warning. We've had to drag them kicking and screaming to adopt every ridiculous security extension to the web. They still use half-ass measures like HSTS that are trivial to work around. Nobody look at the big pink elephant.

nixpulvis超过 3 年前

The arguement that 'Nobody Looks "Beyond the Lock"' is not really valid in my opinion. If even 0.001% look, there's a chance someone will blow the whistle on a sketchy operation. Not to mention that I might only look closely on some responses.The other issues with EVs are more damning to me.

评论 #30369875 未加载

tgbugs超过 3 年前

I've been coming around to the idea that the threat models that are often used for website identity are not the ones we want. The ssh threat model related to changes in host keys seems to me to be a better one.The first time you connect to a website you get whatever identity it wants to show you. Whether it is a real site or not doesn't particularly matter, it only matters when the identity changes. If my first access was MITMed and then I connect to the "real" site, I should go and check to see what information changed, and if I sent any sensitive information I should probably do something to mitigate that (the exact action would depend on the exact type of info you sent). In the reverse case where you trust the original identity more than a changed identity you would ignore the event and might possibly want to inform the original entity that someone is trying to impersonate them.Still fairly complicated for the original user, but certificate expiration would no longer be the insanity that it is now, and you can at least get transport security without the big scary self signed warnings that show up now.

评论 #30366133 未加载

outloudvi超过 3 年前

I guess the same idea also applies to QWAC.<a href="https://www.eff.org/deeplinks/2022/02/what-duck-why-eu-proposal-require-qwacs-will-hurt-internet-security" rel="nofollow">https://www.eff.org/deeplinks/2022/02/what-duck-why-eu-propo...</a>

Sytten超过 3 年前

EV have their place in the ecosystem, they are just useless for websites.You still need them to properly sign binaries for Windows or get your logo showing in Gmail (BIMI), which are legit usecases where you want to verify the identity of the company.The alternative to that is each business setup their own verification mechanism similar to what Apple does and you have to pay each one a good chunk of money. (Arguably the EV certs are not cheap either).

评论 #30360851 未加载

panny超过 3 年前

Says the site being MITM by cloudflare. Not that he's wrong, but glass houses...

bombcar超过 3 年前

Ha the example site at the end has already been taken down.

评论 #30364054 未加载

coldcode超过 3 年前

Snake Oil is a long standing business practice.

newaccount74超过 3 年前

I am soooo grateful for LetsEncrypt -- before them, getting certificates was such a hassle. Even if you didn't fall for the EV or OV or whatever certs, just getting a DV cert was annoying. Every vendor had a slightly different web interface that was really annoying to use, and to get the cheapest price you usually had to go through a reseller, and they had even worse web forms.LetsEncrypt is such a breath of fresh air. And the short 90 day validity period more or less forces you to set up an auto-renew script, so you can typically set it and forget it.And if you mess something up, they even email you to warn that your cert is about to expire!

评论 #30360330 未加载