Extended validation certificates [LWN.net]

Extended validation certificates

Posted Nov 2, 2006 12:08 UTC (Thu) by gerv (subscriber, #3376)
Parent article: Extended validation certificates

The CA/Browser forum website is now up at http://www.cabforum.org; you can download a copy of the current draft of the vetting guidelines from there. (The link's in the header, a little bit hidden for some reason.) A few inaccuracies in the article:

Because CAs have traditionally done very little in the way of validation

Some CAs would dispute that; they would claim that new entrants to the market have done less validation, thereby driving certificate prices down and pulling the other CAs with them, and that this is a relatively new phenomenon.

Verisign has generated a new set of keys to sign the EV certificates and Microsoft has already incorporated that public key into IE7.

Not so; the same roots are used. The new certificates are marked with a new policy OID.

Mozilla has EV on its radar and it is listed as a feature to be added

It was somewhat difficult for us to discuss this while the draft was secret; now that it's public, join the discussion in the mozilla.dev.security newsgroup.

Unless the verification of the entity is extremely thorough (which would be very costly), it is unclear that EV certificates will really do anything to change that.

That's the fallacy of unobtainable perfection.

Even then, few people actually look at the name attached to an SSL certificate, and many might be surprised at the names that show up if they did.

...which is why the IE UI, at least, puts the company name in the chrome.

The end result is that anyone wanting to abuse HTTPS will figure out a way to get a signed EV certificate

I'm impressed that Mr Edge can draw that conclusion having never seen the EV vetting guidelines!

(Log in to post comments)

Extended validation certificates

Posted Nov 2, 2006 13:44 UTC (Thu) by gouyou (subscriber, #30290) [Link]

Even then, few people actually look at the name attached to an SSL certificate, and many might be surprised at the names that show up if they did.
...which is why the IE UI, at least, puts the company name in the chrome.

Which is a good starting point, but "SecureWebsite Ltd." from US won't be really different than "SecureWebsite Ltd." from Nigeria ... Green bar, names looks ok, let's start phishing :(

Extended validation certificates

Posted Nov 2, 2006 14:06 UTC (Thu) by gerv (subscriber, #3376) [Link]

You really should read the guidelines and look at IE's UI before commenting :-)

The UI in IE is of the following form:

SecureWebsite Ltd. (US)

so the country of origin is displayed.

Secondly, the certificate will contain (and the CA will hold) sufficient information about SecureWebsite Ltd. to enable the boys in blue in Lagos to track down the people behind it. The guidelines have been designed to raise the cost (in revealed information as well as money) of spoofing them above the possible return from getting a certificate fraudulently. In other words, you can't make them impossible to get round, but you can make it so expensive or time-consuming or dangerous that it's not worth it for the return you'd get from one phishing site.

Note that OCSP is mandatory for EV certificates, so they can be revoked quickly.

Of course, the vetting guidelines probably aren't perfect yet; if you can see holes in them, please do submit your points via the public comment system.

Extended validation certificates

Posted Nov 2, 2006 22:07 UTC (Thu) by martinfick (subscriber, #4455) [Link]

Ahh, the VIP falacy again. Make something a VIP and it is more valuable to fake. You say that it won't be worth it to fakes because it is too expensive. Doesn't that imply that the supposed added trustworthiness of this systems instantly makes it more worthwhile to fake, making bigger phishing expeditions possible?

Extended validation certificates

Posted Nov 2, 2006 22:17 UTC (Thu) by gerv (subscriber, #3376) [Link]

Yes, EV will be a bigger target if consumers start to trust it (as we hope they will). Then we'll see if the vetting guidelines we've come up with are strong enough. If they aren't, the Forum will revise them until they are.

In the past, there was no standard for CA vetting and so no way to raise standards if there were problems. Now we have a baseline. We hope it's good enough as-is (with input from the community which is coming now) but, if it turns out not to be, we can change it and the CAs will strengthen their vetting.