Extended Validation certificates and cross-site scripting [LWN.net]

Extended Validation certificates and cross-site scripting

Posted Mar 13, 2008 23:00 UTC (Thu) by gerv (subscriber, #3376)
In reply to: Extended Validation certificates and cross-site scripting by jwb
Parent article: Extended Validation certificates and cross-site scripting

Apart from the fact that it wasn't invented by Verisign, but by a consortium of CAs and
browser vendors, and apart from the fact that doing more vetting obviously costs more money,
the remaining part of your criticism is right on the money. Oh, wait, ...

Perhaps those who are dissing EV might get more of a hearing if they actually found some flaw
in the vetting standards. See http://www.cabforum.org/ if you want to try. If you find a flaw,
report it and the CA/Browser Forum will fix it.

Gerv

(Log in to post comments)

Extended Validation certificates and cross-site scripting

Posted Mar 13, 2008 23:16 UTC (Thu) by jwb (subscriber, #15467) [Link]

    * Verifying the legal, physical and operational existence of the entity
    * Verifying that the identity of the entity matches official records
    * Verifying that the entity has exclusive right to use the domain specified in the EV
Certificate
    * Verifying that the entity has properly authorized the issuance of the EV Certificate

Each of these four items were advertised features of every SSL vendor on the market since day
one.  The "EV" scheme is only giving us what we used to think we were getting at the normal
price, except now at the new, higher price.  And it's fairly extortionate because if you don't
get your cert signed by one of the authorities with a root cert shipping in Firefox and MSIE,
then your business is effectively slandered as being less safe.

A VeriSign EV cert costs 50% more than one without EV.  Now that EV exists, almost any web
business is pretty much required to get one, lest popular user agents badmouth them.

Extended Validation certificates and cross-site scripting

Posted Mar 14, 2008 7:30 UTC (Fri) by gerv (subscriber, #3376) [Link]

"Each of these four items were advertised features of every SSL vendor on the market since day
one."

Absolutely. I wouldn't want to cast aspersions on any low-cost cert company by suggesting that
they don't do that for the $10 you pay. But now they are being audited to make sure that they
are doing it, it seems that prices have gone up. That's a strange thing. Still, that doesn't
make the fact that the vetting is verifiably being done now any less of a good thing.

Bottom line: EV is only extortionate if you _were_ actually getting what you thought you were
getting before. Do you think you were?

Extended Validation certificates and cross-site scripting

Posted Mar 15, 2008 0:35 UTC (Sat) by iabervon (subscriber, #722) [Link]

The assurances that they claim, even assuming that they are met, aren't meaningful. The only
meaningful question is whether the site really is the site the user thinks it is, and that's
something that a CA can't determine, because the CA doesn't know what site the user thinks
something is. For example, there have been multiple organizations called, informally, "Chart
Bank" doing business in Massachusetts in the last five years, entirely legally. If I'm a
customer of one of them, and end up at the web site for a different one of them, I'm likely to
reveal personal information and passwords to a third party with whom I have no business
relationship and whose policies on data collected from failed login attempts I don't know.

The only way to get a meaningful increase in security over regular SSL certificates is to
ignore the CA entirely, and reserve the green location bar plus a user-selected description
for certificates that the user has independently verified with the organization (for example,
by comparing the certificate fingerprint with a fingerprint printed on their bank statements).
Then, if the user goes to any site that doesn't have that certificate (or, more reasonably,
doesn't have a certificate signed by the bank's signing certificate), it might get the lock
and a yellow bar, but it won't get "My Bank" and a green bar, even if it's some legitimate
site that could be the user's bank but happens not to be.

Extended Validation certificates and cross-site scripting

Posted Mar 15, 2008 11:20 UTC (Sat) by gerv (subscriber, #3376) [Link]

"For example, there have been multiple organizations called, informally, "Chart Bank" doing
business in Massachusetts in the last five years, entirely legally."

Right. But the one you visit will have certain info in its EV cert, such as its registered
address, and others will have other info. And they _all_ will be legitimate businesses. And,
if they have the same name, they are very unlikely to have similar websites. It's not in their
best interests to promote confusion!

And also, accidentally revealing personal information to a legitimate bank meant for another
bank is not even close to being in the same league as revealing it to a phisher.

Gerv