User: Password:
|
|
Subscribe / Log in / New account

Extended Validation certificates and cross-site scripting

Extended Validation certificates and cross-site scripting

Posted Mar 13, 2008 12:01 UTC (Thu) by nix (subscriber, #2304)
Parent article: Extended Validation certificates and cross-site scripting

Just a note: 'more scrutiny' here is 'more' than 'does the credit card work'. No attempt is
normally made to check that the credit card is not stolen, that the owner of the credit card
is the same person who applied for the certificate, or even that the owner of the credit card
exists. I sometimes wonder why anyone trusts certificates from the major CAs at all...


(Log in to post comments)

Extended Validation certificates and cross-site scripting

Posted Mar 13, 2008 12:46 UTC (Thu) by davecb (subscriber, #1574) [Link]

Given that, are the browser developers being hoodwinked
by the claim that EV has any value whatsoever?

--dave

Extended Validation certificates and cross-site scripting

Posted Mar 13, 2008 17:47 UTC (Thu) by jwb (guest, #15467) [Link]

Yes.  EV is a scam invented by VeriSign to charge people EVEN MORE money for 500 bytes of
ASCII.

Extended Validation certificates and cross-site scripting

Posted Mar 13, 2008 23:00 UTC (Thu) by gerv (subscriber, #3376) [Link]

Apart from the fact that it wasn't invented by Verisign, but by a consortium of CAs and
browser vendors, and apart from the fact that doing more vetting obviously costs more money,
the remaining part of your criticism is right on the money. Oh, wait, ...

Perhaps those who are dissing EV might get more of a hearing if they actually found some flaw
in the vetting standards. See http://www.cabforum.org/ if you want to try. If you find a flaw,
report it and the CA/Browser Forum will fix it.

Gerv

Extended Validation certificates and cross-site scripting

Posted Mar 13, 2008 23:16 UTC (Thu) by jwb (guest, #15467) [Link]

    * Verifying the legal, physical and operational existence of the entity
    * Verifying that the identity of the entity matches official records
    * Verifying that the entity has exclusive right to use the domain specified in the EV
Certificate
    * Verifying that the entity has properly authorized the issuance of the EV Certificate

Each of these four items were advertised features of every SSL vendor on the market since day
one.  The "EV" scheme is only giving us what we used to think we were getting at the normal
price, except now at the new, higher price.  And it's fairly extortionate because if you don't
get your cert signed by one of the authorities with a root cert shipping in Firefox and MSIE,
then your business is effectively slandered as being less safe.

A VeriSign EV cert costs 50% more than one without EV.  Now that EV exists, almost any web
business is pretty much required to get one, lest popular user agents badmouth them.

Extended Validation certificates and cross-site scripting

Posted Mar 14, 2008 7:30 UTC (Fri) by gerv (subscriber, #3376) [Link]

"Each of these four items were advertised features of every SSL vendor on the market since day
one."

Absolutely. I wouldn't want to cast aspersions on any low-cost cert company by suggesting that
they don't do that for the $10 you pay. But now they are being audited to make sure that they
are doing it, it seems that prices have gone up. That's a strange thing. Still, that doesn't
make the fact that the vetting is verifiably being done now any less of a good thing.

Bottom line: EV is only extortionate if you _were_ actually getting what you thought you were
getting before. Do you think you were?


Extended Validation certificates and cross-site scripting

Posted Mar 15, 2008 0:35 UTC (Sat) by iabervon (subscriber, #722) [Link]

The assurances that they claim, even assuming that they are met, aren't meaningful. The only
meaningful question is whether the site really is the site the user thinks it is, and that's
something that a CA can't determine, because the CA doesn't know what site the user thinks
something is. For example, there have been multiple organizations called, informally, "Chart
Bank" doing business in Massachusetts in the last five years, entirely legally. If I'm a
customer of one of them, and end up at the web site for a different one of them, I'm likely to
reveal personal information and passwords to a third party with whom I have no business
relationship and whose policies on data collected from failed login attempts I don't know.

The only way to get a meaningful increase in security over regular SSL certificates is to
ignore the CA entirely, and reserve the green location bar plus a user-selected description
for certificates that the user has independently verified with the organization (for example,
by comparing the certificate fingerprint with a fingerprint printed on their bank statements).
Then, if the user goes to any site that doesn't have that certificate (or, more reasonably,
doesn't have a certificate signed by the bank's signing certificate), it might get the lock
and a yellow bar, but it won't get "My Bank" and a green bar, even if it's some legitimate
site that could be the user's bank but happens not to be.

Extended Validation certificates and cross-site scripting

Posted Mar 15, 2008 11:20 UTC (Sat) by gerv (subscriber, #3376) [Link]

"For example, there have been multiple organizations called, informally, "Chart Bank" doing
business in Massachusetts in the last five years, entirely legally."

Right. But the one you visit will have certain info in its EV cert, such as its registered
address, and others will have other info. And they _all_ will be legitimate businesses. And,
if they have the same name, they are very unlikely to have similar websites. It's not in their
best interests to promote confusion!

And also, accidentally revealing personal information to a legitimate bank meant for another
bank is not even close to being in the same league as revealing it to a phisher.

Gerv


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds