I find this a particular trend amongst security discussion, particularly here on HN: Focus on the most possibly sophisticated and capable attack, while ignoring that tens of millions of users are afflicted by pretty rudimentary attacks that are more or less automated on a daily basis. If EV were to solely succeed in ensuring an actual human had to go through the registration process, it would almost certainly be worth it.
Additionally, as a point of note, EV certificates could be made vastly more effective by easily addressing your concerns: Raise the price of EV certs significantly, which CAs would be more than happy to do, and ensure you needed to go to one of the upper levels of the CA system (say, having to go to Comodo for them, rather than your Trustico nonsense) to reduce the number of parties which could issue them as much as possible, and raise the mutual requirements between them to issue them.
I do agree that if $177 is too high a cost, then the problem is solvable by just setting a price floor on certificates (modulo CA/Browser Forum antitrust concerns). I do not think that solution is likely to work, except at a price point at which EV becomes unusably expensive for legitimate users.
EV only works if we are reasonably confident that users will refuse to enter credentials into a site without EV. As EV stands today - with EV costing less than $177 for a legitimate user (because they've already incorporated) - that isn't happening. Making EV harder to acquire doesn't actually solve phishing. That's my objection. Sure, you can make it harder to get an EV cert for a phishing site, but, so what?
(A better solution that actually works against rudimentary attacks is to just give everyone a U2F security key.)
As an example I do not care about: My HN account. I would not care if it was intercepted and "hacked", because the damage it can do to me personally is minimal. It would probably annoy the mods somewhat, but the handful of spam posts would get cleaned up, I'd have to reach out to the mods to get unbanned, and life would move on. I don't really care that HN has a cert at all, I certainly don't think HN needs an EV cert, I have no real concern about either my password being intercepted, or me being phished into believing a fake site is HN.
If we move DV certificates to be the bare minimum a site is expected to have, then EV should be a bar for important credentials. Aka, your Gmail account, your Bank of America account, etc. You know, Fortune 500 level companies which could afford, I don't know, a $5,000 or more annual investment. The higher cost would also justify higher requirements to get one. At that sort of cost, they could literally fly someone out to your office to check you out directly.
Whereas people have mistakenly corroborated the lock icon with "legitimate websites", an EV cert should ideally be the sort of thing household name companies have, which someone trustworthy has directly ensured is actually the keepers of that certificate.
I don't think placing the burden on my grandma to have a U2F security key is reasonable, but we should have a process so that google.com is clearly marked as being owned by Google, LLC, and that it is, in fact, the real google.com.
I don't think that EV for "important credentials" is likely to be a workable option or a good one for society for the following reasons:
- Simply displaying EV and not using it as part of some automated should-the-browser-pass-credentials flow is, I believe, unlikely to deter phishing. (If you disagree, let's find studies, which probably exist, and I'll concede the point if the studies show that it works. But given that Verified by Visa uses this site with this EV cert https://www.mycardsecure.com/ and expects you to enter personal info there, I'm not optimistic.)
- I do not see how a web browser can determine whose credentials are important to whom. I would expect that there are people on HN who do care deeply about their account not being compromised (e.g., founders and VCs).
- If we simply state that the only people with EV certs are current Fortune 500 companies and current household names, that seems like a bad political decision for the web - first, it is political, and second, it seems like a position that's pretty strongly at odds with the web's political values, insofar as they exist: the web has long been a place for upstarts to compete on an equal footing with companies that have been around for years.
- There are solutions other than EV for these problems, like U2F and also password managers. The fact that the MyEtherWallet BGP attackers were able to steal user login credentials without even getting a valid SSL cert makes me not optimistic about "make certs harder to get" being the answer - we should stop the mechanism by which those credentials were sent in the first place.
I do think placing the burden on your grandma to have a U2F security key is entirely reasonable - she has a key to get into her house, right? A fob to get into her car? A credit card with an EMV chip? I think your grandma is perfectly capable of plugging something into a USB port.
I think the issue is that we need to know that google.com can be shown to clearly be owned by Google, LLC, and not GoogleCo in a small African nation. (And also, presumably, that google.com is actually google.com, and not some weird substitutions in there like https://www.xn--80ak6aa92e.com/ which shows as apple.com on Firefox.) That's going to be the EV system or something like it, and it's inherently impossible to keep that in line with "the web's political values", if you describe those values as requiring that "anyone can get one". There will always be some justification that someone, somewhere, can find to call themselves something.
Google, LLC? Why not Google, Inc.? Wait, is it Alphabet, Inc.? Why do I trust companies from Palo Alto (or Delaware?) more than I trust companies from small African nations?
I don't trust google.com because they're run by some Delaware corporation named "Alphabet." I trust them because I have come to trust G O O G L E dot C O M, generally by being told by other people that G O O G L E dot C O M is a good site (or perhaps in the case of Google, because it's baked into my web browser, which I've figured out how to bootstrap trust for). I trust - and want to enter credentials into - gmail.com because they're the owners of the website gmail.com, and when I give out my email address to people, I say "gmail.com", not "an email service run by a subsidiary of an American corporation named Alphabet."
Anyone can call themselves anything - that is and has long been part of the web's values. The other one is that, once you get a name, you get to keep that name as long as you want. Dropbox didn't originally have dropbox.com, but they still have getdropbox.com, the name I saw on marketing and on referrals from friends about 10 years ago. I don't care if getdropbox.com was started by some of my college classmates or by people from a small African nation, as long as I can type the letters "getdropbox.com" into my browser, I've successfully bootstrapped trust.
If you personally trust companies because they're from the United States and not from small African nations, you do you, but I see no reason that the web should design itself around your politics, when the web already has a perfectly good system for bootstrapping trust - typeable domain names.
And what about https://www.xn--80ak6aa92e.com/? How is the average user supposed to keep up with the latest and greatest ways to pretend to be someone else's URL? I mean, goog1e.com is likely to still be a reasonably effective deception to the average user. Should nobody ever click a link from anywhere, and solely find websites by memorizing the URLs and typing them in?
> First, from incorporation to issuance of the EV certificate, I spent less than an hour of my time and about $177. $100 of this was to incorporate the company, and $77 was for the certificate. It took about 48 hours from incorporation to the issuance of the certificate.
> The primary point raised by advocates of extended validation is that obtaining EV certificates would leave behind a signifigant paper trail of the bad actor's identity. However, there is minimal individual identity verification in the process. Dun & Bradstreet1 is the only entity who attempted to verify my identity, and did so with a few trivial identity verification questions. Purchasing identities with answers to common verification questions is neither hard nor expensive.
> Otherwise, there was no attempt at identity verification from the state of Kentucky or the registered agent I used in the process. This is typical of company formation in the United States.
Given the use of a registered agent, and given that registered agents are a pretty common thing, I don't think that anything is actually being burned here, unless you want to say that any registered agent who incorporates a phishing company gets all their other companies banned. Which, like the CASC's "You can't have EV if you haven't existed for 18 months" suggestion, will technically work at the cost of making EV useless.
Also, a lot of attacks don't care that they're burning credentials anyway. You don't need to spoof MyEtherWallet more than once to walk off with hundreds of thousands in Ethereum. You don't need to spoof the Washington Post more than once to spread fake news 48 hours before a presidential election.