News for hackers. Stuff that matters.

A comment on Scammers registering date-based domain names. Parent comment

Re:Scammers registering date-based domain names by wongarsu on Friday January 03, 2020 @09:06AM (#21945907)
An EV certificate is still a decent proxy for legitimacy: it's somewhat expensive to get and allows you to track down a legal entity. Both points deter scammers and other evil-doers, even if they don't completely prevent them.

Sadly there's no way to judge from just the URL if a site has an EV cert or just a cheap/free https cert, and by the time you opened it in the browser it might be too late.

[ Parent | on HN ]
Re:Scammers registering date-based domain names by SAI_Peregrinus on Friday January 03, 2020 @10:15AM (#21946539)
Not really. "Legal Entity" doesn't mean much, it's cheap to register a company and the name doesn't have to be unique. One guy registered a company called "Stripe" and got an EV cert for his site.[1] Modern web browsers don't show anything different for EV certs (try it). They stopped last year, mostly because EV certs were ineffective.

[1] https://stripe.ian.sh/

[ Parent | on HN ]
Re:Scammers registering date-based domain names by PeterisP on Friday January 03, 2020 @09:57AM (#21946355)
A lack of EV certificate is not a decent proxy for legitimacy, because most of legitimate important sites don't have an EV certificate - so people can't be trained to think that they should think twice if an EV certificate is absent.
[ Parent | on HN ]
Re:Scammers registering date-based domain names by SAI_Peregrinus on Friday January 03, 2020 @10:32AM (#21946699)
They also don't show up any differently in browsers any more. There's no difference a user can see unless they go through the menus to view the cert itself.
[ Parent | on HN ]
Re:Scammers registering date-based domain names by SmellyGeekBoy on Friday January 03, 2020 @10:06AM (#21946451)
EV certificates are a scam anyway.
[ Parent | on HN ]
Re:Scammers registering date-based domain names by wongarsu on Friday January 03, 2020 @10:20AM (#21946590)
I sure would do a double take if I noticed a bank website using a non-EV cert or an EV cert issued to somebody other than the bank. But that's probably one of the few industries where you can expect it.
[ Parent | on HN ]