Slashdot Mirror
Extended Validation SSL, More Secure or Just a Racket?
Nalfeshnee writes "The Register is reporting on the new 'Extended Validation SSL' cert currently being touted by Verisign. Vista and IE7 will be using this but not, apparently, Firefox anytime soon. For this the Verisign Product Marketing Director Tim Callan squarely blames the Firefox dev team for 'not keeping up' with their new technology. However, the whole thing just seems to be a way for Verisign to enjoy ridiculous markup on selling 'more secure' certs."
Yes. Look at the screenshots and you'll see the organization name appears at the right of the address bar.
http://www.verisign.com/ssl/ssl-information-center /faq/high-assurance-ssl.html
This seems to be composed of two parts:
IE 7 will have different icons on the location bar to indicate that a site has the "higher" level of "security" (translation: "bought the new certificate").
The plan was for all the browsers to implement the color bar scheme, based on IE's implementation. There were optimistic announcements by all involved, but no final standard has emerged. VeriSign and other SSL certificate authorities are preparing to start selling these in January. It's not clear to me if Firefox/Mozilla has actually opted out or is just moving more slowly than MSFT in incorporating the changes in the browser. Mozilla tends to be deliberate about SSL-related changes in the browser.
RichM
Data Center Knowledge
I used to work at a certain SSL place, so here's what I could gather.
Right now to get a cert it's a phone call verification or something else that can be done remotely.
For High Assurance CAs, the issuer has to fly a person out to the physical site, take pictures of the site, go inside, take pictures of at least two(?) employees, get names of workers, get signatures, and so on. At least that was the idea last I heard.
Rather than a remote validation, which I guess is easier to forge and easier to issue a mistake to by accident, this requires in person validation and lots of other crap you can't do without actually going there and checking it out. You decide if it's worth it. If not seeing that "special green color" stops just a few customers from using your site, it probably is.
On a related note, I was doing some poking around the other day and noticed this:Three things to be concerned about:
1. It's only a 1024 bit RSA key. That is weak by today's standards.
2. The signature algorithm is 'RSA-MD2'.
3. Attacks against this certificate may only be theoretical today, but Verisign foresaw this, and saw fit to mark the certificate as valid until 2028!
Thank you, Verisign!
According to their customer rep "Doreen", there's really nothing special about this.
What I got out of the chat session:
Now, I understand that this is pretty low on the totem pole, but still I think it's indicative enough to start throwing around some assumptions.
<assumptions style="raging">
From a technical standpoint, "High Assurance SSL" is functionally the same as vanilla SSL. The only difference is that for supported browsers, the cert holder and issuer will be visible in the URL address bar. (Oh, and you can toggle between them by clicking, whoopee.) The main draw is that it's "more visible!!!".
So functionally, if the FF devs want to counter this ridiculous load of crap, all they have to do is stick the plain old vanilla certs into the URL bar and maybe highlight weird characters to show phishing attempts. Certainly, a whole lot more paperwork isn't going to stop the phishers if they're going to the trouble of getting a cert anyways.
</assumptions>
Smells like a turd, looks like a turd.
---k--
</stupid>
You're missing the point of what a trusted CA is supposed to do. The point is that the browser makes trusts this CA to verify that a domain name has a legitimate owner. More precisely, the browser maker trusts the CR to verify that the person who applied for the certificate represents the owner of the domain name. If you create a CA that does no verification, how would you trust them? It would be a huge security hole for such a CA to be in Mozilla's list of trusted CAs. Somebody could register with this free CA as citibank.com, hijack DNS, and impersonate https://www.citibank.com with the users none the wiser.
"paypal gets a lot right"
I have a screen shot on a computer around here someplace of a browser alert window pointing out the cert domain doesn't match the domain. It was about 2-3 years ago. I can't remember for sure but I think it was www.paypal.com (the cert) didn't match paypal.com (which is what I type in).
The points remain:
1) People don't care if the cert is valid or not or in many cases if it's even signed by a root auhority the browser knows about
2) There are lots of errors in certs the browsers ignore; if they didn't damn few, if any would work.
Need Mercedes parts ?
The Mozilla foundation did not have a good set of criteria for including a cert. Originally they pretty much just used the same ones as IE (pay a big heap of money). Now they do have a set of rules, and the CACert people are trying to prove that they comply with them. It should be done Real Soon Now(TM).
I am TheRaven on Soylent News
GoDaddy High Assurance SSL.
Comodo Trusted SSL.
GeoTrust True BusinessID.
Business identity validation SSL certificates have been around for a long time. The only thing different about VeriSign's offering is that they're partnering with Microsoft to have the bar turn green if their more expensive cert is detected, to the disadvantage of all other SSL providers. This is an attempt by VeriSign to make it effectively necessary for businesses to use their cert so customers won't think that their site is insecure.
There's so much wrong with this attempt to gain a monopoly without adding anything of value to the market... but par for the course for VeriSign.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
In the first link, they're self-signed certs that trigger the "Stop the World, something's wrong!" message. If consumers are ignoring this already, I'm afraid that a "green bar" isn't going to be much more effective.
The second link is more problematic, but the solution is simple. If a cert authority can't do proper due dillegence, then remove them from the browser's trusted list until they correct their procedures. They're obviously not trustworthy. Giving Verisign an artificial monopoly on something they should already be doing is not the way to solve the problem!
Javascript + Nintendo DSi = DSiCade