I support DV as the bare minimum for sites, and agree that sites with specific concerns should have something stronger.
I don't think that EV for "important credentials" is likely to be a workable option or a good one for society for the following reasons:
- Simply displaying EV and not using it as part of some automated should-the-browser-pass-credentials flow is, I believe, unlikely to deter phishing. (If you disagree, let's find studies, which probably exist, and I'll concede the point if the studies show that it works. But given that Verified by Visa uses this site with this EV cert https://www.mycardsecure.com/ and expects you to enter personal info there, I'm not optimistic.)
- I do not see how a web browser can determine whose credentials are important to whom. I would expect that there are people on HN who do care deeply about their account not being compromised (e.g., founders and VCs).
- If we simply state that the only people with EV certs are current Fortune 500 companies and current household names, that seems like a bad political decision for the web - first, it is political, and second, it seems like a position that's pretty strongly at odds with the web's political values, insofar as they exist: the web has long been a place for upstarts to compete on an equal footing with companies that have been around for years.
- There are solutions other than EV for these problems, like U2F and also password managers. The fact that the MyEtherWallet BGP attackers were able to steal user login credentials without even getting a valid SSL cert makes me not optimistic about "make certs harder to get" being the answer - we should stop the mechanism by which those credentials were sent in the first place.
I do think placing the burden on your grandma to have a U2F security key is entirely reasonable - she has a key to get into her house, right? A fob to get into her car? A credit card with an EMV chip? I think your grandma is perfectly capable of plugging something into a USB port.
How does a U2F key even solve the problem of knowing that a website associates with a real identity? It may stop a phishing attack, but where do you get the initial trust to begin with?
I think the issue is that we need to know that google.com can be shown to clearly be owned by Google, LLC, and not GoogleCo in a small African nation. (And also, presumably, that google.com is actually google.com, and not some weird substitutions in there like https://www.xn--80ak6aa92e.com/ which shows as apple.com on Firefox.) That's going to be the EV system or something like it, and it's inherently impossible to keep that in line with "the web's political values", if you describe those values as requiring that "anyone can get one". There will always be some justification that someone, somewhere, can find to call themselves something.
> I think the issue is that we need to know that google.com can be shown to clearly be owned by Google, LLC, and not GoogleCo in a small African nation.
Google, LLC? Why not Google, Inc.? Wait, is it Alphabet, Inc.? Why do I trust companies from Palo Alto (or Delaware?) more than I trust companies from small African nations?
I don't trust google.com because they're run by some Delaware corporation named "Alphabet." I trust them because I have come to trust G O O G L E dot C O M, generally by being told by other people that G O O G L E dot C O M is a good site (or perhaps in the case of Google, because it's baked into my web browser, which I've figured out how to bootstrap trust for). I trust - and want to enter credentials into - gmail.com because they're the owners of the website gmail.com, and when I give out my email address to people, I say "gmail.com", not "an email service run by a subsidiary of an American corporation named Alphabet."
Anyone can call themselves anything - that is and has long been part of the web's values. The other one is that, once you get a name, you get to keep that name as long as you want. Dropbox didn't originally have dropbox.com, but they still have getdropbox.com, the name I saw on marketing and on referrals from friends about 10 years ago. I don't care if getdropbox.com was started by some of my college classmates or by people from a small African nation, as long as I can type the letters "getdropbox.com" into my browser, I've successfully bootstrapped trust.
If you personally trust companies because they're from the United States and not from small African nations, you do you, but I see no reason that the web should design itself around your politics, when the web already has a perfectly good system for bootstrapping trust - typeable domain names.
It is perhaps ironic that your primary objection to my line of thinking is that it gates out smaller players and startups, potentially, but then you mention trusting google.com because it's baked into your browser, which of course, gates out everyone but one centralized monopoly deeming itself trustworthy. (Note: I have removed a litany of malicious Chromium-based browser installs from people's PCs in the last year, I am not sure convincing the average user to trust their browser is a good plan.)
And what about https://www.xn--80ak6aa92e.com/? How is the average user supposed to keep up with the latest and greatest ways to pretend to be someone else's URL? I mean, goog1e.com is likely to still be a reasonably effective deception to the average user. Should nobody ever click a link from anywhere, and solely find websites by memorizing the URLs and typing them in?
I don't think that EV for "important credentials" is likely to be a workable option or a good one for society for the following reasons:
- Simply displaying EV and not using it as part of some automated should-the-browser-pass-credentials flow is, I believe, unlikely to deter phishing. (If you disagree, let's find studies, which probably exist, and I'll concede the point if the studies show that it works. But given that Verified by Visa uses this site with this EV cert https://www.mycardsecure.com/ and expects you to enter personal info there, I'm not optimistic.)
- I do not see how a web browser can determine whose credentials are important to whom. I would expect that there are people on HN who do care deeply about their account not being compromised (e.g., founders and VCs).
- If we simply state that the only people with EV certs are current Fortune 500 companies and current household names, that seems like a bad political decision for the web - first, it is political, and second, it seems like a position that's pretty strongly at odds with the web's political values, insofar as they exist: the web has long been a place for upstarts to compete on an equal footing with companies that have been around for years.
- There are solutions other than EV for these problems, like U2F and also password managers. The fact that the MyEtherWallet BGP attackers were able to steal user login credentials without even getting a valid SSL cert makes me not optimistic about "make certs harder to get" being the answer - we should stop the mechanism by which those credentials were sent in the first place.
I do think placing the burden on your grandma to have a U2F security key is entirely reasonable - she has a key to get into her house, right? A fob to get into her car? A credit card with an EMV chip? I think your grandma is perfectly capable of plugging something into a USB port.