Slashdot Log In
Extended Validation SSL, More Secure or Just a Racket?
Posted by
ScuttleMonkey
on Wed Oct 25, 2006 04:53 PM
from the fun-with-revenue-generation dept.
from the fun-with-revenue-generation dept.
Nalfeshnee writes "The Register is reporting on the new 'Extended Validation SSL' cert currently being touted by Verisign. Vista and IE7 will be using this but not, apparently, Firefox anytime soon. For this the Verisign Product Marketing Director Tim Callan squarely blames the Firefox dev team for 'not keeping up' with their new technology. However, the whole thing just seems to be a way for Verisign to enjoy ridiculous markup on selling 'more secure' certs."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Color coded? (Score:5, Insightful)
I'm colorblind. Would I ever notice the difference?
Yes. (Score:4, Informative)
Parent
Certs are a joke (Score:3, Insightful)
"Oh, it's an https site. It's encrypted. Cool". Next.
Some time when you're really bored look at the low level ssl stuff (with openssl or something) and notice all the errors. The browsers ignore so many of these I think it's all a big joke.
Re: (Score:3, Informative)
I have a screen shot on a computer around here someplace of a browser alert window pointing out the cert domain doesn't match the domain. It was about 2-3 years ago. I can't remember for sure but I think it was www.paypal.com (the cert) didn't match paypal.com (which is what I type in).
The points remain:
1) People don't care if the cert is valid or not or in many cases if it's even signed by a root auhority the browser knows about
2) There are lots of errors in certs the browsers igno
Re:Color coded? (Score:4, Funny)
Parent
Most colorblind people can tell white from green (Score:3, Interesting)
To be honest there is a difference between a cert from a real CA and some $10 cert from some outfit that doesn't care anything more about your true identity than whether your credit card payment goes through. Google for "high assurance" vs "low assurance".
Re: (Score:3, Insightful)
Sadly, CACert's root certificate is still not included with Mozilla, although a number of distributions include it.
Re:CACert (Score:4, Informative)
Parent
Secure? (Score:2, Insightful)
I mean hell if SSL is weak encryption and we need stronger encryption should I not SUE verisign right now for providing a false sense of saftey?
Re: (Score:2)
1. You have clearly not read the article, or even the entire /. summary.
2. Who is talking about cracking SSL? Nobody... the underlying algorithm algorithms can be changed.
3.
Re: (Score:3, Informative)
On a related note, I was doing some poking around the other day and noticed this:
Re:Secure? (Score:5, Interesting)
No.
No.
No.
SSL (and TLS) aren't encryption algorithms, they're protocol standards. These protocols make use of existing encryption algorithms to secure data. Many of these algorithms have a variable level of complexity, depending on things like key size. Since security (including encyrption) is always a tradeoff of resources versus security, the goal is to tweak the configuration parameters (again, such as key length) to find a level of security such that an attack against the cipher is less profitable an option than the next best choice, such as kidnapping the document's author. Those who require greater security can use turn up the complexity at the expense of using more resources.
As computation capability increases, the complexity of encryption system is increased to compensate, usually by increasing key length. If a flaw is discovered in a given encryption algorithm making it too easy to break, or if the algorithm isn't capable of being expanded to account for better decryption technology (such as DES) then that algorithm is discarded in favor of some stronger replacement. SSL remains the same.
Verisign's "Extended Validation" program has nothing to do with cipher strength, key length, or encryption. Instead, it's indicative of the vetting process that the company had to undergo to get the certificate. To get a certificate for citibank.net, I have to verify that I own that domain. I don't, necessarily, have to verify that I represent Citibank [1]. Under this High Assurance program, Verisign will vouch, not only for the validity of the domain, but also for the validity of the organization owning that domain.
This is a Good Thing, since there currently is only one tier of validation. An SSL certificate is designed to prevent man-in-the-middle attacks, which it does well. What it doesn't protect against (though we act as if it does) is forged identity attacks. Certificates used for financial transactions, for example, should go through a stronger vetting process than certificates used for securing a blog.
[1] In reality, almost all CAs do extended verification when the other party sounds like a high-profile company or financial institution. Nonetheless, Mistakes do happen [washingtonpost.com].
Parent
Re:Secure? (Score:5, Informative)
Comodo Trusted SSL. [trustlogo.com]
GeoTrust True BusinessID. [geotrust.com]
Business identity validation SSL certificates have been around for a long time. The only thing different about VeriSign's offering is that they're partnering with Microsoft to have the bar turn green if their more expensive cert is detected, to the disadvantage of all other SSL providers. This is an attempt by VeriSign to make it effectively necessary for businesses to use their cert so customers won't think that their site is insecure.
There's so much wrong with this attempt to gain a monopoly without adding anything of value to the market... but par for the course for VeriSign.
Parent
It's called "open source" (Score:5, Insightful)
Re: (Score:3)
The Register was putting word's into Tim's mouth. They are the ones who used the phrase 'dragging their heels', not Tim.
The Mozilla team have been part of the EV development process from the start.
The real issue is that IE7 is harder to change once released. So the different deployment strategies make sense.
I don't get it (Score:5, Interesting)
Re: (Score:2, Insightful)
It may solve some problems, like having a few guys claiming to be from Microsoft showing up at VeriSign's offices and walking off with a signed SSL key for MS.
This is only one of the many major problems that SSL has, though. I don't see how this can address the problems of international domain names (where glyphs for certain characters can look the same, but aren't). I also doubt that it gives assurances about the security practices of the company (why would a cracker sniff a few credit cards at a time of
Re:I don't get it (Score:5, Insightful)
That pretty much sums up this garbage. This is what SSL is supposed to already be, but as anyone who has filed for an SSL certificate already knows the whole thing pretty much works as a handshake... you're who, yes, ok, credit card with that name please, great, here you go.
And what about this "standardized across the industry"... I bought an SSL certificate from a 3rd party because they're in the Firefox/Opera/IE default trust lists, and because they cost $40 a year instead of $400, is this really a new industry standard or is this just Verisign's way of artificially creating a new market now that there's too much competition?
Parent
I'm going to guess (Score:4, Insightful)
They could do this now with regular SSL, but they couldn't charge more money... too much competition out there.
The thing is, the encryption of SSL is not at issue; it's just a new product to market.
Parent
Re:I don't get it (Score:5, Informative)
Right now to get a cert it's a phone call verification or something else that can be done remotely.
For High Assurance CAs, the issuer has to fly a person out to the physical site, take pictures of the site, go inside, take pictures of at least two(?) employees, get names of workers, get signatures, and so on. At least that was the idea last I heard.
Rather than a remote validation, which I guess is easier to forge and easier to issue a mistake to by accident, this requires in person validation and lots of other crap you can't do without actually going there and checking it out. You decide if it's worth it. If not seeing that "special green color" stops just a few customers from using your site, it probably is.
Parent
Re: (Score:3, Informative)
According to their customer rep "Doreen", there's really nothing special about this.
What I got out of the chat session:
They SHOULD be doing this for everyone... (Score:4, Insightful)
I think I remember reading about this either on firefox dev blogs or mailinglists or IRC. IIRC, the upshot was that verisign should be doing "extended validation" type things on all their clients. The validation they have now is really pretty shoddy, shoddy enough that they'd be risking getting kicked out if they weren't so big and so many websites would break. But that's just my memory, which could be bad, you'd have to look into it yourself.
Racket (Score:5, Insightful)
Definitely sounds like a racket to me. If you get the green bar by paying Verisign 150%, how does that differ from today's security certificates? Other than having to pay more money, and only being able to be verified by Verisign, that is. (Doesn't sound racket-y at all. Or was that rickety?) While they make it sound like the Green Bar is an excellent method of knowing that Amazon is really Amazon, I think it's actually a reverse attempt. By getting Amazon to use this spiffy new green bar, Verisign is attempting to legitimize their new technology in the eyes of the consumer. Little will actually change for the consumer, as he already knows when he's surfing Amazon.
The only place it would supposedly help is with Phishing. But since Phishing sites can't get certificates anyway, what does this help? If the lock isn't good enough, just change the URL Bar green for every VERIFIED certificate received. That will have the EXACT same effect.
The new certificates are double plus super good. (Score:5, Insightful)
#2. This additional "verification" is what will cost the additional money.
#3. Any business that does not pay the additional fees to be "verified" by "industry standard" practices will be
#4. Phishing depends upon a person making a single error in judgment, one time. This will not stop phishing.
This will not stop anything. This is stupid. You're paying EXTRA to have someone do the verification they were supposed to be doing already. Imagine trying to run a business like that.
Boss - "I paid you last week, but you barely did any work. I'm going to fire you."
Employee - "If you give me a 50% raise, I'll perform the work to industry standards."
Boss - "Okay, that sounds like a good deal to me."
Parent
Sadly its commonplace.... (Score:3, Interesting)
ROTFL...
You mean like pay a mailing/shipping company insurance for them to do their own job?
Or paying extra for an extended warranty? (To guard against stuff that shouldn't be crappy in the first place)
Or paying a credit card company EXTRA MONEY for them to taken YOUR PAYMENT "express" ?
Or paying extra money for a "Service Plan" to get "updates" to bug-ridden software?
Or paying a monthly fee for a
Re: (Score:2)
Actually, I don't think phishing sites have much trouble getting certs. Several SSL providers merely check that you own the domain the cert is registered to. If I'm the registrant of amaz0n.com, I'll approve the ssl purchase and have a cert. It tells you absolutely nothing about whether you can trust the person running the website you've connected to.
I'm guessing this is going to end up a lot like the "Made for Windows" certifica
Re: (Score:3, Informative)
The second link is more problematic, but the solution is simple. If a cert authority can't do proper due dillegence, then remove them from the browser's trusted list until they correct their procedures. They're obviously not trustworthy. Giving Verisign an artificial monopoly on something they s
Riiight. (Score:3)
Re: (Score:2)
Silly us, we should haver been using two padlock symbols the whole time.
Charging more to do what they should be doing. (Score:5, Insightful)
Err, excuse me.. isn't the verification of the identity of the applicant of the certificate exactly what the CAs are meant to be doing anyway?
I thought that that is why we had these 'trusted' third-parties, to vouch for the identity of the certificate owner - that is the fundamental basis of PKI and certificates. If they weren't doing that before (which they clearly weren't doing properly), what the hell were they doing?
So, we're paying them extra to get a 'fixed' version of something that they caused to be broken in the first place because they couldn't do their job properly. WHy should paying an extra 50% on top of their fees all of a sudden make us able to trust them now?
Re: (Score:2)
Are you really surprised? (Score:2)
You know what? I'm quite sure it's a shoddy product they're trying to shove down people's throat for some reason...
Gaah! Please skip the revisionism. (Score:3, Insightful)
Right! Because DOS was definitely the only O/S upon which big business was doing business, say, back in the 1980's.
And then there were those enormous numbers of consumers using DOS instead of Apple II machines or Ataris or Amigas... Shoved down their throats? Come on. If you're going to rant about MS market share, at least skip over the part when it was anything but a sure thing, before all of the other platform makers wheezed an
Scam... (Score:5, Insightful)
Now we're supposed to get a more "trustworthy" cert and make our address bar green?
Fuck you Verisign.
Tom
Do disreputable sites get them? (Score:2)
Of course, there are technical issues with a PKI system without trusted root certificates, so it might no
Re: (Score:2)
I think you're being too subtle [slashdot.org] for this site [slashdot.org]...
Uh, what was the middle choice again? (Score:2)
C'mon, ScuttleMonkey, are you trying to get a job as a pollster for Karl Rove?
"Would you be more likely or less likely to vote for John McCain for president if you knew he had fathered an illegitimate black child?"
All the brower teams and SSL CAs agreed to this (Score:5, Informative)
The plan was for all the browsers to implement the color bar scheme, based on IE's implementation. There were optimistic announcements by all involved, but no final standard has emerged. VeriSign and other SSL certificate authorities are preparing to start selling these in January. It's not clear to me if Firefox/Mozilla has actually opted out or is just moving more slowly than MSFT in incorporating the changes in the browser. Mozilla tends to be deliberate about SSL-related changes in the browser.
Re: (Score:2)
No the article is the Register's version. Its hard to tell but there is actually a panel session on this at RSA Europe and the other vendors are on the panel.
Spinal Tap Syndrome... (Score:2, Insightful)
What about this paragraph? (Score:2)
I don't feel all paranoid about this, and I think the technology is a good concept, but dang, do we want any for profit company to be the one in charge of maintaining these lists? And what's the appeal process, if my online store got l
racket? (Score:5, Insightful)
Everything Verisign does is a racket.
Therefore, it's a racket.
Q.E.D.
Where's the specification? (Score:5, Insightful)
Has anyone actually been able to find the specification for "high assurance" certificates? Apparently this is being closely held. The spec comes from something called the "CA Browser Forum", which is invitation-only and doesn't seem to have a web site. A standard was supposed to be issued in August, but apparently agreement wasn't reached until a meeting in September. There are many press releases, but no hard data.
So that's why it's not in Mozilla.
It's actually a good idea. Early in the history of SSL, getting a certificate required presenting appropriate business identification info to the certificate issuer. The problem is that some issuers (GoDaddy comes to mind) started issuing "domain only" SSL certificates; the only verification is that the domain can get email. Then, instead of revoking GoDaddy's root certificate for this, the other cert issuers copied GoDaddy's approach. Now anybody can get a meaningless certificate with a meaningless Relying Party Agreement.
The way it's supposed to work is that the certificate issuer bears financial responsibility for misidentification of the certificate owner. Some certificates from Verisign have a Relying Party Agreement [verisign.com] that does provide a financial guarantee to the party relying on the certificate - $100 for a class 1 cert, $5000 for a class 2 cert, and $100,000 for a class 3 cert. Most of the other issuers have relying party agreements which promise nothing and deliver less.
So what's happening is that, soon, you'll be able to tell the difference between the crap certificates and the good ones. Before you buy. The idea is that if you put your credit card into a site that showed a green toolbar in IE, and it wasn't really the company it should have been, you can collect from the certificate issuer. This puts certificate issuers on the hook for phishing losses.
Unfortunately, the rules and the Relying Party Agreements for the new certificates haven't yet appeared, so we can't tell if the rules are tough enough to make this work. Since they're being drafted by the certificate issuers, there will probably be some loophole that lets them off the hook.
SSL and Extended SSL (Score:2, Interesting)
Microsoft (Score:2)
phffft
Fund raising idea for firefox (Score:5, Funny)
You want TECHNOLOGY? Ok, here's some. (Score:5, Interesting)
"Technology?" Give me a break. They're looking at what authority signed the cert, and if the web browser has been told to dogmatically trust that authority more than others, then it turns something green.
Actually, it's not a bad idea. There are degrees of trust, and showing it to the user is fine. But you bet your ass this is mostly just a cashgrab from Verisign.
Good news. There's a way to do this, that will absolutely embarrass MSIE, making its version of https look completely insecure by comparison, and screw Verisign over, in the process.
Support an OpenPGP-based cert model [gnu.org] (perhaps using GNU TLS library [gnu.org], perhaps not). Suddenly, you can have certs that are signed by multiple authorities, including users themselves, and display a whole spectrum of trust metrics. Equifax can make mistakes and issue an incorrect cert to a bank [washingtonpost.com], but can three CAs all make the same mistake, without a conspiracy? And what if you get the bank's fingerprint on your snailmail statements, or there's a sign showing the fingerprint when you walk into it, and thus you can cert it yourself? What if you haven't ever been to the bank (ok, I can't imagine that) but you have 3 friends who have, and you have certified them, and told your computer they are each marginally trusted, and they all certify the bank? Three friends are sure as hell a lot more trustworthy than some faceless corporation named Verisign, whose identification policies you don't even know, whose private key storage policy you don't even know, and in fact doesn't have a single employee you have even met, assuming they have any employees at all and aren't a robot in the basement of a building at the NSA.
what's the price structure? (Score:3, Insightful)
If the extra up-front validation is the main thing, Verisign should be charging a high one-time-fee for undertaking those steps, then charging a low low monthly rate to rest on their laurels and do nothing further. Somehow I doubt that's the price structure they adopted here.
Re: (Score:3, Insightful)
I mean, wouldn't it make more sense for Verisign to do the same thing (if they wanted to get some money for insecure certs but still have a more secure cert) to create a new Certification Authority name also run by Verisign that actually does their job, and
Re: (Score:2)
But then how would you tell the old CA apart from the new CA? It isn't like your browser loudly proclaims which CA is validating a particular domain. Or are you suggesting they revoke their own current CA status?