Ian Carroll demonstrates that Extended Validation certificates can be obtained for a lookalike company, using a fake "Stripe, Inc." site.
HN commenters use it as proof that EV certificates mislead users, and argue about browsers hiding the identity display it exploited.
You're right in that a working EV system can indeed protect people. However, as this article suggests, even a basic check can be very hard for CAs to implement. If you can't even do a spell check on the state or country name, can you be trusted to verify the identity of those who rely on you to meticulously verify a company?
There's also the point https://stripe.ian.sh/ made: it's not just about registering the same name in a different state. People don't know in what state your (parent company) headquarters are so they would need to dig deep into the organisational structure to find out if the EV cert they're presented with isn't from a company with the same name in another state. Want to add more years of registration? Just buy an old, probably no longer used letterbox company and change the legal name. Whois info can be set to anything you want for most domain registrars as well. People will still need to find out if all the data matches.
There's also this demonstration of how EV can actually be used to help phishing by using the "green address bar" and the hilariously stupid Apple address bar design: https://www.typewritten.net/writer/ev-phishing/
I believe there is value in EV certificates if you can rely on the identity verification that they come with. Sadly, most providers of EV certificates seem to view them as a way to make more money, not as a tool to bring trust to the web.
An EV-like system will probably be reinvented in the future, giving us a fresh start…
EV certificates are nothing other than a way for the CAs to make money now that people have realized that the CAs' core product is worth approximately $0.
Argument 1: this person was able to get an EV cert for "Stripe, Inc. [US]", an entity they registered in Kentucky, no relation to the Stripe, Inc. of California whose website is stripe.com. They were not able to get a certificate for stripe.com. (The CA revoked it, and then later apologized for revoking it because there was no reason by their policy to do so.) https://stripe.ian.sh/
Argument 2: the actual website for MasterCard's SecureCode is https://www.mycardsecure.com/ , whose EV cert is "Arcot Systems LLC [US]". The fact that it has a meaningless domain name is in no way fixed by it having a meaningless (but technically accurate, Arcot is the contractor for SecureCode) EV cert. How do you know you're actually supposed to type your personal information there?
Argument 3: the web's security model is based on origins (domain names), not on EV certs. If Stripe switches tomorrow to stripeiscool.com and a domain squatter gets stripe.com, my browser will still send cookies to stripe.com, even though it no longer has an EV cert, and it certainly won't send cookies to stripeiscool.com, even if it has an EV cert with the same organization. Even if EV were a good idea in the abstract, it lacks a plan to make it work with the web as actually deployed.
Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/). Do you even read links? https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/
EV certs are an expensive boondoggle that add little-to-no value over DV certs. It's why all browser makers (not just Google) dropped any special rendering for them. The real value is pervasive TLS.
Phishing and website impersonation should be tackled with a variety of practises, and EV certs don't really come into it. Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Your browser history should have it. You can bookmark it. If you've clicked a phishing link and you're on wellsfargo.com.badguy.com instead of wellsfargo.com, don't you find it odd you can't auto-fill your user/password any more? Maybe you're on the wrong site? Oh yes, there on the URL bar is "wellsfargo.com.badguy.com", I see it now.
Can you imagine if we still had that awful special rendering for EV certs, and the wellsfargo.com.badguy.com owners incorporated "Wells Fargo" in Timbuktu and bought an EV cert for their legitimate business, and the entire URL bar was covered up with " Wells Fargo"... lol
With EV the checks basically care about:
1. Does this entity exist, e.g. it's in an official government business directory and the address details match what was specified
2. Use a third party directory (e.g. Dunn & Bradstreet) to look up this entity, and phone them. Ask to talk to some specific role at the company e.g. "Head of the IT department" and then confirm the details with that person.
This involves actual humans, albeit basically call centre employees, looking at paperwork, making telephone calls, that sort of thing. I guess you could label it "best effort" but to me that signifies much less.
For Americans a surprise problem with EV is that your country doesn't _have_ a central business directory. Each State runs its own directory, most businesses are registered in Delaware, regardless of their actual home state.
https://stripe.ian.sh/ has a completely genuine Stripe, Inc. EV certificate, issued to a Stripe, Inc. just not the one that's famous.
> [1]HTTPS encryption itself doesn't meaningfully require public key infrastructure, it's just that without PKI, you don't know who sent the encrypted traffic. Since domains are terrible "identities" and it's common for large organizations to use many of them that sound similar to scam domains, domain validation really doesn't tell anyone anything about whether or not they're talking to a trustworthy entity.
It is trivial to get an EV cert for a company that has the same name as a trustworthy entity[0]. There is nothing in the design of EV that prevents this, and name collisions between corporate entities are common and acceptable practice[1].
[0] https://stripe.ian.sh/
[1] Trademarks are a different matter, but getting an EV cert for a company that has the same incorporated name as a different company in a different state is completely legal.
If you click through to the page the article is referring to, his description of the problem is far better than Ars' summary[0], and he basically says some of the things you said. He is however more pessimistic:
> There will undoubtedly be many proposed solutions to this issue. Ultimately, though, any method that ends up giving users a legal entity is fatally flawed. As a result of how extended validation certificates work, browsers have few options to fix this. Having said that, they can take steps to ensure EV certificates do not override other critical parts of the user interface, like Safari does.
[0] Edit: Actually, on this note, might I suggest the HN link be changed to point to https://stripe.ian.sh/