Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So, I saw this on a page:

enter image description here

(The redacted part says the name of the entity that owns the domain)

The page recently got SSL certs verified by GeoTrust. The image is on https://smarticon.geotrust.com/smarticon?ref=hostname and on clicking it we get sent to https://smarticon.geotrust.com/smarticonprofile?Referer=hostname, which shows:

enter image description here

But I don't quite get the point of this image. To me, it's detracting attention away from the green URL bar and shifting it to the spoofable image.

Is there any point in CAs giving customers these images to put on the page?

share|improve this question
1  
"Is there any point in CAs giving customers these images to put on the page?" -- It's good(?) advertising for the CAs? Certainly I can't see any good reason why the customers should put them up, but I can see a business case for why the CAs would give them out. –  apsillers Oct 24 '13 at 15:48

2 Answers 2

up vote 3 down vote accepted

Generally the point is that if you click the link, it will do some additional validation of the site by confirming with the CA that the certificate is the correct one that they issued, but really, it shouldn't matter and could easily be faked by going to some random website that says "yep, they're secure."

It's one of those things that I think was originally intended to be the answer for websites to point out who their certificate is from back before browsers did a better job of properly displaying who the certificate authority is. I think it was mostly trying to counteract attacks where someone compromises the local machine and places a fake root certificate that allows a man in the middle to easily pretend to be the site, though at that point, you are screwed anyway since a keylogger could just as easily be used at that point.

So no, not really any good point anymore and even when there was a point, it was dubious at best. what is a bit different is that sometimes it is more than an identity verification. Some of the services will do vulnerability scans and check privacy policies and such and audit the company and only then allow a logo to be displayed, but that isn't the point of the logos you put in your post.

share|improve this answer

Personally I completely disagree with any form of security assertion on a webpage. I'm writing a blog at the moment about exactly this.

Many financial institutions features things like "Log In Securely Here" links and pictures of padlocks dotted all around the place. A simple SSLstrip attack and the user is browsing the page over http:// yet they are logging in "securely" because, well, the page says so and there is a picture of a padlock so it must be secure.

I also agree with your point that it detracts the user's attention away from the address bar which is the only place a user should look to seek assurances about the security of their connection. Expecting them to look for and trust a jpg that says the site is secure is a bad practice. Anyone can put a padlock icon on their site and say it's secure when it isn't.

share|improve this answer
    
I recall dealing with a vendor of some hosted service or another last year who had a new web based service that they were trying to sell us and the site had one of those logos but it was http:// and a wireshark capture using the site showed that no part of it, not even the login process went over https:// We talked to them about it and they insisted it was secure. They had not even set up their server to use SSL/TLS as an option, but they fully believed that because they bought a certificate and pasted the logo code onto the site it was secure. –  Rod MacPherson Oct 24 '13 at 16:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.