0

When you get a certificate from a website you visit, signed by a trusted CA, is it trust-worthy because the CA authority did a background check on them?

But how does this help with spoof websites?

Imagine this:

  • someone made a fakebook.com and made it look exactly like Facebook
  • user actually typed in fakebook.com himself (by mistake)
  • fakebook.com has acquired a certificate from on the trusted CAs
  • The certificate says it is "Fakebook" and not "Facebook" which is fair
  • The user sees the green icon and is happy. He goes on to use Fakebook.

To prevent the above, should all CAs manually check the website and see if it is intentionally made to look like another website?

I read about a CA that mistakenly gave certificates to an individual claiming to be Microsoft. (http://en.wikipedia.org/wiki/Certificate_authority#CA_compromise) What does this mean? Someone created a website and used "Microsoft" as the owner name? When users visit websites, its not like they actually see who the owner is. All they care about is whether it is signed by some trusted CA. How does it matter what owner name that guy used to acquire a certificate?

Improve this question

2 Answers 2

Reset to default
5

is it trust-worthy because the CA authority did a background check on them?

No. A SSL certificate is comparable to a passport: it says who the person is and which country the passport issued. But it does not say how trustworthy the person is.

The main use of the certificate is to make end-to-end encryption possible, that is protecting against man-in-the-middle attacks by checking, that that host name in your URL matches the name given in the certificate and that the certificate is issued by a trusted CA. No more, no less.

In most cases the only check the issuer CA will do is to see if you have access to a specific email address of the domain, i.e. [email protected] or similar. For EV certificates more checks will be done but nobody will do background checks of your criminal history or so.

Therefore the only trust you get from the certificate is, that the owner of the certificate probably owns this domain. And even that is not true in all cases because the CA might be hacked or the site had an insecure configuration so that the attacker was able to get a certificate etc.

In no case you can derive from the certificate if the site itself is trustworthy, if it is able to protect your private data, if it got hacked etc. And a certificate does not protect you against spoofed sites or bad guys claiming to be good guys.

Improve this answer
2
  • but can you give me a specific example of how using a certificate helps against a possible attack? From your answer, anyone (even the owner of a spoof website) can get a certificate claiming him to be the owner of the spoof website. User visits the spoof website and gets exploited. What's the use of certificates here? A passport is used to make sure, when someone goes to withdraw money from a bank account, that he is the owner of the bank account. How is it analogous to certificates?
    – learner
    Commented Mar 30, 2015 at 18:22
  • 1
    A passport lets you verify, that the presenter of the passport is the one (s)he is claiming to be. It does not say anything about trust and the bank only gives the money out because it verified that the details on the passport match the details of the account and not because the person looks trustworthy. Same is true for certificates: they get used to verify that the site you connect to is the site you see in the URL. This validation is needed to protect the connection against man-in-the-middle attacks. But the certificate says nothing on how much you can trust the site.
    – Steffen Ullrich
    Commented Mar 30, 2015 at 19:04
1

"fakebook.com has acquired a certificate from on the trusted CAs" : Normally (and I said normally, because to say it so "the world isn't perfect") this step should not happen.

A really trustable CA should benefit from specific services from third-party societies (like Netcraft) so, when you try to register a new domain name, they will automatically check it with these services before allowing you to proceed. You have more information on the linked page, but to say it short such service will associate a risk level to the requested domain name, depending on the similarity with a currently existing domain (including different kinds of transformation in the name), allowing the registrar system to take appropriate measure (refuse automatically, check manually, etc.).

Improve this answer
2
  • While such things would be nice I doubt they will happen in reality. To provide some reality checks: arstechnica.com/security/2015/03/…, arstechnica.com/security/2015/03/…, ... And it does not matter if the CA is "really trustable" - it is enough if any of the 100+ CA trusted by the browser/system issues this certificate. The chain is only as strong as the weakest link.
    – Steffen Ullrich
    Commented Mar 29, 2015 at 12:56
  • Incidently, I saw that fakebook actually exists, owned by FB publishing... a music related company. Thank you for your links, I think it remains interesting to see what companies try to do against such threats, but obviously any automated checking cannot be bulletproof (I wonder the risk level associated by Netcraft's algorithm to the legitimate fakebook website...) and there are still other flaws to solve (weakness on customer side to protect access to administrative email accounts, weakness on intermediate CA to protect the private keys, etc.).
    – WhiteWinterWolf
    Commented Mar 29, 2015 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .