0

I just happened to stumble upon this Article in Netcraft. The article claims that many of the major CAs have given out hundreds of Certificates to false organizations.

Are there any truth to these claims? Is there any data to support it?

It is also worrying that these fake certificates were issued by many of the major CAs. In the past I've never heard of a similar incident in such a massive scale(I may be ignorant here, feel free to enlighten me). Has the Quality of PKI for the web gone down lately?

0

1 Answer 1

1

Are there any truth to these claims? Is there any data to support it?

What data you need to support the claims apart from the ones already in the article? Netcraft is usually not a company which makes unfounded claims.

Has the Quality of PKI for the web gone down lately?

I don't think so. But since more and more users link SSL with security and phishing sites want to look secure the existing system of lousy checks by the CA gets more abused. Most users don't understand that SSL only protects the transport and does make any statements about the security of the site itself.

But actually, from the perspective of a potential victim a site like https://phypal.com (example from the Netcraft article) is probably not more trustworthy than https://paypal.secure-payments.toplevel or https://support.toplevel/paypal/ which you could probably easy create even when stricter checks are done by the CA. There are usually lots of ways to make your site look trustworthy. In my opinion it is much more important to educate users what kind of security they can really get from SSL, and what it does not protect against.

3
  • are the CAs always been this lousy with their verification? is there any other way to verify the authenticity of a website other than using the CAs?
    – JOW
    Oct 19, 2015 at 10:42
  • 1
    A certificate only validates that the owner of the certificate owns the domain contained in the certificate. Only EV certificates involve more because in this case the CA actually does a more extensive verification of the owner. Again, SSL protects only the transport so any SSL enabled website can still deliver malware or can be used for phishing. Oct 19, 2015 at 11:09
  • i guess it just sucks to be the guy who thought that he was safe because he saw a green address bar and a padlock symbol. thanks for the answer.
    – JOW
    Oct 19, 2015 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .