The CA's Role in Fighting Phishing and Malware

The pro-content policing argument does have one good point. While a “green lock” does not indicate safety or legitimacy, there is tons of advice out there (from websites, commercial CAs, news programs, etc) that have incorrectly stated that the lock means just that.

So there is a real risk of users misunderstanding the meaning of the symbol. Inexperienced users may visit “Paypall.com” and check for a lock as assurance that they are on the real Paypal. However I think the CA industry uses this argument as a crutch; there is no evidence to support this is a common occurrence.

Most commercial CAs do have content policing measures. Its usually a combination of a black listed term list + revocation information + 3rd party databases like Google’s Safe Browsing database.
Some CAs are more strict, like Symantec, who recently banned an entire TLD because they identified it as being a popular TLD for phishing/malware. This is a perfect example of CAs overstepping their boundaries, and an illustration of why aggressive content policing is inappropriate.

Let’s Encrypt’s position is a good one. The CA/B Forum Baseline Requirements do suggest that CAs use some sort of system to identify “high-risk” domains. So there is an implication, with the current wording of the BRs, that the CA does have SOME responsibility on this front. One of the suggestions they make is to check with the Google Safe Browsing database. There is no evidence that Google uses this list to unfairly punish domains, so claims that this makes Google “gatekeepers of who gets a certificate” are unfounded and purely hypothetical.

We should remember that historically, all certificates had identity validation (OV was the first kind of Certificate). Some CAs carry this history with them and have a different interpretation about what a certificate represents and means. Let’s Encrypt’s move is partially political. They dont want to immediately end the practice of content policing, and their blog post says as much. Some of you may be unhappy with this in the short term, but I think it will yield more benefits in the long term.

3 Likes