Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.

[Scott Gifford <sgifford () suspectclass com>]

Neil W Rickert <rickert+bt () cs niu edu> writes:

> Scott Gifford <sgifford () suspectclass com> wrote on Feb 11, 2005:
>
> > Maybe I'm naive, but shouldn't a trustworthy root CA not sign
> > certificates for domain names which are obviously meant to be
> > deceptive?
>
> Signing the certificate earns income for the CA and its shareholders,
> and serves the customer who requested that the certificate be
> signed.  If a CA were to set very high standards and check very
> carefully, then it would price itself out of the market.
>
> As a user of a browser I am not a customer of the CA, and it isn't
> evident why the CA should be under any obligation to me.  They surely
> are under an obligation to their shareholders and their customers.

My understanding of the business model was similar to an organization
like the Better Business Bureau; the customers are the ones paying to
be certified, because being certified gives them some extra
legitimacy.  BBB is able to do this because they have built up public
trust; essentially they're a reseller of public trust.  If they do a
poor job of screening, it reflects poorly on their customers, and
trust in them is reduced.

CAs serve a similar function.  If they have no public trust, what do
they have to sell?  Surely people don't pay them 50-100 bucks for the
5 seconds of CPU time it takes to sign the certificate...

----ScottG.