[amfsn]

That's what they wanted when they pushed Let's Encrypt. https meant something before, since a certificate was expensive and required proof of identity. Yes, those methods weren't infallible, but they were good enough. Now we've lost that with free https.

[tialaramex]

None of this is correct.

Certificates weren't expensive before Let's Encrypt, several outfits offered free certificates, especially on a "trial" basis that would be adequate for criminals even if it was largely useless to legitimate users.

But expensive certificate were, and still are, available to those with the Apple mindset. DigiCert will sell you a certificate for $218. Lasts 12 months.

And you're probably thinking: Right, that's a _proper_ certificate, that'll assure me of who bought it, and it comes with true security and all this amazing stuff. Nope, that's the same DV assurance that Let's Encrypt gives away, except DigiCert gets $218 of your money, and why not?

If there's a guy wants to buy one glass of water from me for $100 who am I to insist drinking water is free?

Anyway, no, certificates did not require "proof of identity" prior to Let's Encrypt, in fact back then they only required that the CA use "Any other method" a term of art in the rules that meant the CA could use its own best judgement (perhaps clouded by commercial considerations) to decide what was enough to be sure you controlled example.com before issuing you an example.com certificate.

_After_ Let's Encrypt, and with substantial input _from_ key Let's Encrypt people this was reformed to the Ten Blessed Methods (there are not actually ten of them today, but I like that name and it seems to have stuck) in which there are explicit methods defined for how a CA must check that you control the DNS names you want certificates for.

You are living in an all too common fantasy world. A world where you needlessly spend more money to achieve less security because you don't want to be confronted with facts.

[cm2187]

EV certs required that. DV certs never provided that sort of security.

[amfsn]

Of course they did. When you paid with your card they knew your identity. Unless you were carding which is a pretty serious crime.

[logifail]

> When you paid with your card they knew your identity.

Who's the "they" in that sentence? As it stands, a certificate reseller knows that the Paypal account "[e-mail]" paid for a SSL certificate for "www.unrelatedcompany.TLD"

The certificate itself tells you nothing about who paid for it - it doesn't even tell you which email account was used to confirm some level of association with the unrelatedcompany.TLD domain.

[amfsn]

Then PayPal has the data and LE can follow the trail. Because it's about LE being able to tell who actually bought the certificate, telling me end users can't do that is kinda moving the goalposts.

[pilsetnieks]

There are certificate authorities all over the world, and many of them not in jurisdictions that would share data with your law enforcement.

[logifail]

Q1: What kinds of serious crimes involve law inforcement needing to chase up who's behind the purchase of a SSL certificate, anyway?

Q2: Can't the bad guys just buy a pre-paid debit card with cash if they're that desperate to cover their tracks?