[mamborambo]

The consumer's dependence on "legit-sounding domain name", a green SSL key, and recognizable corporate logos and website layout as the "proof" of authenticity is passe.

In this era of online ubiquity there should be another layer of opt-in validation, ring of trust, p2p feedback and rating, that can all be plugged into the consumer web experience.

[jesterson]

As weird as it sounds, it is still the best.

If we have centralised "licensing" solution it is abused by large capital to wash off smaller - there is plenty of examples.

If we have decentralised solution (which is basically what review is) - it is immediately abused by "marketers".

There is no simple and easy solution to the problem.

[BobbyJo]

IMO, the best solution to the problem is friction. Criminals are criminals because it's easy. If opening a fraudulent store is 90% as difficult as opening a legit one, no one is going to bother.

[Tiereven]

I see what you're saying: if you add more startup cost then it makes it harder for spammers without legitimate business interest to profit. I think I disagree, though. Legitimate "mom and pop" businesses experience all the pain of learning the process of setting up a store, creating real products and pricing, inventory, delivery etc. They don't need more friction.

These criminals on the other hand are likely automating everything and have the advantage of lessons learned from dozens of iterations.

The article indicated the mimic sites accept credit card numbers but don't actually process them -- to me that is the Achilles heel of the process. If credit card companies started requiring instantaneous verification of the card's actual use (via a card chip reader or an app on user's phone, for example) instead of allowing payment via static information vulnerable to replay at any time, I think that could do a lot more to improve security of online transactions than green check boxes.

[joshspankit]

There’s danger on the other side of this: Credit card companies are already stifling creators because of the power they have when CCs are the primary payment method. Additional security gives them a tighter grip.

[BizarroLand]

Computers with built in NFC readers could allow you to pay for your purchases with your phone and use fingerprint/passcode/faceID etc. for verification.

That would be convenient enough for most people that it's usable.

[sydbarrett74]

Organised criminal syndicates are behind most of these operations. They have immense resources from which to draw. It's another example of the saying, 'It takes money to make money.'

IOW, adding friction wouldn't be a sufficient deterrent. Criminals are resourceful, and enriching themselves further is a strong motivator.

[BizarroLand]

Aside from that, in today's online world, any time friction is added, people come along and make some grease for it. Making a storefront from scratch? Difficult! Using WooCommerce on Wordpress? So easy a sufficiently motivated 12 year old can figure it out.

If you add some system for site verification, first someone will make tooling to facilitate it and soon after someone will offer a service to provide it for you and in a matter of months these spam sites will be up and running just like they are now, only it will be more difficult for a legitimate newcomer to get started in the same arena.

[FortiDude]

To me it's very simple: nation states should have their own layer that uses the national registry for companies to verify a domain.

When you register a business you also provide your official domains and so the validity of the website is checked against the validity of the business.

[crote]

The thing is, we tried this already. Twice.

First with domain names. The domain "nissan.com" is not owned by the well-known car company but by a completely unrelated computer company. As "Nissan Motors v. Nissan Computer" settled, this is totally fine and Nissan Computer still owns the domain.

Besides exact matches there are also similar-looking names. For example, a student named Mike Rowe started a small webdesign company called MikeRoweSoft, which drew the attention of Microsoft, leading to "Microsoft v. MikeRoweSoft" - which was settled out of court and resulted in the domain being transferred to Microsoft.

Second are Extended Validation domains - which used to show the company name in the URL bar. As Ian Carroll demonstrated[0] this isn't really worth a lot, and browsers no longer bother showing it at all[1].

Company names also often overlap when they are active in different areas, such as Apple Corp (record label founded by The Beatles) and Apple Inc. (tech multinational) - which over the years have shifted towards a rather impressive market overlap! Some companies are split with both sides keeping the original name, such as Motorola Inc.'s split into Motorola Solutions and Motorola Mobility. Sometimes products are sold under a completely different brand name, such as HMD selling Nokia-branded smartphones, or TP Vision selling Philips-branded televisions while MMD sells Philips-branded gaming monitors!

The thing is, reality is just too complicated for a "very simple" register. How are you supposed to fit in all of the scenarios listed above while still keeping it usable?

[0]: https://arstechnica.com/information-technology/2017/12/nope-... [1]: https://www.troyhunt.com/extended-validation-certificates-ar...

[mavhc]

.uk has .ltd.uk and .plc.uk which are only available to registered companies. No one uses them

[tokai]

Your name confusion is missing the point. It's the central registration done at a national level, not a True delimitation of which domain names which companies can own. A company could use downloadfreeram.tk, as long as it's officially registered in the national company register.

[nocoiner]

OK. What do you do in the United States where every state (and territory and the federal administrative district) has its own company register? Or where a vast number of businesses are sole proprietorships that have registered their trade name in their local county office?

[TheOtherHobbes]

Sounds like there might be some kind of solution for this that - just spitballing here - uses networked computers.

[crote]

So private individuals would not be allowed to register domains?

It sounds a bit like you just want WHOIS, which in practice turned out to be a bit useless.

[Rediscover]

Semi-OT: You just reminded me of dealing with subsidiaries in the1980s and 1990's. (Before chain of certs).

I spoke up about it on a mailing (probably an IETF one) list about subsidiary companies should be required to have not xyz.com but xyz.<owning company>.<over-seeing owner company>.com as their address. Example: In the U.S. it's not simple to get /real/ xyz with all the vitamins. So a hypothetical xyz.com should really turn up on search result as xyz.<parent company>.com.

Adjust as fit. Maybe $xx/year or the quantity of companies underneath the majorowner before compliance.

I was praising the value of something I did know the USian market had a distributorship over [in the geographical real] with a sub-standard product.

Let me know that I am looking at stats on y product (only served in z country).

Let me know that xyz name in my country is different ta your place.

[null_object]

> To me it's very simple: nation states should have their own layer that uses the national registry for companies to verify a domain.

I think this can just add layers of bureaucracy that don't address the problem anyway.

In the early days of widespread internet use in Sweden it was quite difficult to register a .se web-address: not only were company documents needed, but the authority that granted use of the address also split your right to it geographically within Sweden, so that if you wanted the address to stretch across the whole country you needed to make multiple applications (using a subdomain system).

This process just made it almost impossible for a small personal startup to own a Swedish domain, and it was completely impossible to register a domain on a 'try-it' basis, to see if a nascent business idea would take-off.

In other words it just entrenched the dominant position of incumbents.

What happened instead, was that Swedes registered .com addresses, or .nu ('now' in Swedish), or other variations. And the same sort of thing would happen now: the international fraudulent sites would still be possible - just legitimate registrations would become much harder.

A little like what happens with pirating, where people using pirated software often have to jump through fewer hoops than legitimate users, who've paid for their installs, but need to constantly dial-up to be allowed to keep using the tools they've bought.

tldr; more bureaucracy for legitimate businesses, but doesn't address the core problem for end-users.

[FortiDude]

I'm not saying that you need to be a company to have your own domain. I'm saying that if your domain represents a company there should be some way to automatically check that against a database of registered businesses

[marcinzm]

Wasn't that what the higher tier SSL certificates effectively aimed to do?

[sofixa]

Yes, EV(Extended Validation) was for that, the certificate authority had to verify you're a legitimate business with that name. However it didn't really work well: https://arstechnica.com/information-technology/2017/12/nope-...

[moooo99]

In Germany we have an approach with a somewhat similar effect.

For any site with an commercial intent (which is pretty loosely defined) it is mandatory to have an Imprint with the person representing the company, the address of the HQ as well as the companies registration number and court location. It makes it somewhat more transparent what company is behind the site and gives you information you can lookup in public registries.

I hate it from a privacy perspective but it’s okay for for consumer protection.

[lnsru]

My rude opinion: imprint is nonsense. It does not protect you from fake shops at all. It’s no brainer to copy one from another shop. As a legit seller you can be sued by shady layers for errors in imprint. Who is looking in public registers while shopping online…

[moooo99]

I actually do know quite a few people who look up the imprint before shopping there, especially when they buy stuff as a business. You’re obviously right but it’s fairly easy to copy an imprint, and the whole shady lawyer thing for minor errors also is absolutely a pain.

I don’t think it’s completely useless, but it’s certainly not perfect either. As the parent comment suggested having a business register It’s legit domains would probably makes sense from a consumer protection point of view.

However, with the current state of the digital administration in Germany this change would introduce so much overhead that it would lead to a lot of justified opposition.

[lnsru]

Family members as commercial buyers not only read imprints, but also check the seller and his company in various scoring portals. In commercial domain nice consumer protection does not exist anymore.

[archi42]

For well known shops: Probably nobody. But if I find a good price on an unknown (to me) shop I'll check the tax ID from the imprint on Google.

CRT.sh is also nice to figure out how long an operation has been using SSL (e.g. mtz-elektronik[dot]de is used by scammers on hacked Amazon shops since a few days).

[Double_a_92]

I think their argument was that anybody can just copy the imprint of a legitimate business.

It doesn't stop the fraudulent "potato-shop.de" from trying to look like the real "potatoshop.de".

[CorrectHorseBat]

Fraudulent websites could just add fake/copied information, no? A special domain doesn't have that issue.

[Kovah]

Oh they do copy this information! I became victim of such a fraud because the whole website looked really legitimate to me, and I am the "tech guy" in our family. Thing is: fraudsters create good looking websites and just copy all the company information from other stores, put in a non-working telephone number and email and they are good to go. There are thousands of small businesses that sell stuff online.

One would argue that there is a Handesregistereintrag (record of commerce at the officials) that might help, but it only contain information about the seller including contact details and what the does, and not domains. And the record is not needed for small businesses.

TLDR: Germany seems to have hurdles for fraudsters, but they are easily taken by simply copying information from legit stores.

[moooo99]

Yes copying that information is obviously fairly easy and allows the scammer to make at least short term legit looking websites.

Adding the legit domains to the Handelsregister doesn’t seem like the worst idea to me. However, as the digital access to government services is still basically non-existent this would lead to a whole lot of additional bureaucracy and slowed down processes.

[fragmede]

some PKI would prevent copying, the same way that no one else can pretend to be https://Google.com

[TheOtherHobbes]

There are political edge cases.

Let's say I set up a site that's critical of an authoritarian government. I fund it with sales of merch and books and such.

I want to be anonymous - for obvious reasons - but if I have to register my details I can't be.

Also, accountability doesn't work without international authority. Some countries are more enthusiastic about accountability and the rule of law than others, and the ones who aren't can make money by selling "credible" domains to bad actors.

Of course after a while those domains will become less credible. But there are a lot of TLDs out there now, which makes the system very difficult to police without international cooperation.

In reality I can run a scam operation from a beach in Thailand, bank the money, shut it down, then run a very similar scam operation from a beach in Vietnam or Costa Rica. That won't change until there's some kind of international cyberpolice agency which will hunt me down across borders.

But then you get the anonymity problem.

Not simple, and no registration system will fix this.

[FortiDude]

I mean, if you sell stuff on the internet I should be able to make sure you're an actual reachable entity with legal responsibility.

Now, it they made it into a standard that could be included into the browser's UI...

[moooo99]

Yes, I do think it’s absolutely sensible to make something like this mandatory for people who sell stuff or have some kind of commercial interest.

However, the law is pretty unclear about what is considered commercial interest. This effectively leads to the situation where basically any site of any kind is expected to have an imprint or otherwise, you can expect to get a nice and expensive writing from a lawyer.

[Double_a_92]

It shouldn't be mandatory. You should just be able to attach all your domains to your entry in the commercial register.

Then browsers could query it and show that's it legitimate.

But it's probably really hard to implement for technical and legal and organisational reasons.

[steve_taylor]

To register a .com.au or .net.au domain, you have to provide your ABN (Australian Business Number). The problem with that, however, is you don't have to prove you have the authority to do so. You can enter any business's ABN.

[stevewatson301]

The path to an China-esque ICP recordal system.

[TobbenTM]

Some countries do _kinda_ have this, for registering `.no` domains you need to be a Norwegian citizen or do it through a Norwegian company. Not sure how much that actually helps tho?

[mellavora]

Even better, let's get rid of names as identifiers. We all know names are problematic.

We could use government-issued tokens, maybe on a government-run blockchain.

And we could use the same for our personal (corporate) selves, such that all of our economic interactions were moderated through a government-run identity blockchain.

I want the mark on my forehead please, not the wrist, so I can pay by bowing my head to the money-god instead of just laying my wrist on the sensor.

What could possibly go wrong?

[FortiDude]

A database of businesses already exists.

Businesses usually have domain names just like they have physical addresses.

If the database were to include the domain names we could make automatic checks to give the user more assurances.

Your reply is mind boggling and totally foreign to the topic.

[EDEdDNEdDYFaN]

What database are you referring to? Is there an international database for all businesses registered in every single country that everyone universally signs up for when they incorporate?

[FortiDude]

Every nation has its own. Nations that want to make their citizens safer when surfing the web could open up a standard API to make such automated queries

[prox]

That would be a great idea.

[NavinF]

In practice consumers just go straight to Amazon because they're afraid of the wider internet and depend on the return policy to save them when they get scammed. Doubt any "opt-in validation, ring of trust, p2p feedback and rating" will change that in the next decade.

[leveraction]

This and the fact that they have your cc and shipping already on file, which makes things a lot easier. More than once I have found a product on some site and then purchased it from Amazon just because it is so much easier.

[Krisjohn]

That’s kind of what antivirus web plugins do