Amazon has been investigated for selling dangerously defective electrical products.[1] But they've been allowed to sleaze by, claiming that some anonymous seller is the problem.
[1] https://www.wsj.com/articles/amazon-has-ceded-control-of-its...
Amazon has been investigated for selling dangerously defective electrical products.[1] But they've been allowed to sleaze by, claiming that some anonymous seller is the problem.
[1] https://www.wsj.com/articles/amazon-has-ceded-control-of-its...
Did DV certs really require personal info before? I thought that was only ever EV.
> The domain registrar industry failed us, supporting "domain privacy" for businesses.
They didn't fail, they decided that maybe publishing the home address of every site owner was maybe actually a terrible idea and a huge privacy issue.
> Then Amazon allowed sellers to be anonymous while claiming that Amazon itself was not the seller.
That feels unrelated, but: Then get a court order and force the issue.
California law: (B&P code 17538).
(1) Before accepting any payment or processing any debit or credit charge or funds transfer, the vendor shall disclose to the buyer in writing or by electronic means of communication, such as e-mail or an on-screen notice, the vendor’s return and refund policy, the legal name under which the business is conducted and, except as provided in paragraph (3) (which is about PO boxes), the complete street address from which the business is actually conducted.
Not even in the European Union. In fact, especially not in the European Union. One of the principles of the Single Market is that you can't escape liability by operating in a different country within the Union.[1]
"Definitions ... (b) "service provider": any natural or legal person providing an information society service; ...
General information to be provided
1. In addition to other information requirements established by Community law, Member States shall ensure that the service provider shall render easily, directly and permanently accessible to the recipients of the service and competent authorities, at least the following information:
(a) the name of the service provider;
(b) the geographic address at which the service provider is established;
(c) the details of the service provider, including his electronic mail address, which allow him to be contacted rapidly and communicated with in a direct and effective manner;"
[1] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...
In the current era, the situation is that there are three acknowledged categories of certificates in the Web PKI (and thus trusted by an out-of-box web browser): EV, OV and DV. These are all defined by the Baseline Requirements, published by the CA/Browser Forum: https://cabforum.org/baseline-requirements-documents/
The BRs specify that certain characteristics of the X.509 Subject (e.g. a postal address) must be present in each category and if present they must be verified by some particular means. PKIX adds Subject Alternative Names SANs†, to reflect the Internet's idea about how to name things (e.g. Fully Qualified Domain Names), and in the modern era the BRs specify methods by which Certificate Authorities may verify those names belong to the applicant. I like to call these the Ten Blessed Methods, although today there are no longer ten of them.
In the prior era from about 2012 to 2017, things were similar except that the BRs said that any CA could verify SANs using "Any other method" of the CA's choosing. In practice this meant the methods in actual use were often inadequate and sometimes outright laughable.
Before that era, the CA/B rules didn't exist. Certificate Authorities occupied in effect a Wild West, having either been specialists providing X.509 certificates in other applications like the financial sector or else created specifically for this purpose. They did whatever they wanted. At first, they charged a lot of money for certificates full of details from the X.500 system. What was the full street address of your organisation? There was no systematisation, so given a certificate it would be a job for a forensic expert to decide what, if anything, could be said to be true about the subject and why. This worked OK when there were only a few dozen companies even bothering to use Netscape's new fangled HTTPS feature to secure credit card transactions. But if you can make $1000 selling one certificates to a bank, how about making $2000 by selling twenty $100 certificates to big commercial outfits keen to explore the possibilities for "Commerce on the Information Superhighway" ? Of course for $100 each you can't expect to check their street address. Let's just write the company's name, and "Verified".
So no, the answer to your question is that "DV Certificates" were never required to have personal info, but that's mostly because no certificates were in a sense required to fill that out, the rules about this stuff come after the de facto existence of DV certificates is driven by a race-to-the-bottom free market.
As to the Domain Registrars, for many of the TLDs we care about the registrar is, or is ultimately sanctioned by, a sovereign entity. Just as with Birth Registration, or Ship Registration, if you've got a problem with the way one country does it, take it up with that country, it's their business not yours.
In the UK for example businesses even those which are just a single person working under their name (such as my sister) are legally required to provide a postal address for their UK domain registration. Are some of them fake? Probably, lots of information in our legally required business register is fake, so that would be expected, but it is the law for whatever that's worth.
† Importantly, SANs are not an "alias". All certificates in the Web PKI have at least one SAN. Certificate Auhorities can, and as far as I know all do choose to write one of the names from a SAN as text into the X.509 Subject Common Name (CN) field. But that field is a legacy of the X.500 directory system that has been obsolete for decades, it's a plausible choice to display to a human because it's guaranteed to be human readable, for any other purpose it's definitely wrong.
[1]https://scotthelme.co.uk/extended-validation-not-so-extended...
The WHOIS database is an absolutely terrible idea that needs to die as soon as possible. This should have been a proxy service from the beginning. I don’t care if ICANN knows where I live so they can forward abuse mail but they should have never published this info to the public.