Hacker News Reader

Comment by Scoundreller | Hacker News Reader

You can also go after their ssl certificate provider if they have one. Doesn’t always work but it has at least once for me.

Unfortunately I’ve also observed a lot of Canadian phishing links will geo-redirect, so reporting them can sometimes go nowhere unless the checker uses the right vpn.

View on HN

They almost all use LetsEncrypt, which has a documented policy of not terminating accounts for spam/fraud.

Gross. Why?

They have a published policy that explains it:

https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Because it’s not their problem and would set a bad precedent

Their arguments are the same that any other layer involved could use to sit it out.

“We shouldn’t be the police, let some layer above or below us be the police, just anyone but us!”

What they don’t really say is that an abuse team costs money to run.

When self-regulation doesn’t work, you risk ending up with legally-imposed regulation. I’m sure that will really delight them.

Ssl is like the lowest on the chain. You have the domain registrar and the end host and perhaps cloudflare in the middle - and for phishing the mail starting point. All of these are better choices to report abuse than let’s encrypt provided free ssl that’s open for any one to use. I would place that at the level of a phishing site using nginx who could realistically add code to block a list of phishing domains somewhere in their code because it might be used by phishing sites - just no.

Reply on news.ycombinator.com