Erik van Straten on Nostr: nprofile1q…nh9qy : non-ACME certs suck big time. However, now the internet has ...

nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpq8yve5f33hyqq35t3y3xu72t9x33pfdznd0kq78lf73wkxchzr5hs8nh9qy (nprofile…h9qy) : non-ACME certs suck big time.

However, now the internet has turned into a malicious phishing mess.

People can no longer determine who is responsible for a website, and nobody cares.

Google hosted fake websites (using ACME certs from Let's Encrypt) on their cloud servers called:
• cancel-google[.]com
• adsupport-google[.]com
• helpdesk-google[.]com

See (Dutch) https://infosec.exchange/@ErikvanStraten/113837934294209517.

Google also doesn't give a fsck about HSTS, see https://infosec.exchange/@ErikvanStraten/113856108585517842.

Worse, last year a phishing site with a domain name containing "google" was proxied by Cloudflare - and had a "GOOGLE TRUST SERVICES" DV certificate.

Did I mention that browsers suck and that Big Tech, making Big Money, is knowingly complicit to cybercrime?

And did I mention that certificates were not invented to please admins?

#Phishing #DV #GoogleIsEvil #BigTechIsEvil #GTS #BrowsersSuck #AnonymousWebsites