219

Also, congrats

I was able to create several ht.ly URLs without a Hootsuite or Twitter account, but HTTPS URLs or those pointing to a domain-level index were rendered as simple redirects. A couple of Youtube videos and a Wikipedia article were rendered in the ht.ly iframe with the social bar.

I agree that in principle using an iframe for this purpose (including added-value content like an ad or a social media bar) is a bad idea. Showing the URL in the title is inadequate (Chrome users won’t even see this if they are busy browsers).

The more I think about it the less I like the idea of these short URL services cloaking URLs like this. If I’m not mistaken the browser security model permits a document in an iframe to modify the location property of the parent viewport (this is the Ajax iframe XSS technique in reverse); from keyboardcowboy.ca you could set the parent fragment identifier to #https://www.facebook.com/. In my mind the less-observant user who would be confused by this type of phishing attack could be further reeled in this way.

Seems to me the social sharing functionality of the ht.ly bar is better implemented with a browser add-on, bookmarklet, or AddThis-type widget. Oh well.

And then there is the problem of who owns the root key. Currently that will be the Team America World Police, excuse me, USA government. You may not care, but the other 95% of the world does. Though Americans not caring about that is curious because you appear to prefer to trust unaccountable private enterprises over that very same government. Maybe now that they’ve shown themselves to like being unaccountable themselves (warrantless this, warrantless that) you’ve started to trust them?

The message here is that too many techies wilfully ignore the political mess they’re making. And it’s going to bite us all in the behind. So please be a bit more considerate before you open your yap. Can’t expect that from Danny boy, unfortunately.

Once upon a time, all SSL CA’s did all elaborate validation of documentation. I remember having to fax in a document with driver’s licenses on company letterhead, etc. Maybe not bulletproof, but humans actually used to read these things for every request.

Making someone pay extra to opt in to more validation doesn’t solve the problem at all. The base standard has to be raised, but there doesn’t seem to be any incentive for CA’s to do the extra work. They’re not generally impacted in the case of succesful fraud, I don’t think I’ve seen any browsers pulling CA root certs because of lax practices, so they’re going to compete for the best profit margin for the lowest reasonable price, which means more automation and less validation. (and thus a weaker overall PKI for everyone)