I don't see how 'bad guys' are helped by having a working cert for 1-2-3-4.weirdacronym.io

Would you care to elaborate?

They could get a free cert other places, and even look like a real domain.

They would have gotten a valid certificate that couldn't be tied in anyway to their identity.

Coupled with e.g. a XSS vuln on a secured website, you could serve a nasty browser exploiting payload from a secure site, without any warning such as "this page is trying to load stuff from an unsecure site".

This in only one scenario, there are others. This really was pretty bad.

Free certs are tied to your identity?

More than having the IP?

SSL is not the place to enforce content restrictions.

Not even the paid certs that most people buy are tied to identity. Those only validate control of the domain (usually by having you whack some garbage into a DNS TXT record).

Yet another reason why the SSL PKI is a scam and a racket.

By proving control of the domain, there is a link between the certificate and the person asking for it thru the registrar. And thru the payment information to the registrar, you can usually get to someone.

It's a tenuous link, but a lot better than no link at all. At times enough for law enforcement to follow the tracks.

(edit since we reached maximum comment depth) Control of an IP address doesn't mean trackable ownership of it, you could use any machine your just compromised and instantly have a valid certificate for it. Delays in certificate issue add a thin layer of security, even if you gained unlegitimate control of a domain, the interval before asking and getting a certificate offers an opportunity for the intrusion to be detected and remediated.

Instant valid certificate for any IP address you happen to compromise is really quite bad.

Unless it's a free (sub)domain.

Why can't you do the same sort of tracking down if you have an IP?

Anything you pay for is ultimately traceable, at least by law enforcement, unless you're using a stolen credit card or a BTC tumbler. And even then, depending on the effort they're willing to invest, investigators could probably track the sale of the credit card number to you, notice that the BTC tumbler was pretty quiet when your money came out of it and there's only a couple of possible Coinbase accounts responsible, etc.

Paying for an SSL cert does make people a bit more accountable, but I'd argue that that's a bug rather than a feature.

Dylan, that was our thinking exactly--the URL would look unbelievably fake.

Dylan, that was our thinking exactly--the URL would look unbelievably fake.