Free Canon camera hire

[gcluer]

I am told that this is genuine though I haven't checked it myself. If it is genuine I am sure some members would be interested.

https://canon-testdrive-uk.hireacamera.com/en-gb/

[Mike Farley]

It looks genuine to me. The website certificate has been registered by Amazon and it appears to be a campaign that is being run by "Hire a Camera" on behalf of Canon. Which makes sense as I doubt Canon has the resources to do this all by itself and like all manufacturers, I would be surprised if sales are not substantially down. It gives potential customers the chance to handle the gear which is not possible in a shop at the moment. Cameras are too expensive for most to buy on a whim. Other companies have had similar promotions. I once borrowed an Olympus E-M1 for a few days with a comparable scheme and Fuji has been running something simiilar. With this Canon deal, availability is limited in some instances, especially for the EOS R.

[Peter Boughton]

The website certificate has been registered by Amazon

The certificate has been issued by Amazon to a user of AWS (Amazon's hosting platform), for the domain hireacamera.com and its subdomains.

AWS certificates are granted automatically and do not involve any verification by Amazon of the user requesting it - this is not abnormal, but it's not proof of anything either.

Standard certificates are a rough indication that, the server your browser is communicating with matches the domain name you're visiting, and the communications between your browser and the server are not being eavesdropped on or tampered with (<disclaimer>except potentially by a limited subset of organisations</disclaimer>).

For an certificate to be evidence of a company being genuine, it needs to be an Extended Validation certificate - meaning a certificate authority has taken payment from someone, and the identity of the owner has been verified by a human. (These are fairly uncommon now, but an example can be seen by visiting https://www.scan.co.uk/ - depending on if/how the browser used highlights the difference, which does vary.)


In this case, evidence that the company is genuine is provided by the company having a record in Companies House which identifies their domain, dates back to 2003, with an address that matches their contact details and the contact page has a phone number with the correct area code.

Final proof is obtained by visiting the source page on Canon's website - https://www.canon.co.uk/testdrive/ where the "Book a test drive now" button links to the the above site.

­

[Mike Farley]

The website certificate has been registered by Amazon

The certificate has been issued by Amazon to a user of AWS (Amazon's hosting platform), for the domain hireacamera.com and its subdomains.

AWS certificates are granted automatically and do not involve any verification by Amazon of the user requesting it - this is not abnormal, but it's not proof of anything either.­

I find it astounding that someone can purchase a certificate without any proof of domain ownership on the part of the requester. It does seem like a system which is open to abuse by the unscrupulous.

[Mike Farley]

I would be surprised if sales are not substantially down.

Amateur Photographer has been running a series during lockdown which reports how various camera stores are faring. Previous retailers have been cagey as to what is going on, but London Camera Exchange has been more forthcoming. There is no mention of new camera bodies, but LCE reckons it is still selling other equipment.

https://www.amateurphotographer.co.uk/l ... eat-137490

[Peter Boughton]

...
AWS certificates are granted automatically and do not involve any verification by Amazon of the user requesting it - this is not abnormal, but it's not proof of anything either.­

I find it astounding that someone can purchase a certificate without any proof of domain ownership on the part of the requester. It does seem like a system which is open to abuse by the unscrupulous.

I was a little lax with wording in that sentence - what I meant is that it is not proof of a website/offer being genuine. Obtaining a certificate does require control of the domain/server, at the point in time of the certificate being requested/issued, but doesn't confirm ownership (like the EV certificate does).

For example, if a scammer managed to break into the hireacamera systems, they could setup a sub-domain and receive a certificate for it (or re-use the primary wildcard certificate), then spread the link and presumably be gathering people's payment details - until the true owner was warned and resolved the issue.

To be clear, that is not the situation here, just an example of why unusual links shouldn't be trusted until they can be verified as coming from a legitimate source.
(In this case, the Canon website provides that legitimacy, so long as you trust the Canon servers haven't been compromised.)

­

[Mike Farley]

Hi Peter

Your revised explanation makes sense, otherwise the certifcates would serve no effective purpose and scammers would have a field day. I have never doubted the authenticity of the offer. Thanks for the update.