3 ms·
The only real protection from this is to verify that the SSL icon is displayed in the address bar, and that the domain is the domain you expected. It's a shame
by Flimm 11y ago
The only real protection from this is to verify that the SSL icon is displayed in the address bar, and that the domain is the domain you expected. It's a shame more websites don't educate users to do this.
This gives me an idea for a Javascript widget that guides users to verify the address bar, with an appropriate demonstration screenshot based on the expected domain, and the user's browser.
- rlpb 11y agoWorse, websites will redirect you to a different domain as part of their normal process. For example, in the UK, the Lloyds Bank main website is lloydsbank.com, but click (on their insecure page) for online banking logon and you're taken to https://online.lloydsbank.co.uk https://online.lloydsbank.co.uk. The main website for another UK bank, NatWest, is on natwest.com (it redirects to http://personal.natwest.com http://personal.natwest.com), but click for online banking and you're taken to a page on https://www.nwolb.com https://www.nwolb.com Telling users to check the domain is useless, since legitimate sites condition users to ignore it. EV certificates do fix this to some extent, but users are not conditioned to check these, and it domain-validated certificates just complicate matters for them. I would prefer to see legislation that mandates security standards for entities that handle personal data. In the UK, secondary legislation against an amended Data Protection Act that mandates EV certificates would work well for this, IMHO. This won't help the Internet at large, but would at least help condition UK users to know what to check.
- deanclatworthy 11y agoI'd love to see EV certificates everywhere, and cheap enough that made them practical for small business owners who collect minimal personal information. Should you really need an EV certificate to have a newsletter sign up form? Probably not, but I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year [0] for the privilege. But absolutely, anyone storing serious personal information (credit cards, banking information, social security numbers) should be required by law to have an EV cert. [0] https://www.geotrust.com/uk/ssl/ https://www.geotrust.com/uk/ssl/
- rlpb 11y agoMy issue with that is the users no longer know what to check - having two types of certificates is confusing. I'd be happy if you used domain-validated SSL but browsers didn't make any claims about the security of connections without the EV cert though. For me this means no padlock icon whatsoever. After all - from the perspective of an ordinary user who cannot verify your domain, it is insecure. Edit: how about "No claims about security to be presented to the user without EV certificates"?
- dublinben 11y agoThe connection to a website with a DV certificate is certainly secure, it just isn't authenticated. TLS is designed to provide both, and EV follows through on that second promise.
- rlpb 11y agoThis is a question of semantics - one that everyday users don't care about. To them, unauthenticated is insecure.
- dublinben 11y agoI guess it was impossible to have a secure session before the introduction of EV in 2007 then. I guess all these https sites (this one included) have been fooling me all along, with their fake secure connections.
- nailer 11y agoWell yeah, you could register a domain validated cert for hotmaillogin.com, or for ..company.com (and then register hotmail.com.company.com) at the time just fine, and plenty of people did.
- nailer 11y agoTo me, encryption without proof of identity isn't secure. But as the other poster notes, this is semantics.