3 ms·
Worse, websites will redirect you to a different domain as part of their normal process. For example, in the UK, the Lloyds Bank main website is lloydsbank.com
by rlpb 11y ago
Worse, websites will redirect you to a different domain as part of their normal process.
For example, in the UK, the Lloyds Bank main website is lloydsbank.com, but click (on their insecure page) for online banking logon and you're taken to https://online.lloydsbank.co.uk https://online.lloydsbank.co.uk.
The main website for another UK bank, NatWest, is on natwest.com (it redirects to http://personal.natwest.com http://personal.natwest.com), but click for online banking and you're taken to a page on https://www.nwolb.com https://www.nwolb.com
Telling users to check the domain is useless, since legitimate sites condition users to ignore it.
EV certificates do fix this to some extent, but users are not conditioned to check these, and it domain-validated certificates just complicate matters for them.
I would prefer to see legislation that mandates security standards for entities that handle personal data. In the UK, secondary legislation against an amended Data Protection Act that mandates EV certificates would work well for this, IMHO. This won't help the Internet at large, but would at least help condition UK users to know what to check.
- deanclatworthy 11y agoI'd love to see EV certificates everywhere, and cheap enough that made them practical for small business owners who collect minimal personal information. Should you really need an EV certificate to have a newsletter sign up form? Probably not, but I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year [0] for the privilege. But absolutely, anyone storing serious personal information (credit cards, banking information, social security numbers) should be required by law to have an EV cert. [0] https://www.geotrust.com/uk/ssl/ https://www.geotrust.com/uk/ssl/
- rlpb 11y agoMy issue with that is the users no longer know what to check - having two types of certificates is confusing. I'd be happy if you used domain-validated SSL but browsers didn't make any claims about the security of connections without the EV cert though. For me this means no padlock icon whatsoever. After all - from the perspective of an ordinary user who cannot verify your domain, it is insecure. Edit: how about "No claims about security to be presented to the user without EV certificates"?
- dublinben 11y agoThe connection to a website with a DV certificate is certainly secure, it just isn't authenticated. TLS is designed to provide both, and EV follows through on that second promise.
- rlpb 11y agoThis is a question of semantics - one that everyday users don't care about. To them, unauthenticated is insecure.
- dublinben 11y agoI guess it was impossible to have a secure session before the introduction of EV in 2007 then. I guess all these https sites (this one included) have been fooling me all along, with their fake secure connections.
- nailer 11y agoWell yeah, you could register a domain validated cert for hotmaillogin.com, or for ..company.com (and then register hotmail.com.company.com) at the time just fine, and plenty of people did.
- nailer 11y agoTo me, encryption without proof of identity isn't secure. But as the other poster notes, this is semantics.
- nailer 11y agoMicrosoft Edge shows a hollow grey lock for DV certs: https://certsimple.com/blog/dv-ssl-in-microsoft-edge https://certsimple.com/blog/dv-ssl-in-microsoft-edge
- nailer 11y ago> I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year for the privilege. CertSimple is run from London, 150 quid a year, and delivers EV certs faster than anywhere in the world - an average of 5 hours, rather than the industry standard 7 to 10 days'. it also has an 80 second request process without software installation or terminal Q and A: https://certsimple.com https://certsimple.com