3 ms·

I'd love to see EV certificates everywhere, and cheap enough that made them practical for small business owners who collect minimal personal information. Should

I'd love to see EV certificates everywhere, and cheap enough that made them practical for small business owners who collect minimal personal information. Should you really need an EV certificate to have a newsletter sign up form? Probably not, but I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year [0] for the privilege. But absolutely, anyone storing serious personal information (credit cards, banking information, social security numbers) should be required by law to have an EV cert. [0] https://www.geotrust.com/uk/ssl/ https://www.geotrust.com/uk/ssl/

rlpb 11y ago
My issue with that is the users no longer know what to check - having two types of certificates is confusing. I'd be happy if you used domain-validated SSL but browsers didn't make any claims about the security of connections without the EV cert though. For me this means no padlock icon whatsoever. After all - from the perspective of an ordinary user who cannot verify your domain, it is insecure. Edit: how about "No claims about security to be presented to the user without EV certificates"?
- dublinben 11y ago
  The connection to a website with a DV certificate is certainly secure, it just isn't authenticated. TLS is designed to provide both, and EV follows through on that second promise.
  - rlpb 11y ago
    This is a question of semantics - one that everyday users don't care about. To them, unauthenticated is insecure.
    - dublinben 11y ago
      I guess it was impossible to have a secure session before the introduction of EV in 2007 then. I guess all these https sites (this one included) have been fooling me all along, with their fake secure connections.
      - nailer 11y ago
        Well yeah, you could register a domain validated cert for hotmaillogin.com, or for ..company.com (and then register hotmail.com.company.com) at the time just fine, and plenty of people did.
  - nailer 11y ago
    To me, encryption without proof of identity isn't secure. But as the other poster notes, this is semantics.
- nailer 11y ago
  Microsoft Edge shows a hollow grey lock for DV certs: https://certsimple.com/blog/dv-ssl-in-microsoft-edge https://certsimple.com/blog/dv-ssl-in-microsoft-edge
nailer 11y ago
> I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year for the privilege. CertSimple is run from London, 150 quid a year, and delivers EV certs faster than anywhere in the world - an average of 5 hours, rather than the industry standard 7 to 10 days'. it also has an 80 second request process without software installation or terminal Q and A: https://certsimple.com https://certsimple.com

rlpb 11y ago

My issue with that is the users no longer know what to check - having two types of certificates is confusing. I'd be happy if you used domain-validated SSL but browsers didn't make any claims about the security of connections without the EV cert though. For me this means no padlock icon whatsoever. After all - from the perspective of an ordinary user who cannot verify your domain, it is insecure. Edit: how about "No claims about security to be presented to the user without EV certificates"?

dublinben 11y ago
The connection to a website with a DV certificate is certainly secure, it just isn't authenticated. TLS is designed to provide both, and EV follows through on that second promise.
- rlpb 11y ago
  This is a question of semantics - one that everyday users don't care about. To them, unauthenticated is insecure.
  - dublinben 11y ago
    I guess it was impossible to have a secure session before the introduction of EV in 2007 then. I guess all these https sites (this one included) have been fooling me all along, with their fake secure connections.
    - nailer 11y ago
      Well yeah, you could register a domain validated cert for hotmaillogin.com, or for ..company.com (and then register hotmail.com.company.com) at the time just fine, and plenty of people did.
- nailer 11y ago
  To me, encryption without proof of identity isn't secure. But as the other poster notes, this is semantics.
nailer 11y ago
Microsoft Edge shows a hollow grey lock for DV certs: https://certsimple.com/blog/dv-ssl-in-microsoft-edge https://certsimple.com/blog/dv-ssl-in-microsoft-edge

nailer 11y ago

> I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year for the privilege. CertSimple is run from London, 150 quid a year, and delivers EV certs faster than anywhere in the world - an average of 5 hours, rather than the industry standard 7 to 10 days'. it also has an 80 second request process without software installation or terminal Q and A: https://certsimple.com https://certsimple.com