3 ms·
My issue with that is the users no longer know what to check - having two types of certificates is confusing. I'd be happy if you used domain-validated SSL but
by rlpb 11y ago
My issue with that is the users no longer know what to check - having two types of certificates is confusing.
I'd be happy if you used domain-validated SSL but browsers didn't make any claims about the security of connections without the EV cert though. For me this means no padlock icon whatsoever. After all - from the perspective of an ordinary user who cannot verify your domain, it is insecure.
Edit: how about "No claims about security to be presented to the user without EV certificates"?
- dublinben 11y agoThe connection to a website with a DV certificate is certainly secure, it just isn't authenticated. TLS is designed to provide both, and EV follows through on that second promise.
- rlpb 11y agoThis is a question of semantics - one that everyday users don't care about. To them, unauthenticated is insecure.
- dublinben 11y agoI guess it was impossible to have a secure session before the introduction of EV in 2007 then. I guess all these https sites (this one included) have been fooling me all along, with their fake secure connections.
- nailer 11y agoWell yeah, you could register a domain validated cert for hotmaillogin.com, or for ..company.com (and then register hotmail.com.company.com) at the time just fine, and plenty of people did.
- nailer 11y agoTo me, encryption without proof of identity isn't secure. But as the other poster notes, this is semantics.
- nailer 11y agoMicrosoft Edge shows a hollow grey lock for DV certs: https://certsimple.com/blog/dv-ssl-in-microsoft-edge https://certsimple.com/blog/dv-ssl-in-microsoft-edge