4 ms·

There's a shift happening in the browser space as well to "downgrade" the UI for DV certs, much less green locks and bars and more gray and no red security warn

There's a shift happening in the browser space as well to "downgrade" the UI for DV certs, much less green locks and bars and more gray and no red security warnings. We're entering a world where every site has a DV cert (most likely for free with registering a domain) but that all of the things for which we now consider "needing SSL" will require an EV cert.

mikeash 11y ago
As long as browsers don't start popping up scary warnings about submitting forms to a site that only has DV certs, I think it'll be fine.
- nandhp 11y ago
  And hopefully soon they can pop up scary warnings for unencrypted sites.
- oberstein 11y ago
  And as long as they do pop up scary warnings when the DV certificates change possibly due to a MitM attack it'll be even more fine.
angelbob 11y ago
I'm looking forward to that world.
ehPReth 11y ago
Firefox recently changed DV from gray to green: https://blog.mozilla.org/security/2015/11/03/updated-firefox-security-indicators-2/ https://blog.mozilla.org/security/2015/11/03/updated-firefox...
raesene4 11y ago
EV certs will only make sense (for the vast majority of sites) when consumers start actually recognizing the difference between EV and DV, personally I don't see that happening real-soon as many non-technical consumers don't even notice if there's no SSL cert at all... Ask yourself do you remember what sites use EV certs and would you notice if one had a DV instead... if you wouldn't ask yourself why a company would pay more money for that EV cert, when they can get a perfectly good DV one for free
nailer 11y ago
Yes and no: - Safari uses a grey lock for DV certs - Edge uses a hollow grey lock for DV certs - Mozilla launched Let's Encrypt, and then changed DV certs from grey to green in Firefox. - Chrome still uses green for DV and hasn't changed
- eeZi 11y ago
  Chrome downgraded to plain gray for mixed content though.
  - lathiat 11y ago
    it's not really a downgrade though, because it used to throw a yellow exclamation warning about not being secure which was problematic.

mikeash 11y ago

As long as browsers don't start popping up scary warnings about submitting forms to a site that only has DV certs, I think it'll be fine.

nandhp 11y ago
And hopefully soon they can pop up scary warnings for unencrypted sites.
oberstein 11y ago
And as long as they do pop up scary warnings when the DV certificates change possibly due to a MitM attack it'll be even more fine.

angelbob 11y ago

I'm looking forward to that world.

ehPReth 11y ago

Firefox recently changed DV from gray to green: https://blog.mozilla.org/security/2015/11/03/updated-firefox-security-indicators-2/ https://blog.mozilla.org/security/2015/11/03/updated-firefox...

raesene4 11y ago

EV certs will only make sense (for the vast majority of sites) when consumers start actually recognizing the difference between EV and DV, personally I don't see that happening real-soon as many non-technical consumers don't even notice if there's no SSL cert at all... Ask yourself do you remember what sites use EV certs and would you notice if one had a DV instead... if you wouldn't ask yourself why a company would pay more money for that EV cert, when they can get a perfectly good DV one for free

nailer 11y ago

Yes and no: - Safari uses a grey lock for DV certs - Edge uses a hollow grey lock for DV certs - Mozilla launched Let's Encrypt, and then changed DV certs from grey to green in Firefox. - Chrome still uses green for DV and hasn't changed

eeZi 11y ago
Chrome downgraded to plain gray for mixed content though.
- lathiat 11y ago
  it's not really a downgrade though, because it used to throw a yellow exclamation warning about not being secure which was problematic.