5 ms·
>The only thing needed is certificates for domain control, as LE does EV certs are quite useful for special sites like banking though.
by thesimon 10y ago
>The only thing needed is certificates for domain control, as LE does
EV certs are quite useful for special sites like banking though.
- creshal 10y agoWhy? As long as there's a single rogue CA that lets people print EV certs without due diligence, the whole system is a farce.
- verroq 10y agoNot with CT and pinning.
- mjevans 10y agoAt that point why have EV instead of actually doing real security and prompting the user to verify the certificate (and remembering what they approved)?
- thesimon 10y agoI don't think my mother knows how to verify the certificate and certificate chain.
- Kadin 10y agoUnless your mother knows not to go to a site without an EV certificate, it doesn't really matter that much. The certificate pinning is valuable in terms of preventing MITMs by rogue CAs, but the EV itself doesn't seem to really add much.
- stephenr 10y ago> Unless your mother knows not to go to a site without an EV certificate "Make sure it says <company name> in green at the top" is much easier than "ok now check any intermediary certs, and of course make sure they have the right fingerprint"