3 ms·
Not with CT and pinning.
by verroq 10y ago
Not with CT and pinning.
- mjevans 10y agoAt that point why have EV instead of actually doing real security and prompting the user to verify the certificate (and remembering what they approved)?
- thesimon 10y agoI don't think my mother knows how to verify the certificate and certificate chain.
- Kadin 10y agoUnless your mother knows not to go to a site without an EV certificate, it doesn't really matter that much. The certificate pinning is valuable in terms of preventing MITMs by rogue CAs, but the EV itself doesn't seem to really add much.
- stephenr 10y ago> Unless your mother knows not to go to a site without an EV certificate "Make sure it says <company name> in green at the top" is much easier than "ok now check any intermediary certs, and of course make sure they have the right fingerprint"