The comment made about domain names not being trustworthy is why I like EV-certificates. Some people (notably google) argue that EV-certificates add very littl

The comment made about domain names not being trustworthy is why I like EV-certificates. Some people (notably google) argue that EV-certificates add very little of value because the user can just as easily check the domain name. Thing is, I could probably get some paypal or google like domain. Even if I can't, I could use a data URI as in [1] to put https://google.com https://google.com in the address bar. Compare that to EV. To get a browser to display google (or googel, or paypal), I'd need to convince a CA to issue such an EV cert. Whilst that might not be impossible, it takes something close to a state-level actor. A lot of phishers operate below that level. What EV gives over the domain name is a fully CA controlled part of the UI. Whilst the address bar is the 'zone of death by phisher' the EV bar is the 'zone of death by CIA/KGB'. [1] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/ https://www.wordfence.com/blog/2017/01/gmail-phishing-data-u...