3 ms·

The use-case for proving integrity is different from the use-case for proving both integrity and identity, thus the UI should be different as well.

• closeparen 10y ago
  This attack should work on EV too. Register a company with PayPal in its name in some small country. There is no "avoid name conflicts between companies" system with as much reach as the Internet itself.
  • bravura 10y ago
    Then browsers don't need to accept EVs from small countries that don't adhere to a certain level of common decency.
  • tonyztan 10y ago
    That's why the EV indicator includes the 2-letter country code. "PayPal, Inc. [RO]" would be displayed instead of "PayPal, Inc. [US]".
    • closeparen 10y ago
      Would you notice? There's so much crap in company suffixes, I probably wouldn't. This attack also requires the user to ignore the suffix.
      • nailer 10y ago
        I'd support using flags or full names rather than country codes here, they're much more distinct.
      • tonyztan 10y ago
        That's a good point. Browsers could definitely have better UI to highlight this information to users.