4 ms·

The blame is misplaced. DV certificates were never meant to protect against phishing. Chrome is just doing it wrong. In my opinion, there should be no padlock,

The blame is misplaced. DV certificates were never meant to protect against phishing. Chrome is just doing it wrong. In my opinion, there should be no padlock, no visual indicators that a connection is secure for DV certs. The enduser doesn't have to know a website uses HTTPS. The padlock should only show up (along with the company name) when the website uses an EV certificate.

matt4077 10y ago
That would imply that there is no security benefit whatsoever provided by a DV certificate. To prove that DV certificates are usually seen as "better than nothing", just consider the difference browsers make in their treatment of self-signed certificates. I'm also in the position of running a small online business on the side, and such a change would almost certainly require and upgrade to an EV certificate. While we have thought about it (and I have tried to find some data on changes in conversion rates possibly coming from it), I haven't quite been able to convince myself that the costs and hassle are worth it. The process may be prohibitively expensive in some countries, or for some very small operations. Maybe it's time to think about improvements to identity-verifying certificates. Either by improvements to the process towards automation, or maybe another certificate class relying on a reputation system for judging trustworthiness.
- lfam 10y ago
  > That would imply that there is no security benefit whatsoever provided by a DV certificate. The security benefit is that the connection to the server is authenticated and encrypted. Nobody in between can inspect or mutate the data. This is a huge win over unauthenticated HTTP.
- tokenizerrr 10y ago
  > I haven't quite been able to convince myself that the costs and hassle are worth it. Have you ever heard a regular user talk about the URL bar not being green?
  - matt4077 10y ago
    No, but then again the URL bar's color rarely comes up when I do smalltalk. I've also never heard anybody in real life mention the size or color of "order" buttons, but I have pretty reliable data that even among choices that will seem to be completely reasonable, some will convert at 3x the rate of others.
bramblerose 10y ago
Not just chrome, also Paypal, which allows basically unlimited access to your account with just a username and password.
- Neliquat 10y ago
  I wish. I don't even have unlimited access to my own account. Paypal sucks both ways.
randoramax 10y ago
I agree the blame is misplaced. Browsers should do a better job at highlighting scammy sites. There is a counter-argument on http://www.thewhir.com/blog/web-encryption-needs-the-freedom-to-grow-but-new-policy-threats-are-emerging http://www.thewhir.com/blog/web-encryption-needs-the-freedom...
pfg 10y ago
Chrome's long-term plan is to show no visual indicator for (valid) HTTPS, and a non-secure indicator for HTTP[1], so that's essentially what you're describing. IIRC Firefox has similar plans. HTTPS deployment numbers don't quite allow for that yet. [1]: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...

matt4077 10y ago

That would imply that there is no security benefit whatsoever provided by a DV certificate. To prove that DV certificates are usually seen as "better than nothing", just consider the difference browsers make in their treatment of self-signed certificates. I'm also in the position of running a small online business on the side, and such a change would almost certainly require and upgrade to an EV certificate. While we have thought about it (and I have tried to find some data on changes in conversion rates possibly coming from it), I haven't quite been able to convince myself that the costs and hassle are worth it. The process may be prohibitively expensive in some countries, or for some very small operations. Maybe it's time to think about improvements to identity-verifying certificates. Either by improvements to the process towards automation, or maybe another certificate class relying on a reputation system for judging trustworthiness.

lfam 10y ago
> That would imply that there is no security benefit whatsoever provided by a DV certificate. The security benefit is that the connection to the server is authenticated and encrypted. Nobody in between can inspect or mutate the data. This is a huge win over unauthenticated HTTP.
tokenizerrr 10y ago
> I haven't quite been able to convince myself that the costs and hassle are worth it. Have you ever heard a regular user talk about the URL bar not being green?
- matt4077 10y ago
  No, but then again the URL bar's color rarely comes up when I do smalltalk. I've also never heard anybody in real life mention the size or color of "order" buttons, but I have pretty reliable data that even among choices that will seem to be completely reasonable, some will convert at 3x the rate of others.

bramblerose 10y ago

Not just chrome, also Paypal, which allows basically unlimited access to your account with just a username and password.

Neliquat 10y ago
I wish. I don't even have unlimited access to my own account. Paypal sucks both ways.

randoramax 10y ago

I agree the blame is misplaced. Browsers should do a better job at highlighting scammy sites. There is a counter-argument on http://www.thewhir.com/blog/web-encryption-needs-the-freedom-to-grow-but-new-policy-threats-are-emerging http://www.thewhir.com/blog/web-encryption-needs-the-freedom...

pfg 10y ago

Chrome's long-term plan is to show no visual indicator for (valid) HTTPS, and a non-secure indicator for HTTP[1], so that's essentially what you're describing. IIRC Firefox has similar plans. HTTPS deployment numbers don't quite allow for that yet. [1]: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...