4 ms·
Ooh! So that's where they stashed it. But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? Earlier, you coul
by dingo_bat 9y ago
Ooh! So that's where they stashed it. But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? Earlier, you could click on the https part of the address bar and it would show you the certificate details.
- deathanatos 9y agoNo, I don't really expect an average Joe to check certificate details. Explaining certificates to developers is hard enough — I can't imagine trying to get an average joe to comprehend it. What details would they realistically look at, anyways? If the certificate validates, that's an automated check of most of the interesting bits. But the first thing in my dialog, for example, is the subject, which is garbage for many DV certs. Then there's the difference between CN and subjectAltName…
- vtlynch 9y ago>But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? The browser does this for you. Chrome (and all major browsers) have a certificate validation that parses the hostname in the certificate and compares it to the site you are on. Checking certificate details manually is primarily useful for troubleshooting. It serves little to no security benefit for 99% of users.