4 ms·

> I'm a company that needs to show the company name next to the padlock Does anyone actually look at or care about that?

cpncrunch 9y ago
Yes, everyone who cares about their security when using online banking.
rocqua 9y ago
See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-certificate/ https://www.troyhunt.com/journey-to-an-extended-validation-c...
- snuxoll 9y ago
  It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.
  - ori_b 9y ago
    > Nobody notices the lack of EV on amazon.com, because, well, it's Amazon. Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.
    - Ermenwyr 9y ago
      amazoone.com actually redirects to www.amazon.com, as do amazoon.com, aamazon.com, and amezon.com. It seems like finding a domain name that is "close" to amazon.com that is not already registered by Amazon is not that easy.
- tonyztan 9y ago
  We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.
  - duskwuff 9y ago
    > We need an 'Expect-EV' header, just like 'Expect-CT'. What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it. > Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses. Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)
    - tonyztan 9y ago
      > What good would that header do? It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful. >EV certificates are not available to everyone. I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable. >how do you enforce a requirement like that If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.
reificator 9y ago
Marketing often cares about that a lot. Users seem to notice but often times there's confusion as to why the address bar is, for lack of a better term, stuttering. And god help you if your certificate uses a name you don't have any branding for.
- walshemj 9y ago
  Exactly for example the fiasco of behringer whose site is get this "www.music-group.com". It always seem to be German firms that don't just get the internet at all
nothrabannosir 9y ago
I definitely do for my bank. And the country code that is shown next to it.
Twirrim 9y ago
>Does anyone actually look at or care about that? No. You'll note that Amazon doesn't. They spent a bunch of time trying to figure out if it made a difference for customers. It turns out it doesn't, so they don't bother with the extra expense.
- nailer 9y ago
  Apple does, as a counterpoint. I'm interested in the Amazon study if you have a link, I haven't seen that before. (Note, I run CertSimple and we specialise in making the verification process for EV faster and much less painful, so I'm biased)
  - Twirrim 9y ago
    I don't have any link... but off the top of my head they found that such a tiny percentage of people actually noticed the EV, even amongst technical people, that the value added was negligible. Even those that notice the EV certificate indicated that it didn't change their decision to purchase from a site. You can make the EV process as smooth and simple as you like, but unless there's good solid business value provided by it (in $$s terms), you've got way more of an uphill struggle ahead.
- wongarsu 9y ago
  For someone as big as Amazon, isn't it cheaper to just get an EV cert than spending significant time figuring out whether it's worth it?
  - greenleafjacob 9y ago
    Not if it increases conversation rate by X%.
    - sambe 9y ago
      That would only reinforce the point.
nailer 9y ago
It's proof of identity, matching a pubkey to a legal name. Debian does it, Windows does it, your university does it, keybase does it. HTTPS is one of the few areas where it (since DV was invented) no longer the common practice. Note: I'm biased. See bio.
walshemj 9y ago
if I am logging onto a bank or my broker Abso-fragging-lutely, damn it :-)

cpncrunch 9y ago

Yes, everyone who cares about their security when using online banking.

rocqua 9y ago

See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-certificate/ https://www.troyhunt.com/journey-to-an-extended-validation-c...

snuxoll 9y ago
It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.
- ori_b 9y ago
  > Nobody notices the lack of EV on amazon.com, because, well, it's Amazon. Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.
  - Ermenwyr 9y ago
    amazoone.com actually redirects to www.amazon.com, as do amazoon.com, aamazon.com, and amezon.com. It seems like finding a domain name that is "close" to amazon.com that is not already registered by Amazon is not that easy.
tonyztan 9y ago
We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.
- duskwuff 9y ago
  > We need an 'Expect-EV' header, just like 'Expect-CT'. What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it. > Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses. Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)
  - tonyztan 9y ago
    > What good would that header do? It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful. >EV certificates are not available to everyone. I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable. >how do you enforce a requirement like that If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.

reificator 9y ago

Marketing often cares about that a lot. Users seem to notice but often times there's confusion as to why the address bar is, for lack of a better term, stuttering. And god help you if your certificate uses a name you don't have any branding for.

walshemj 9y ago
Exactly for example the fiasco of behringer whose site is get this "www.music-group.com". It always seem to be German firms that don't just get the internet at all

nothrabannosir 9y ago

I definitely do for my bank. And the country code that is shown next to it.

Twirrim 9y ago

>Does anyone actually look at or care about that? No. You'll note that Amazon doesn't. They spent a bunch of time trying to figure out if it made a difference for customers. It turns out it doesn't, so they don't bother with the extra expense.

nailer 9y ago
Apple does, as a counterpoint. I'm interested in the Amazon study if you have a link, I haven't seen that before. (Note, I run CertSimple and we specialise in making the verification process for EV faster and much less painful, so I'm biased)
- Twirrim 9y ago
  I don't have any link... but off the top of my head they found that such a tiny percentage of people actually noticed the EV, even amongst technical people, that the value added was negligible. Even those that notice the EV certificate indicated that it didn't change their decision to purchase from a site. You can make the EV process as smooth and simple as you like, but unless there's good solid business value provided by it (in $$s terms), you've got way more of an uphill struggle ahead.
wongarsu 9y ago
For someone as big as Amazon, isn't it cheaper to just get an EV cert than spending significant time figuring out whether it's worth it?
- greenleafjacob 9y ago
  Not if it increases conversation rate by X%.
  - sambe 9y ago
    That would only reinforce the point.

nailer 9y ago

It's proof of identity, matching a pubkey to a legal name. Debian does it, Windows does it, your university does it, keybase does it. HTTPS is one of the few areas where it (since DV was invented) no longer the common practice. Note: I'm biased. See bio.

walshemj 9y ago

if I am logging onto a bank or my broker Abso-fragging-lutely, damn it :-)