3 ms·

See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a pa

by rocqua 9y ago

See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-certificate/ https://www.troyhunt.com/journey-to-an-extended-validation-c...

snuxoll 9y ago
It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.
- ori_b 9y ago
  > Nobody notices the lack of EV on amazon.com, because, well, it's Amazon. Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.
  - Ermenwyr 9y ago
    amazoone.com actually redirects to www.amazon.com, as do amazoon.com, aamazon.com, and amezon.com. It seems like finding a domain name that is "close" to amazon.com that is not already registered by Amazon is not that easy.
tonyztan 9y ago
We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.
- duskwuff 9y ago
  > We need an 'Expect-EV' header, just like 'Expect-CT'. What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it. > Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses. Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)
  - tonyztan 9y ago
    > What good would that header do? It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful. >EV certificates are not available to everyone. I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable. >how do you enforce a requirement like that If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.

by rocqua 9y ago

snuxoll 9y ago

It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.

ori_b 9y ago
> Nobody notices the lack of EV on amazon.com, because, well, it's Amazon. Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.
- Ermenwyr 9y ago
  amazoone.com actually redirects to www.amazon.com, as do amazoon.com, aamazon.com, and amezon.com. It seems like finding a domain name that is "close" to amazon.com that is not already registered by Amazon is not that easy.

tonyztan 9y ago

We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.

duskwuff 9y ago
> We need an 'Expect-EV' header, just like 'Expect-CT'. What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it. > Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses. Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)
- tonyztan 9y ago
  > What good would that header do? It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful. >EV certificates are not available to everyone. I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable. >how do you enforce a requirement like that If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.