5 ms·

What does this mean in regular human terms?

by Izmaki 9y ago

belorn 9y ago
Extended Validation certificate is when a company go to a CA and provide a bunch of business documents and legal proof that they really own the company behind a name. Its not a technical aspect but human lawyer <-> human lawyer that establish a certificate. At the end if the validation is successful, the company get a technical signed document that in browsers shows up as a green lock and the name in green next to the URL.
- colejohnson66 9y ago
  So in addition to knowing that your browser is connected to where you want, you now know that the website you want is actually who they say they are?
  - yourself92 9y ago
    Exactly
  - kzrdude 9y ago
    Of course you also need a browser and/or OS to establish the roots of the trust relations.
    - gcb0 9y ago
      ...and hope symantec/komodo/et al won't start selling those certs by the bucket.
  - forapurpose 9y ago
    > you now know that the website you want is actually who they say they are? That's the idea. Of course, validation, while more thorough than for standard certs, still is not that reliable. My strong impression is that it could be fooled by anyone sufficiently motivated.
    - peterwwillis 9y ago
      Not only that - in practice it's kind of meaningless, because if you were served a non-EV cert, you wouldn't notice. And there's usually other domains or subdomains that don't use the EV cert. It's mostly just a kind of token gesture by a business to claim they're more secure.
    - easyroot 9y ago
      EV is part of a narrative. Which has some value, even if weak.
- athenot 9y ago
  > "a bunch of business documents and legal proof" In my case they just needed me to put an entry in the Yellow Pages...
  - icebraining 9y ago
    Which CA?
  - deleted 9y ago
    [deleted]
  - athenot 9y ago
    Errata: sorry I went back and checked and I believe they also required some proof of incorporation. My apologies for the incorrect cynicism. :(
    - acchow 9y ago
      Is the proof of incorporation not presented on physical paper? Seems easy to fake.
      - babuskov 9y ago
        Aren't all corporations listed in a public registry where it's easy to verify?
  - DonHopkins 9y ago
    Don't forget to restart your ypserver! Also, never put this line in /etc/netgroup then rwall to it: universal (,,) http://www-mice.cs.ucl.ac.uk/multimedia/misc/tcp_ip/8702.mm.www/0310.html http://www-mice.cs.ucl.ac.uk/multimedia/misc/tcp_ip/8702.mm....
    - kurusii 9y ago
      That was a fun read. Thanks for the link. On a somewhat related topic, I worry a lot about things on the internet disappearing, most often simply due to neglect (domain expiry, companies being bought, et c.) I try to save everything I can that I find interesting, in fear of it never being available again. That said, it makes me very happy to see emails from 1987 archived online--so happy that I've even saved a copy.
- acchow 9y ago
  Why do we think a lawyer would be less likely to be duped? If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake?
  - JumpCrisscross 9y ago
    > If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake? Lawyers are good at verifying identities. It's a core part of their work. More critically, in-person fraud scales differently from electronic fraud.
    - frank_abagnale 9y ago
      https://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale
blfr 9y ago
You get a green bar to know you're connecting to the NYT and the cert is issued for many additional addresses showing large coverage of their services and hinting at future use.
0xfeba 9y ago
EV certs provide more than just encryption that a DV (domain validation) cert provides. DV just checks to make sure the domain is under control of whoever is asking for the cert. EV ensures that the entity (person, corp, org, whatever) is in fact in control of the domain and is who they say they are.
andimm 9y ago
I liked this post on EV certificates: https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas-phishing-lets-encrypt/ https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...
- Ajedi32 9y ago
  Worth noting that a lot of the arguments in this article change when you're talking about Onion services. Notably, Onion services tend to have URLs that are _very_ difficult for humans to remember (they're essentially just gibberish), and they're anonymous by default, meaning without an EV cert there's no easy way to check whether the service you're visiting is legitimate or not. DV certs are also pretty useless for Onion services, since your connection is already encrypted and authenticated by Tor.

What does this mean in regular human terms?

by Izmaki 9y ago

What does this mean in regular human terms?

Extended Validation certificate is when a company go to a CA and provide a bunch of business documents and legal proof that they really own the company behind a name. Its not a technical aspect but human lawyer <-> human lawyer that establish a certificate. At the end if the validation is successful, the company get a technical signed document that in browsers shows up as a green lock and the name in green next to the URL.

colejohnson66 9y ago
So in addition to knowing that your browser is connected to where you want, you now know that the website you want is actually who they say they are?
- yourself92 9y ago
  Exactly
- kzrdude 9y ago
  Of course you also need a browser and/or OS to establish the roots of the trust relations.
  - gcb0 9y ago
    ...and hope symantec/komodo/et al won't start selling those certs by the bucket.
- forapurpose 9y ago
  > you now know that the website you want is actually who they say they are? That's the idea. Of course, validation, while more thorough than for standard certs, still is not that reliable. My strong impression is that it could be fooled by anyone sufficiently motivated.
  - peterwwillis 9y ago
    Not only that - in practice it's kind of meaningless, because if you were served a non-EV cert, you wouldn't notice. And there's usually other domains or subdomains that don't use the EV cert. It's mostly just a kind of token gesture by a business to claim they're more secure.
  - easyroot 9y ago
    EV is part of a narrative. Which has some value, even if weak.
athenot 9y ago
> "a bunch of business documents and legal proof" In my case they just needed me to put an entry in the Yellow Pages...
- icebraining 9y ago
  Which CA?
- deleted 9y ago
  [deleted]
- athenot 9y ago
  Errata: sorry I went back and checked and I believe they also required some proof of incorporation. My apologies for the incorrect cynicism. :(
  - acchow 9y ago
    Is the proof of incorporation not presented on physical paper? Seems easy to fake.
    - babuskov 9y ago
      Aren't all corporations listed in a public registry where it's easy to verify?
- DonHopkins 9y ago
  Don't forget to restart your ypserver! Also, never put this line in /etc/netgroup then rwall to it: universal (,,) http://www-mice.cs.ucl.ac.uk/multimedia/misc/tcp_ip/8702.mm.www/0310.html http://www-mice.cs.ucl.ac.uk/multimedia/misc/tcp_ip/8702.mm....
  - kurusii 9y ago
    That was a fun read. Thanks for the link. On a somewhat related topic, I worry a lot about things on the internet disappearing, most often simply due to neglect (domain expiry, companies being bought, et c.) I try to save everything I can that I find interesting, in fear of it never being available again. That said, it makes me very happy to see emails from 1987 archived online--so happy that I've even saved a copy.
acchow 9y ago
Why do we think a lawyer would be less likely to be duped? If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake?
- JumpCrisscross 9y ago
  > If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake? Lawyers are good at verifying identities. It's a core part of their work. More critically, in-person fraud scales differently from electronic fraud.
  - frank_abagnale 9y ago
    https://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale

blfr 9y ago

You get a green bar to know you're connecting to the NYT and the cert is issued for many additional addresses showing large coverage of their services and hinting at future use.

0xfeba 9y ago

EV certs provide more than just encryption that a DV (domain validation) cert provides. DV just checks to make sure the domain is under control of whoever is asking for the cert. EV ensures that the entity (person, corp, org, whatever) is in fact in control of the domain and is who they say they are.

andimm 9y ago

I liked this post on EV certificates: https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas-phishing-lets-encrypt/ https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...

Ajedi32 9y ago
Worth noting that a lot of the arguments in this article change when you're talking about Onion services. Notably, Onion services tend to have URLs that are _very_ difficult for humans to remember (they're essentially just gibberish), and they're anonymous by default, meaning without an EV cert there's no easy way to check whether the service you're visiting is legitimate or not. DV certs are also pretty useless for Onion services, since your connection is already encrypted and authenticated by Tor.