3 ms·

Most companies don't care about the EV, aka the GREEN BAR. For example, Paypal and Apple care but not Google, Amazon or Microsoft. So, its not a matter of co

by jorgec 9y ago

Most companies don't care about the EV, aka the GREEN BAR. For example, Paypal and Apple care but not Google, Amazon or Microsoft. So, its not a matter of costs but its usability that its practically NIL. Even Ycombinator is not using it. As a developer, i am found that practically all customers don't care about the URL, in fact, most customer don't see the url at all.

BillinghamJ 9y ago
The primary benefit I have found is for pinning/CA whitelisting purposes. All EV certs must have publicly searchable CT records, and go through reasonably complex validation processes involving some manual human validation processes, in addition to the usual checks. This means that: 1. The barrier to getting an EV cert is higher - and the probability of a misissuance is lower. 2. If a misissuance does occur, it should be very easy to find out - by regularly/automatically searching CT logs. If you choose two or three CAs whose EV programs you trust, you can pin against those CAs’ EV roots in your applications (e.g. a mobile app published by your company). This is an effective process to reduce the risk of MITMs, and even continues to work as the CA changes intermediates etc (assuming they have separate roots for EV). There isn’t a whole lot of benefit in browsers, unless you have preloaded pinned certificates there too (which many major sites do). Also, as an aside, if anyone is looking for EV certs, I have always wholeheartedly recommended CertSimple. They’re very quick, aren’t too expensive, and have good support. The certs are issued by DigiCert. We use them for https://cuvva.com https://cuvva.com
- rocqua 9y ago
  Sure, if I see an EV cert, I trust that cert slightly more. However, unless I expect an EV cert and happen to check, there is no downside to having a DV cert. If you are going to pin your apps to a CA, you have quite a few other options. For example, you could cross-sign all your certs by your own root CA cert and pin to that in addition to pinning to the other CA. At this point, you don't need to trust the CA as long as you trust your own root cert.
  - BillinghamJ 9y ago
    I didn’t make any reference to any visual/user benefits/trust from EV certs. If you’re going to do cross-signing, then you do need to essentially operate your own root program - assuming you want to keep your own root secure. You’ll also then presumably need to serve an additional cert (or two, if you’re keeping your own root offline) in the intermediate chain so it can be validated by the client.
- Scott_Helme_ 9y ago
  In April next year we will have the CT requirement for all certificates so EV will lose an edge there. For the pinning in a mobile app, would you still depend on the PKI or not just pin against your own private CA/certificates?
  - BillinghamJ 9y ago
    Our mobile apps use the same endpoints/hostnames as our public API, so fairly important for it to be publicly trusted. I do still think the barrier to entry aspect of EVs will always be very helpful. In a world where you can get a DV cert in under a second (from LetsEncrypt), if your DNS or domain registration was to be compromised, you’d have no MITM protection at all until you managed to get it revoked - which is likely to take days. It’d almost be helpful to have a system where certs have to be requested (publicly on CT records) a week in advance or something, so issuance can be protested if something like the above did happen.
Theodores 9y ago
Green bar EV caught me by surprise the other day, I did not know what it was and even checked the likes of Google to see if everyone else had one. This did actually take me away from the checkout of the website I was on, so it kind of broke 'Don't make me think' for me in that instance.
nailer 9y ago
FYI microsoft.com has an EV certificate. Google.com has a OV certificate, where identity is matched to google.com but this isn't shown in the browser. it's a similar level of verification as EV but without the UI. Note Google have a lot of user generated content (eg, AMP sites) hosted on google.com YC's website isn't an example of great tech. (See bio/disclosure in my other comment)

by jorgec 9y ago

BillinghamJ 9y ago

The primary benefit I have found is for pinning/CA whitelisting purposes. All EV certs must have publicly searchable CT records, and go through reasonably complex validation processes involving some manual human validation processes, in addition to the usual checks. This means that: 1. The barrier to getting an EV cert is higher - and the probability of a misissuance is lower. 2. If a misissuance does occur, it should be very easy to find out - by regularly/automatically searching CT logs. If you choose two or three CAs whose EV programs you trust, you can pin against those CAs’ EV roots in your applications (e.g. a mobile app published by your company). This is an effective process to reduce the risk of MITMs, and even continues to work as the CA changes intermediates etc (assuming they have separate roots for EV). There isn’t a whole lot of benefit in browsers, unless you have preloaded pinned certificates there too (which many major sites do). Also, as an aside, if anyone is looking for EV certs, I have always wholeheartedly recommended CertSimple. They’re very quick, aren’t too expensive, and have good support. The certs are issued by DigiCert. We use them for https://cuvva.com https://cuvva.com

rocqua 9y ago
Sure, if I see an EV cert, I trust that cert slightly more. However, unless I expect an EV cert and happen to check, there is no downside to having a DV cert. If you are going to pin your apps to a CA, you have quite a few other options. For example, you could cross-sign all your certs by your own root CA cert and pin to that in addition to pinning to the other CA. At this point, you don't need to trust the CA as long as you trust your own root cert.
- BillinghamJ 9y ago
  I didn’t make any reference to any visual/user benefits/trust from EV certs. If you’re going to do cross-signing, then you do need to essentially operate your own root program - assuming you want to keep your own root secure. You’ll also then presumably need to serve an additional cert (or two, if you’re keeping your own root offline) in the intermediate chain so it can be validated by the client.
Scott_Helme_ 9y ago
In April next year we will have the CT requirement for all certificates so EV will lose an edge there. For the pinning in a mobile app, would you still depend on the PKI or not just pin against your own private CA/certificates?
- BillinghamJ 9y ago
  Our mobile apps use the same endpoints/hostnames as our public API, so fairly important for it to be publicly trusted. I do still think the barrier to entry aspect of EVs will always be very helpful. In a world where you can get a DV cert in under a second (from LetsEncrypt), if your DNS or domain registration was to be compromised, you’d have no MITM protection at all until you managed to get it revoked - which is likely to take days. It’d almost be helpful to have a system where certs have to be requested (publicly on CT records) a week in advance or something, so issuance can be protested if something like the above did happen.

Theodores 9y ago

Green bar EV caught me by surprise the other day, I did not know what it was and even checked the likes of Google to see if everyone else had one. This did actually take me away from the checkout of the website I was on, so it kind of broke 'Don't make me think' for me in that instance.

nailer 9y ago

FYI microsoft.com has an EV certificate. Google.com has a OV certificate, where identity is matched to google.com but this isn't shown in the browser. it's a similar level of verification as EV but without the UI. Note Google have a lot of user generated content (eg, AMP sites) hosted on google.com YC's website isn't an example of great tech. (See bio/disclosure in my other comment)