5 ms·

I still don't quite follow. You were talking about adoption among top 10 sites - is your argument that Twitter is not using an EV certificate[1] because a judge

by pfg 9y ago

I still don't quite follow. You were talking about adoption among top 10 sites - is your argument that Twitter is not using an EV certificate[1] because a judge might say something along the lines of "That's all great but how do I know this twitter dot com thing is actually a site operated by Twitter, Inc? They're not using EV!" if some users sues them over a data breach? [1]: Not really important for this discussion, but slightly relevant: For some reason Twitter uses both EV and non-EV certificates depending on geolocation.

galobtter 9y ago
Yeah I don't think google not using a EV certificate really changes whether I can sue them
- enord 9y ago
  Obviously the law applies regardless of certificate type, but your ability to prove claims is affected.
  - galobtter 9y ago
    At least for top 10 websites, would I not be able to prove that google is responsible for everything on their site?
    - enord 9y ago
      Probably yes. More probably if the interaction was validated with an EV-cert.
enord 9y ago
Essentially yes, but that can be established through other channels in legal proceedings involving large, well established actors. An ev-cert tells the user that the operator of a site has taken pains to make themselves legally accountable, and have confirmed details about juridistiction, legal entity, liason, etc. to the CA, which in turn connects cryptographic non-repudiation to legal non-repudiation (i.e. a signature). All this is to state that with EV, every http response is basically signed and dated by the legal organisation that operates the site (grossly simplified, but sufficient for this argument). This signals where and how any dispute is to be arbitrated and settled (officially, and possibly legally), and conversely how seriously the security and integrity of the interaction is considered. The ev-cert acknowledges legal exposure, and therefore it also informs users of legal exposure.
enord 9y ago
To adress your aside: If twitter uses EV somewhere end non-EV elsewhere (depending on geolocation) then I'd wager they do it to comply minimally to the juridistiction in which they serve requests, that is: minimise legal exposure by foregoing EV-certs where this is legally tenable. ps: I'm getting some downvotes for my view on this, but little in the way of arguments. I'm happy to be corrected. Am I coming off as an asshat on this?
- pfg 9y ago
  Without getting into whether I agree with this or whether there's any data supporting such a statement, I think you could make the argument that the EV indicator might make users feel like there's a legal entity behind a site that they could go after, compared to sites without EV indicators. I don't think you can make the argument that businesses don't adopt EV because that'd expose them to legal risk. That's just doesn't fit into my understanding of how the law and courts work. I'm not aware of any evidence or precedence that would support this, and the EV guidelines don't mention anything of this nature either.
  - Scott_Helme_ 9y ago
    Something that I see a lot in the discussions around EV is "the EV indicator might make users feel" x, y or z. Not to sound too harsh but I don't care about making the user 'feel' anything. I want to make them more secure.

by pfg 9y ago

galobtter 9y ago

Yeah I don't think google not using a EV certificate really changes whether I can sue them

enord 9y ago
Obviously the law applies regardless of certificate type, but your ability to prove claims is affected.
- galobtter 9y ago
  At least for top 10 websites, would I not be able to prove that google is responsible for everything on their site?
  - enord 9y ago
    Probably yes. More probably if the interaction was validated with an EV-cert.

enord 9y ago

Essentially yes, but that can be established through other channels in legal proceedings involving large, well established actors. An ev-cert tells the user that the operator of a site has taken pains to make themselves legally accountable, and have confirmed details about juridistiction, legal entity, liason, etc. to the CA, which in turn connects cryptographic non-repudiation to legal non-repudiation (i.e. a signature). All this is to state that with EV, every http response is basically signed and dated by the legal organisation that operates the site (grossly simplified, but sufficient for this argument). This signals where and how any dispute is to be arbitrated and settled (officially, and possibly legally), and conversely how seriously the security and integrity of the interaction is considered. The ev-cert acknowledges legal exposure, and therefore it also informs users of legal exposure.

enord 9y ago

To adress your aside: If twitter uses EV somewhere end non-EV elsewhere (depending on geolocation) then I'd wager they do it to comply minimally to the juridistiction in which they serve requests, that is: minimise legal exposure by foregoing EV-certs where this is legally tenable. ps: I'm getting some downvotes for my view on this, but little in the way of arguments. I'm happy to be corrected. Am I coming off as an asshat on this?

pfg 9y ago
Without getting into whether I agree with this or whether there's any data supporting such a statement, I think you could make the argument that the EV indicator might make users feel like there's a legal entity behind a site that they could go after, compared to sites without EV indicators. I don't think you can make the argument that businesses don't adopt EV because that'd expose them to legal risk. That's just doesn't fit into my understanding of how the law and courts work. I'm not aware of any evidence or precedence that would support this, and the EV guidelines don't mention anything of this nature either.
- Scott_Helme_ 9y ago
  Something that I see a lot in the discussions around EV is "the EV indicator might make users feel" x, y or z. Not to sound too harsh but I don't care about making the user 'feel' anything. I want to make them more secure.