3 ms·

I think the only solution to fixing this is for Safari to show the domain again. It is the URL that is unique and known by the visitor, not the business name.

I think the only solution to fixing this is for Safari to show the domain again. It is the URL that is unique and known by the visitor, not the business name. Here in the UK there is another problem with EV certs, there is no way of registering a "trading name" or "doing business as (DBA) name" against a company so you can only have an EV cert issues against your actual registered business name. If that is different from your trading name and what you use as your domain name then they are less than worthless. For example, if the company is "Widgets of London Limited" but trade online as "Widgets Online" with the domain "widgetsonline.com" they cant get an EV cert with "Widgets Online" as the name - even if they own the registered trademark of it. See https://certsimple.com/help/doing-business-as-or-trading-names https://certsimple.com/help/doing-business-as-or-trading-nam... Maybe another solution to this is not to show just business name directly, force it to show the domain as well unless there is a registered trademark that is proven to be owned by the organisation and only then go the safari route of showing a shortened name?

lucideer 9y ago
If you click through to the page the article is referring to, his description of the problem is far better than Ars' summary[0], and he basically says some of the things you said. He is however more pessimistic: > There will undoubtedly be many proposed solutions to this issue. Ultimately, though, any method that ends up giving users a legal entity is fatally flawed. As a result of how extended validation certificates work, browsers have few options to fix this. Having said that, they can take steps to ensure EV certificates do not override other critical parts of the user interface, like Safari does. [0] Edit: Actually, on this note, might I suggest the HN link be changed to point to https://stripe.ian.sh/ https://stripe.ian.sh/
rlpb 9y ago
> ...so you can only have an EV cert issues against your actual registered business name This seems reasonable to me. If I had to chase you in court, I'd need your actual registered business name, and not your trading name. Further, there can be no verification of your trading name as there is no central registry or deduplication of trading names. If you could get a certificate naming your trading name, then so could a fraudster. This does make trading names less useful on the Internet. As a consumer, I don't feel anything of value has been lost. > ...unless there is a registered trademark that is proven to be owned by the organisation... This doesn't work either since trademarks don't exist in a single namespace. A fraudster could register a trademark matching yours but for use in a different market.

lucideer 9y ago

If you click through to the page the article is referring to, his description of the problem is far better than Ars' summary[0], and he basically says some of the things you said. He is however more pessimistic: > There will undoubtedly be many proposed solutions to this issue. Ultimately, though, any method that ends up giving users a legal entity is fatally flawed. As a result of how extended validation certificates work, browsers have few options to fix this. Having said that, they can take steps to ensure EV certificates do not override other critical parts of the user interface, like Safari does. [0] Edit: Actually, on this note, might I suggest the HN link be changed to point to https://stripe.ian.sh/ https://stripe.ian.sh/

rlpb 9y ago

> ...so you can only have an EV cert issues against your actual registered business name This seems reasonable to me. If I had to chase you in court, I'd need your actual registered business name, and not your trading name. Further, there can be no verification of your trading name as there is no central registry or deduplication of trading names. If you could get a certificate naming your trading name, then so could a fraudster. This does make trading names less useful on the Internet. As a consumer, I don't feel anything of value has been lost. > ...unless there is a registered trademark that is proven to be owned by the organisation... This doesn't work either since trademarks don't exist in a single namespace. A fraudster could register a trademark matching yours but for use in a different market.