5 ms·

I may be different, but to me it seems that EV certificates are useful for dealing with domain typo fishing. Google.com is pretty short and memorable. However,

I may be different, but to me it seems that EV certificates are useful for dealing with domain typo fishing. Google.com is pretty short and memorable. However, when I type my bank's address, especially if it is a small bank, seeing the EV certificate gives my more confidence that I did not make a typo in the URL. Given that LetsEncrypt makes if free and painless to set up https if you have control of a domain, the EV certificate just gives me just a little bit more comfort over a DV especially for sensitive information.

gruez 8y ago
>seeing the EV certificate gives my more confidence that I did not make a typo in the URL not really. there's nothing preventing an attacker from creating a legal entity with the same name and legitimately getting a EV certificate. https://stripe.ian.sh/ https://stripe.ian.sh/
- ocdtrekkie 8y ago
  This is a much easier problem to deal with than trying to make any other strategy useful. The requirements to get an EV certificate can and should be updated, but it's the closest thing HTTPS does to being a useful security measure. The reality is that good security doesn't scale. If an entity starts specifying a reasonable list of certificates it has directly verified are the trustworthy well-known entities people expect, you have a good trust system. Once you start throwing in an automatically-verifiable system where everyone should be able to participate, phishing is going to happen. As much as Let's Encrypt helped encrypt the web for free, it also guaranteed that convincingly phishing the web is also free. Making a legal entity and going through the EV process is a level of frustration that isn't easy to handle repeatedly, and very few checks would be needed to be added to EV to make it near impossible for an entity to rebrand and reappear after being banned for misusing it's certificate. Notice that stripe.ian.sh doesn't actually have an EV cert anymore: A system working as designed. The only way we are going to ever ensure your bank site can't be imitated by some kid in their garage is going to be to create a system that a kid in their garage can't participate in. And the closest thing to that is EV.
  - owenmarshall 8y ago
    > Notice that stripe.ian.sh doesn't actually have an EV cert anymore: A system working as designed. Comodo has apologized for incorrectly revoking the certificate for stripe.ian.sh and offered a new EV cert. https://www.comodoca.com/en-us/about/blog/on-comodo-ca’s-recent-revocation-of-an-ssl-certifi/ https://www.comodoca.com/en-us/about/blog/on-comodo-ca’s-rec... In fact, many browser security developers would disagree with your assessment: https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/NjMmyA6MxN0 https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...
    - ocdtrekkie 8y ago
      I have very little faith in the opinions of "browser security developers" at the moment on account of browser security being a joke. Their focus has been on technical security but lacks practical security. Yes, stripe.ian.sh exists, but have you ever seen a truly malicious use of EV? Browser security developers concern themselves with arcane exploits of sandboxes while they don't mind nearly that every browser extension has full read/write access to everything people see and do. EV has flaws, but it's better than literally anything else. We shouldn't be promoting HTTPS if it isn't solving this, the other problems it attempts to solve are mostly overstated problems. Because phishing is a vastly bigger threat than MITM. EV has theoretical flaws but solves real problems, HTTPS without it has real problems and largely solves theoretical flaws.
      - iancarroll 8y ago
        Frankly, I have yet to see a typical user point out EV as a problem solver. Usually, when I try to explain my work with EV to an average user, nobody knows what I'm talking about.
        ocdtrekkie 8y ago
        I would argue that's because the companies that should be using EV aren't, so users don't see EV often/enough. Google, Microsoft, etc. have no excuse to not be using, and emphasizing EV certificates. Consider how many "Microsoft support" scams would fall flat on their face if people were taught to look for the company they're dealing with was in a green box near the URL, and EV certs were shored up so that only major Fortune 500 or so companies were able to participate. And before someone suggests that users can't be taught this, there's precedent: We've been trying to teach users not to trust that "Secure" badge/lock icon they've gotten used to. The difference is, the secure icon never represented that they were communicating with someone trustworthy, but the EV designation would. EDIT: Also, hi Ian! stripe.ian.sh makes you a minor celebrity, and I'm honored by your presence. ;)
- nailer 8y ago
  That's obviously specific to the US, but more to the point: they (Digicert) are looking at moving EV to trademarks which is nationally registered and a better match for 'verified brand'

gruez 8y ago

>seeing the EV certificate gives my more confidence that I did not make a typo in the URL not really. there's nothing preventing an attacker from creating a legal entity with the same name and legitimately getting a EV certificate. https://stripe.ian.sh/ https://stripe.ian.sh/

ocdtrekkie 8y ago
This is a much easier problem to deal with than trying to make any other strategy useful. The requirements to get an EV certificate can and should be updated, but it's the closest thing HTTPS does to being a useful security measure. The reality is that good security doesn't scale. If an entity starts specifying a reasonable list of certificates it has directly verified are the trustworthy well-known entities people expect, you have a good trust system. Once you start throwing in an automatically-verifiable system where everyone should be able to participate, phishing is going to happen. As much as Let's Encrypt helped encrypt the web for free, it also guaranteed that convincingly phishing the web is also free. Making a legal entity and going through the EV process is a level of frustration that isn't easy to handle repeatedly, and very few checks would be needed to be added to EV to make it near impossible for an entity to rebrand and reappear after being banned for misusing it's certificate. Notice that stripe.ian.sh doesn't actually have an EV cert anymore: A system working as designed. The only way we are going to ever ensure your bank site can't be imitated by some kid in their garage is going to be to create a system that a kid in their garage can't participate in. And the closest thing to that is EV.
- owenmarshall 8y ago
  > Notice that stripe.ian.sh doesn't actually have an EV cert anymore: A system working as designed. Comodo has apologized for incorrectly revoking the certificate for stripe.ian.sh and offered a new EV cert. https://www.comodoca.com/en-us/about/blog/on-comodo-ca’s-recent-revocation-of-an-ssl-certifi/ https://www.comodoca.com/en-us/about/blog/on-comodo-ca’s-rec... In fact, many browser security developers would disagree with your assessment: https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/NjMmyA6MxN0 https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...
  - ocdtrekkie 8y ago
    I have very little faith in the opinions of "browser security developers" at the moment on account of browser security being a joke. Their focus has been on technical security but lacks practical security. Yes, stripe.ian.sh exists, but have you ever seen a truly malicious use of EV? Browser security developers concern themselves with arcane exploits of sandboxes while they don't mind nearly that every browser extension has full read/write access to everything people see and do. EV has flaws, but it's better than literally anything else. We shouldn't be promoting HTTPS if it isn't solving this, the other problems it attempts to solve are mostly overstated problems. Because phishing is a vastly bigger threat than MITM. EV has theoretical flaws but solves real problems, HTTPS without it has real problems and largely solves theoretical flaws.
    - iancarroll 8y ago
      Frankly, I have yet to see a typical user point out EV as a problem solver. Usually, when I try to explain my work with EV to an average user, nobody knows what I'm talking about.
      - ocdtrekkie 8y ago
        I would argue that's because the companies that should be using EV aren't, so users don't see EV often/enough. Google, Microsoft, etc. have no excuse to not be using, and emphasizing EV certificates. Consider how many "Microsoft support" scams would fall flat on their face if people were taught to look for the company they're dealing with was in a green box near the URL, and EV certs were shored up so that only major Fortune 500 or so companies were able to participate. And before someone suggests that users can't be taught this, there's precedent: We've been trying to teach users not to trust that "Secure" badge/lock icon they've gotten used to. The difference is, the secure icon never represented that they were communicating with someone trustworthy, but the EV designation would. EDIT: Also, hi Ian! stripe.ian.sh makes you a minor celebrity, and I'm honored by your presence. ;)
nailer 8y ago
That's obviously specific to the US, but more to the point: they (Digicert) are looking at moving EV to trademarks which is nationally registered and a better match for 'verified brand'