It's got more credence coming out of Troy's mouth than, say, a random commenter's like mine, his somewhat bit too scathing snark notwithstanding, but on the "st

It's got more credence coming out of Troy's mouth than, say, a random commenter's like mine, his somewhat bit too scathing snark notwithstanding, but on the "stripe.ian.sh" thread a few months ago I observed [1] that EV, or rather, people's mental model of the trust that EV confers is broken. People typically care about whether the site they arrived at was the one they were intending to visit, which the computer can't possibly know without additional input, but EV has attained a role of serving as a flawed signal of such, because the browser bar said something that doesn't look alarmingly different. What we're seeing now is the convergence of forces that are pushing short-lived, automatic DV certs and players who are keen on de-emphasizing EV's imperfect role as a destination surety signal. Big sites can get by with DV because people trust big sites by fiat, just by mental associations they already have to a URL. There's no benefit to Facebook having an EV cert, because literally everyone who'd want to visit Facebook knows Facebook's URL. User error about entering credentials on the wrong site -- accidentally due to typosquatting, or through leading such as phishing -- is better mitigated in other ways: multi-factor authentication (especially unproxiable such as U2F); not by making the high-profile site pay thousands of dollars for a text string in green, when there's users who fall victim to phishing from bizarre domains too. [1] https://news.ycombinator.com/item?id=15904513#15909273 https://news.ycombinator.com/item?id=15904513#15909273