6 ms·
EV certs are a useful as a barrier-to-entry when you do cert pinning against roots/intermediates.
by BillinghamJ 8y ago
EV certs are a useful as a barrier-to-entry when you do cert pinning against roots/intermediates.
- dagenix 8y agoExcept that HPKP is being deprecated by Chrome (https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ?hn https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...). And I'd suspect other browsers will follow.
- sandij 8y agoWhen pinning CAs instead of certificates, you’d use CAA instead of HPKP.
- BillinghamJ 8y agoThat wouldn’t work, as there’s no differentiator between EV and non-EV
- toast0 8y agoCAA isn't restricting acceptance of certs, it's restricting issuance, assuming the attempted issuer is compliant, competent, and that your domain didn't get hijacked.
- BillinghamJ 8y agoI don’t mean website pinning. I mean eg apps etc
- markonen 8y agoWe're also using an EV cert for pinning in our native apps (in other words, we're not pinning a public key or a CA, but the fact that the certificate is an EV cert), on the theory that this is less risky operationally than pinning any specific details of an actual certificate. We can get a new certificate from a bunch of CAs, but it's tricky for an attacker to get one for our domain name. (no need to reply to this with stripe.ian.sh) However, now that EV certs are clearly going the way of the dodo, the risks associated with them are likely to increase. CAs are going to be exiting the EV business (and/or going out of business themselves). The dwindling market is also likely to increase the price of an EV cert, rather than decrease it, as remaining purchasers will have a specific need to use an EV cert. It might be time to re-evaluate.
- BillinghamJ 8y agoI don’t think they’re actually likely to go away for many years. The CA/B forum may decide to deprecate them one day though.