3 ms·

I'm seeing a lot of discussions about financial and specifically banking sites here. For the average user, there's no reason or need to phish a particular finan

• throwawaymath 8y ago
  It wouldn't do anything, because users don't check it. I used to be involved in phishing campaigns against internal employees at a fintech company. Despite these employees being highly technical people, I can't recall incorrect or missing extended validation certificates ever stopping them from submitting credentials. As another commenter has said, I can't personally tell you the name of any specific website with an EV certificate. I don't know any friends or family who actually check for the presence of correct EV certificates. It's a cool idea and it's made CAs plenty of money, but it's just too subtle of a cue. I think many people are resistant to the idea that extended validation certificates aren't effective for one or both of two reasons. First, they probably want to actually do something instead of being hopeless, so they consider doing something better than nothing even if it's not ideal. Second, they are reviewing the technical specification and finding it sound, but not grounding it in the reality of how users work. Part of the argument against them is not just that they're ineffective, but also expensive. It's not unreasonable to simply call it snake oil. The visual cue would need to be significantly more prominent - up to par with the red versus green icons of HTTP and HTTPS, respectively - in order to have a real impact. Users would need to have better training and education to come to expect the extended validation instead of merely feeling more assurance when it's present. The system has insufficient penalty for sites which should have extended validation but only present domain validation, and browser-buyin to the concept is fading.
  • wbond 8y ago
    > First, they probably want to actually do something instead of being hopeless, so they consider doing something better than nothing even if it's not ideal. Right, once OV and EV certificates are effectively removed from browsers, users such as myself will no longer have any tool to help ensure we are interacting with the entity intend to be interacting with. It is kind of like getting a cold call from your credit card company saying their has been suspicious activity and they want me to authenticate my account with personal details. I always call the phone number on the back of my physical credit card to ensure someone isn't scamming me. Rather than removing EV certificates as a concept, I would love to see some experiments run by browser vendors to see how users can more readily understand who they are interacting with. But instead, the solution seems to be to get rid of the only option since it doesn't work in its current incarnation. > Part of the argument against them is not just that they're ineffective, but also expensive. It's not unreasonable to simply call it snake oil. I have a hard time understanding this argument. You can purchase an EV cert for $80 a year from NameCheap. The extra cost is because they have people verify that the company details you have provided are valid and that you are an authorized representative of the company. Any company that is more than a solo founder is going to be in dire straights if $80 a year is too much. I mean, are you even going to find a domain name and hosting for less than $80 a year? In reality though, I don't think much of anyone other than major email providers and financial institutions really need to worry about EV. If a website doesn't have EV, but uses PayPal, I have no qualms. But if I go to long into Fidelity or PayPal and they couldn't be bothered to spent $100 per year to help me ensure I am actually interacting with them, that says a lot to me. I mean, even my small town NH bank has an EV cert. It just makes sense if you are dealing with finances.
    • technion 8y ago
      OV was never really accessible in browsers. Even the vendors pushing these seemed to avoid showing how to identify one (when they would screencap the EV green bar), and probably for good reasons. > You can purchase an EV cert for $80 a year from NameCheap I've been through this a quite few times. The cost of the cert isn't the true cost. If I could pay $80 to Lets Encrypt to have every issued cert be EV, I'd do it just to avoid this bikeshed. Every single time I've done it, the validation process has been extremely painful. I feel like it's made up on the spot by whatever offshore person gets asked to do the validation. Documents accepted last year are suddenly not accepted at renewal time. Being denied because my Australian company doesn't show up on a UK business register for example.
• tialaramex 8y ago
  Yup. A LOT of businesses make this worse by having some sort of half-arsed single sign on solution where a single set of employee credentials work in a bunch of systems, but not all systems. If you show their users a site they've never seen before with a login box and say it's somehow related to the business ("Our company's partnership with Hat Box means you may be entitled to significant discounts on a range of hats, check them out today!"), they will type in the credentials they use for that business's core systems, not because they're idiots re-using passwords, but because they genuinely expect that might be what works and other systems they use have reinforced that expectation. You can get a LOT of valid user credentials this way without even really meaning to phish them. As well as preventing confused end users from putting their site A credentials into site B, WebAuthn prevents idiots from designing a system on site B that expects the credentials from site A. It just doesn't work, you can't make it work, so you have to go back to the client and say "No, as well as being stupid that's also impossible". So you not only protect the users from the actual security problem you stop engineers building things which incur the problem in the first place.