4 ms·

I'm surprised no one has mentioned the main practical benefit of EV certs: the fact that a green cert in the browser ensures that there is no man-in-the-middle

by jzl 7y ago

I'm surprised no one has mentioned the main practical benefit of EV certs: the fact that a green cert in the browser ensures that there is no man-in-the-middle network proxy/appliance intercepting the traffic even if a trusted certificate for the proxy/appliance (or bad guy) has been placed in your machine's cert store. Browsers will only honor the EV setting in the cert if it was signed by a hardwired (and much shorter) list of CAs. As long as you, the user, trust that the browser itself hasn't been modified (for example if you downloaded it yourself), then it's a nice reassurance when using a browser in a not totally trusted environment.

CherryJimbo 7y ago
Browsers are moving away from showing differences between EV and DV certs nowadays though. And anyone can register a company name and get an EV cert - that doesn't make it trusted. https://stripe.ian.sh/ https://stripe.ian.sh/ is a prime example of this. HTTPS is a nice reassurance, sure, but an EV cert isn't.
- LeoPanthera 7y ago
  > https://stripe.ian.sh/ https://stripe.ian.sh/ is a prime example of this. It used to be. All his EV certs were revoked.
  - CherryJimbo 7y ago
    Sure, but my point doesn't change. https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-ca/ https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-c... is a good write-up about that.
- nailer 7y ago
  Company homonyms are an issue, albeit a US specific one. The industry is looking at verifying trademarks, which tend to be monopolies.
headsoup 7y ago
The article is precisely about this: regardless of practical use, people don't follow the behaviour associated with supporting that practice, so it's worthless. And people who would follow the correct behaviour...are probably capable of doing so without the EV anyway.
- jzl 7y ago
  > "The article is precisely about this" No, I don't believe it is. The point debunked over and over again by Troy in this and other articles of his is the supposed anti-phishing aspect of EV certs: that because the browser shows the company name separate from the url, the user can know that they're really at e.g. Amazon and not amaz0n.com. I'm referring to a very specific situation that is much more rarely mentioned: when you are using a computer with a managed cert store (usually a company computer behind a firewall) and you want to know if the site you are visiting is getting "legitimately" (per company policy) SSL-sniffed by a network appliance. This is completely different from phishing attacks or whether you think you are at the real Amazon. All you need to do is go to a single site that you know has EV and see if it shows up as EV in the browser. Sure, they could selectively sniff, but in practice I believe most companies that do this have an all or nothing approach.

by jzl 7y ago

CherryJimbo 7y ago

Browsers are moving away from showing differences between EV and DV certs nowadays though. And anyone can register a company name and get an EV cert - that doesn't make it trusted. https://stripe.ian.sh/ https://stripe.ian.sh/ is a prime example of this. HTTPS is a nice reassurance, sure, but an EV cert isn't.

LeoPanthera 7y ago
> https://stripe.ian.sh/ https://stripe.ian.sh/ is a prime example of this. It used to be. All his EV certs were revoked.
- CherryJimbo 7y ago
  Sure, but my point doesn't change. https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-ca/ https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-c... is a good write-up about that.
nailer 7y ago
Company homonyms are an issue, albeit a US specific one. The industry is looking at verifying trademarks, which tend to be monopolies.

headsoup 7y ago

The article is precisely about this: regardless of practical use, people don't follow the behaviour associated with supporting that practice, so it's worthless. And people who would follow the correct behaviour...are probably capable of doing so without the EV anyway.

jzl 7y ago
> "The article is precisely about this" No, I don't believe it is. The point debunked over and over again by Troy in this and other articles of his is the supposed anti-phishing aspect of EV certs: that because the browser shows the company name separate from the url, the user can know that they're really at e.g. Amazon and not amaz0n.com. I'm referring to a very specific situation that is much more rarely mentioned: when you are using a computer with a managed cert store (usually a company computer behind a firewall) and you want to know if the site you are visiting is getting "legitimately" (per company policy) SSL-sniffed by a network appliance. This is completely different from phishing attacks or whether you think you are at the real Amazon. All you need to do is go to a single site that you know has EV and see if it shows up as EV in the browser. Sure, they could selectively sniff, but in practice I believe most companies that do this have an all or nothing approach.