3 ms·
The article is precisely about this: regardless of practical use, people don't follow the behaviour associated with supporting that practice, so it's worthless.
by headsoup 7y ago
The article is precisely about this: regardless of practical use, people don't follow the behaviour associated with supporting that practice, so it's worthless.
And people who would follow the correct behaviour...are probably capable of doing so without the EV anyway.
- jzl 7y ago> "The article is precisely about this" No, I don't believe it is. The point debunked over and over again by Troy in this and other articles of his is the supposed anti-phishing aspect of EV certs: that because the browser shows the company name separate from the url, the user can know that they're really at e.g. Amazon and not amaz0n.com. I'm referring to a very specific situation that is much more rarely mentioned: when you are using a computer with a managed cert store (usually a company computer behind a firewall) and you want to know if the site you are visiting is getting "legitimately" (per company policy) SSL-sniffed by a network appliance. This is completely different from phishing attacks or whether you think you are at the real Amazon. All you need to do is go to a single site that you know has EV and see if it shows up as EV in the browser. Sure, they could selectively sniff, but in practice I believe most companies that do this have an all or nothing approach.