3 ms·
Maybe EV isn't the answer. But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when
by stefan_ 7y ago
Maybe EV isn't the answer. But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when you have Firefox, Chrome et al. kotau to company proxies and all kinds of dubious state CAs in the trust root.
That's before you get to the UI failures, where phishers can trivially get that lock for their microssoft.com domains.
- hsk823 7y agoYes but none of those issues are fixed via extended validation of TLS certs. Extended validation was simply a cash grab and a human component to validating you are who you are beyond a domain name mismatch. EV process was the same as any other cert process, what ever company out there issues the EV was just doing extra leg work and making sure business registration paperwork was legit, etc. etc. It didn't make it more safe, it just added extra steps to validate ownership of a domain. MITM TLS proxies and shady root CAs are and will continue to exist in the enterprise and for state actors for the foreseeable future. EV does not challenge this, in fact EV certs like any cert that's intercepted properly, the end user will never know that it happened.
- hannob 7y ago> But there is opportunity for something else out there, because right now https is not living up to the "authentication" promise when you have Firefox, Chrome et al. kotau to company proxies and all kinds of dubious state CAs in the trust root. There's already a lot of things being done to improve the situation. Honest question: Are you aware of them? Do you know Certificate Transparency? Have you followed the intense discussion about Dark Matter? Do you know what the Baseline Requirements are? Do you know how Webauthn prevents Phishing?