3 ms·
It does not matter. Main point is: "reliance on the absence of a positive visual indicator was simply never a good idea in the first place". Even if you would
by ozim 7y ago
It does not matter. Main point is: "reliance on the absence of a positive visual indicator was simply never a good idea in the first place".
Even if you would have reasonable alternative such as brand name or else, simply having this in address bar in green does not help people to differentiate phishing sites without brand name in progress bar. People see the same layout and colors on the page and assume it is correct one.
- Ajedi32 7y agoSure, but a few years ago the same was true of the visual indicators for plain DV https. Browsers responded with an effort to increase adoption of DV certs to the point where positive indicators for encrypted connections could be replaced by negative indicators for unencrypted connections. Could a similar approach not also work with EV certs? I acknowledge it's a bit harder, since not every site necessarily _needs_ full identity verification. (I don't really care about the legal entity that owns Hacker News, for example, I just care that it's the same site I signed up for back when I first created my account.) But for the sites where it _does_ matter, there's no reason why efforts couldn't be made to shift towards negative security indicators. (For example, perhaps browsers could warn users when the legal entity that owns a site changes.)
- nailer 7y agoLiterally everyone on the Chrome Security UX team tweets from a verified account. Even Troy Hunt does.
- rocqua 7y agoThat would be a pretty decent approach, but an EV cert does not assert that: > This key belongs to the owner of this domain name AND this domain name matches this business name. Instead, an EV cert comes with an extra name (the official business name) and then asserts: > This key belongs to the owner of this domain name AND this key belongs to the owner of this other business name Hence you get the image [1] of a website www.thesslstore.com but EV business name 'Rapid Web Services LLC'. Should that really mean that this counts as a 'verfied' domain that gets a tick-mark? That said, switching to a system more like the first assertion, and going with the 'verified' tick mark could work. It would make validating EV certs a lot harder though, as it requires a more subjective judgement to make. (e.g. could you validate windows.com for the company microsoft? What about youtu.be for youtube) Making a wrong judgement here should look pretty bad for a cert-issuer. [1] https://www.troyhunt.com/content/images/2019/08/image-4.png https://www.troyhunt.com/content/images/2019/08/image-4.png
- nailer 7y agoThat's a good point. I support: - Using trademarks (this fixes the US issue of per-state homonym attacks). - Not including the domain in the certificate at all. If an identity is verified, it's verified. Why limit where it can be used, or try and assert some unrelated fact? The SSL Store (Computer Services) [US] This has been suggested to Google, who indicated they were not interested.
- rocqua 7y ago> Not including the domain in the certificate at all. If an identity is verified, it's verified. Why limit where it can be used, or try and assert some unrelated fact? I strongly disagree. It is still a domain that is entered into the URL box. On the web, websites are defined by their domain name. That is the thing I want verified. For EV I also want verification the domain name matches a company that should have that name. But the core thing is a domain name.
- nailer 7y agoKeep in mind most domains are not typed manually into a URL box.