2 ms·
Sure, but a few years ago the same was true of the visual indicators for plain DV https. Browsers responded with an effort to increase adoption of DV certs to t
by Ajedi32 7y ago
Sure, but a few years ago the same was true of the visual indicators for plain DV https. Browsers responded with an effort to increase adoption of DV certs to the point where positive indicators for encrypted connections could be replaced by negative indicators for unencrypted connections. Could a similar approach not also work with EV certs?
I acknowledge it's a bit harder, since not every site necessarily _needs_ full identity verification. (I don't really care about the legal entity that owns Hacker News, for example, I just care that it's the same site I signed up for back when I first created my account.) But for the sites where it _does_ matter, there's no reason why efforts couldn't be made to shift towards negative security indicators. (For example, perhaps browsers could warn users when the legal entity that owns a site changes.)