3 ms·

seems like you are completely missing the use case, if you think EV certificates are for frequently visited website. I, for one, always make sure my bank has E

seems like you are completely missing the use case, if you think EV certificates are for frequently visited website. I, for one, always make sure my bank has EV before I enter the password. the fact that most people don't doesn't change the fact that it does provide additional trust for those who are aware. security isn't all or nothing. the second use case is when you first visit a website, which potentially asks for credit card number or anything sensitive, it does improve your trust and reduces the friction with lesser known websites. of course PayPal, as a well known and trusted website doesn't need it - nobody is asking themselves if they should trust PayPal. again, it's probably not a security boundary, and it's probably not impossible to generate bogus ev certs, it's better than nothing.

rocqua 7y ago
Paypal is an interesting case [1]. Whether they served an EV-cert differed based on browser. If EV worked, that would mean people who switched browsers would refuse to use paypal. And yet, there are no reports of people thinking their paypal is untrusted. Nor did paypal decide to roll out EV everywhere because they were losing users. [1] https://www.troyhunt.com/paypals-beautiful-demonstration-of-extended-validation-fud/ https://www.troyhunt.com/paypals-beautiful-demonstration-of-... edit: Claimed that EV differed based on location, but it was based on browser.
eridius 7y ago
I, for one, have absolutely no idea if my bank uses EV. Let me check... ok yeah they have it. But I would not have noticed in a million years if they got rid of it. The real security here isn't the cert, it's the fact that I use a password manager and it will refuse to enter my password if I'm not on the right site. If I pop open 1Password and it doesn't offer me my bank login, then clearly I'm not on my bank's website.

rocqua 7y ago

Paypal is an interesting case [1]. Whether they served an EV-cert differed based on browser. If EV worked, that would mean people who switched browsers would refuse to use paypal. And yet, there are no reports of people thinking their paypal is untrusted. Nor did paypal decide to roll out EV everywhere because they were losing users. [1] https://www.troyhunt.com/paypals-beautiful-demonstration-of-extended-validation-fud/ https://www.troyhunt.com/paypals-beautiful-demonstration-of-... edit: Claimed that EV differed based on location, but it was based on browser.

eridius 7y ago

I, for one, have absolutely no idea if my bank uses EV. Let me check... ok yeah they have it. But I would not have noticed in a million years if they got rid of it. The real security here isn't the cert, it's the fact that I use a password manager and it will refuse to enter my password if I'm not on the right site. If I pop open 1Password and it doesn't offer me my bank login, then clearly I'm not on my bank's website.