5 ms·

Another data point in the ongoing theme of EV certificates having basically no value. The other big data points being: browsers don't want to display them diff

Another data point in the ongoing theme of EV certificates having basically no value. The other big data points being: browsers don't want to display them differently, and users don't notice them being any different. Now we have that nobody is really checking them that closely. How much longer will these even exist?

Mathnerd314 7y ago
There was https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... from a year ago. Max length of a certificate is 2 years, so probably 2020. Maybe 2021-2022 if you count stragglers and businesses that are locked into long contracts.
- cmroanirgo 7y ago
  Mr Hunt also updated this statement recently: https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... "Extended Validation Certificates are (Really, Really) Dead"
jillesvangurp 7y ago
Ours are about to expire. I replaced them with free amazon certificates recently. The process of getting and deploying certificates three years ago was super painful. The process of replacing these certificates was super easy and renewal is now automated. Things have improved a lot since the letsencrypt movement kicked off a few years ago.
- donatj 7y ago
  I used to pay for certificates. Recently however, I got burned with a crappy Symantec one sold by Name resulting in near continuous customer reports of console errors in Chrome. I fought with Name to get them to reissue it, they wouldn’t. I decided it was time to figure out how to setup Let’s Encrypt. They lost me as a customer, and I’ll likely never buy a certificate again.
- CameronNemo 7y ago
  I wish InCommon/internet2 supported ACME. The admins at my work are quite busy as is, and ACME would definitely make for one less factor to be constantly concerned with.
drdaeman 7y ago
> browsers EV certs are still useful for code signing. At least on Windows UAC warnings look differently if binary is signed with EV certificate.
- GordonS 7y ago
  Does it? Windows is my daily driver, and I'm security-minded - yet I haven't noticed different colours for UAC dialogs depending on signature type. I notice if it's not signed at all, of course, but otherwise... no? I would imagine most typical end users are the same. Similar to how browsers are not actually, where they make it really obvious if a site doesn't use TLS, otherwise it all looks the same.
  - tialaramex 7y ago
    The comment you're responding to doesn't make this especially clear, but code signing only /has/ certificates with organisation names subject to an extended validation. The rules for those are: https://cabforum.org/ev-code-signing-certificate-guidelines/ https://cabforum.org/ev-code-signing-certificate-guidelines/ Whereas for the Web PKI (things that do SSL/TLS, including most obviously HTTPS on the web) there are both the baseline requirements for every certificate: https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/ and EV for adding "extended validation" to that: https://cabforum.org/extended-validation/ https://cabforum.org/extended-validation/ It's kinda useless to have a certificate that says this program is really named "Great Calculator". Oh yeah? So what? Whereas a certificate that says it's from "Microsoft Corp" in "Washington, US" at least tells me whose fault this calculator program is when it wrecks my PC. On the other hand, knowing this is really https://news.ycombinator.com/ https://news.ycombinator.com/ is kinda good because the machine can (and does) automatically check that this matches on every single URL resolved, every image, every HTTP POST, everything.
    - GordonS 7y ago
      Oh, I've bought code certificates before - I didn't realise the ridiculous process I had to go through was "extended validation "?! I had to give them a published telephone number for a callback. I don't publish a phone number, so I setup a Skype Number and published it in a free Yellow Pages kind of site - they did a callback, which obviously totally proves I work for Acme Stuff, and then I removed the listing and Skype Number. I recall there were a couple of other bits of theatre I had to endure, publishing information on random listing sites that don't do any validation of their own, but I don't remember exact what.
weinzierl 7y ago
> How much longer will these even exist? EVs will soon be gone when browsers stop recognizing them. We are already well on our way there. From the same author from a month ago [1]: > Both Google Chrome and Mozilla Firefox have announced that they plan to move the EV indicator out of their main UI. [1] https://scotthelme.co.uk/gone-for-ever/ https://scotthelme.co.uk/gone-for-ever/
- amenod 7y ago
  I don't think that's an indication that their CAs will be removed. Correct me if I'm wrong, but they are not less safe than other certificates, they just don't add any additional value. So they will probably be treated the same as other certificates by browsers. If people will continue paying for them is another matter of course (but it might very well happen that they will have many customers for years to last).
  - deleted 7y ago
    [deleted]
  - My1 7y ago
    EVs and security is a fun topic, including obvious sarcasm. They generally are more secure for 3 reasons: 1) hardfail on revocation checks 2) you can't get around any errors generated by an EV 3) you can't fake them by truststore manipulation (except ie and maybe edge) as the ev roots are hard compiled into the browser and not dependent on the external trust store. Validation would have been a 4th reasons if it wouldn't be for all the obvious problems with it especially lately. The problem is what people imply or are made to imply from different cert types. Back in the day people were told to just check for the lock, which obviously is dumb considering now everyone can get a dv for free. Then with EV CAs told people that sites with ev are more trustworthy. Obviously nonsense considering the excluded usages of EVs in the cabforum documents. EVs are only supposed to make a hard link between an offline and online legal entity, and even that failed with stripe.ian.sh (although that's not exactly the fault of EVs) EVs now get so much higher implied security that the real vs implied security ratio is obviously very ugly while DVs becoming standard obviously have much more real security than implied (if people check the urlbar correctly)
mytailorisrich 7y ago
> browsers don't want to display them differently, and users don't notice them being any different. That's the only thing that matters, really. The selling point of EV certificates is that (1) they are very visible in the browser and (2) users care enough about that to make a difference to your business. I haven't seen any surveys or A/B testing results about (2) but since (1) is no longer true this is moot. It means you should just go for the cheapest certificate, which means free nowadays.
- megous 7y ago
  Firefox displays them differently.
  - mytailorisrich 7y ago
    First thing to note is that Firefox is largely irrelevant versus Chrome and Safari in terms of marketshare. Chrome no longer displays EV certificates differently, I believe, that about 2 thirds of the market. The second thing is (2) is my previous comment: Even if an EV certificate is displayed differently, does anyone care? Does that impact my business to make it worthwhile? The general public could not care less, imo.
    - StavrosK 7y ago
      You're saying that Firefox's 9% is irrelevant versus Safari's 3%?
      - mytailorisrich 7y ago
        That's not the point of my comment both regarding EV certificates and regarding relevance of Firefox (and I don't know where you got those stats).
      - theevilsharpie 7y ago
        You are clearly excluding mobile browsing stats.
wbond 7y ago
Just yesterday someone asked if there was a way to verify if the email from a purchase was leading to the correct domain to log in to. They wanted to make sure they weren’t being phished. How I wished there was a simple button they could have clicked in their browser that would have shown a window with the company details for the website certificate. Everybody rails on how useless EVs are, yet it seems like no browsers have spent any time over the past years even trying to improve the UX related to certs. I mean, sure they’ve changed the color and removed the ambiguous company name and country. Which makes you ask why did they ever display country in situations where that isn’t the jurisdiction that issues business licenses, such as in the US? I mean, click on the lock and through N buttons, then expand various sections and read through dotted identifiers that only ASN.1 experts recognize (seriously, who though it would be a good idea to use OIDs for known fields in the UI?), and then maybe you’ll understand who the certificate is issued to. At least in the US, when obtaining and EV cert you need the jurisdiction (state), business registration number, they call the business phone number. They basically do some research - usually you need a DUNs number, publicly listed phone number, etc. Wouldn’t it make sense to have a button that when you click it you see a user-friendly window showing the information about the company for OV/EV? I mean, sure, you can register Stripe in a different state - how about providing some statistics like what year the company was formed (usually only file with business registration), a link to the company registration details on the jurisdiction website, the top level domain Whois info, etc? If you wanted to get fancy you could provide a link to the user’s search engine with the company name as the search terms. Instead it seems like we have a bunch of cryptographers (or maybe just infosec people) obsessed about 1. The money companies are charging for EV certs 2. that it is possible for mistakes to happen. This instead of improving how we present information about a company. So since there isn’t a perfect, foolproof identity verification system for companies online, now every user online needs to do their own reconnaissance to make sure this is really the website they should be at.
- tialaramex 7y ago
  Your proposal seems like it doesn't really change anything? Users are still left to "do their own reconnaissance". Research suggests they don't do a very good job at that.
commandlinefan 7y ago
When I saw that google, amazon, apple and Microsoft weren’t bothering with EV certs, I figured I didn’t need to either.
- megous 7y ago
  Google's cert is not really domain validated either. They have their own CA. Microsoft also has a CA. Apple has EV and Amazon uses DigiCert, which is the only one that may be domain validated, perhaps.
  - tialaramex 7y ago
    All four of them own publicly trusted CAs. However, they are certainly required to validate all the certificates they issue even to themselves. Several (all?) of them are domain registrars and so they would be able to rely on that to shortcut issuance validation for names in domains for which they are both registrar and owner, but it still happens it's just easier.

Mathnerd314 7y ago

There was https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... from a year ago. Max length of a certificate is 2 years, so probably 2020. Maybe 2021-2022 if you count stragglers and businesses that are locked into long contracts.

cmroanirgo 7y ago
Mr Hunt also updated this statement recently: https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... "Extended Validation Certificates are (Really, Really) Dead"

jillesvangurp 7y ago

Ours are about to expire. I replaced them with free amazon certificates recently. The process of getting and deploying certificates three years ago was super painful. The process of replacing these certificates was super easy and renewal is now automated. Things have improved a lot since the letsencrypt movement kicked off a few years ago.

donatj 7y ago
I used to pay for certificates. Recently however, I got burned with a crappy Symantec one sold by Name resulting in near continuous customer reports of console errors in Chrome. I fought with Name to get them to reissue it, they wouldn’t. I decided it was time to figure out how to setup Let’s Encrypt. They lost me as a customer, and I’ll likely never buy a certificate again.
CameronNemo 7y ago
I wish InCommon/internet2 supported ACME. The admins at my work are quite busy as is, and ACME would definitely make for one less factor to be constantly concerned with.

drdaeman 7y ago

> browsers EV certs are still useful for code signing. At least on Windows UAC warnings look differently if binary is signed with EV certificate.

GordonS 7y ago
Does it? Windows is my daily driver, and I'm security-minded - yet I haven't noticed different colours for UAC dialogs depending on signature type. I notice if it's not signed at all, of course, but otherwise... no? I would imagine most typical end users are the same. Similar to how browsers are not actually, where they make it really obvious if a site doesn't use TLS, otherwise it all looks the same.
- tialaramex 7y ago
  The comment you're responding to doesn't make this especially clear, but code signing only /has/ certificates with organisation names subject to an extended validation. The rules for those are: https://cabforum.org/ev-code-signing-certificate-guidelines/ https://cabforum.org/ev-code-signing-certificate-guidelines/ Whereas for the Web PKI (things that do SSL/TLS, including most obviously HTTPS on the web) there are both the baseline requirements for every certificate: https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/ and EV for adding "extended validation" to that: https://cabforum.org/extended-validation/ https://cabforum.org/extended-validation/ It's kinda useless to have a certificate that says this program is really named "Great Calculator". Oh yeah? So what? Whereas a certificate that says it's from "Microsoft Corp" in "Washington, US" at least tells me whose fault this calculator program is when it wrecks my PC. On the other hand, knowing this is really https://news.ycombinator.com/ https://news.ycombinator.com/ is kinda good because the machine can (and does) automatically check that this matches on every single URL resolved, every image, every HTTP POST, everything.
  - GordonS 7y ago
    Oh, I've bought code certificates before - I didn't realise the ridiculous process I had to go through was "extended validation "?! I had to give them a published telephone number for a callback. I don't publish a phone number, so I setup a Skype Number and published it in a free Yellow Pages kind of site - they did a callback, which obviously totally proves I work for Acme Stuff, and then I removed the listing and Skype Number. I recall there were a couple of other bits of theatre I had to endure, publishing information on random listing sites that don't do any validation of their own, but I don't remember exact what.

weinzierl 7y ago

> How much longer will these even exist? EVs will soon be gone when browsers stop recognizing them. We are already well on our way there. From the same author from a month ago [1]: > Both Google Chrome and Mozilla Firefox have announced that they plan to move the EV indicator out of their main UI. [1] https://scotthelme.co.uk/gone-for-ever/ https://scotthelme.co.uk/gone-for-ever/

amenod 7y ago
I don't think that's an indication that their CAs will be removed. Correct me if I'm wrong, but they are not less safe than other certificates, they just don't add any additional value. So they will probably be treated the same as other certificates by browsers. If people will continue paying for them is another matter of course (but it might very well happen that they will have many customers for years to last).
- deleted 7y ago
  [deleted]
- My1 7y ago
  EVs and security is a fun topic, including obvious sarcasm. They generally are more secure for 3 reasons: 1) hardfail on revocation checks 2) you can't get around any errors generated by an EV 3) you can't fake them by truststore manipulation (except ie and maybe edge) as the ev roots are hard compiled into the browser and not dependent on the external trust store. Validation would have been a 4th reasons if it wouldn't be for all the obvious problems with it especially lately. The problem is what people imply or are made to imply from different cert types. Back in the day people were told to just check for the lock, which obviously is dumb considering now everyone can get a dv for free. Then with EV CAs told people that sites with ev are more trustworthy. Obviously nonsense considering the excluded usages of EVs in the cabforum documents. EVs are only supposed to make a hard link between an offline and online legal entity, and even that failed with stripe.ian.sh (although that's not exactly the fault of EVs) EVs now get so much higher implied security that the real vs implied security ratio is obviously very ugly while DVs becoming standard obviously have much more real security than implied (if people check the urlbar correctly)

mytailorisrich 7y ago

> browsers don't want to display them differently, and users don't notice them being any different. That's the only thing that matters, really. The selling point of EV certificates is that (1) they are very visible in the browser and (2) users care enough about that to make a difference to your business. I haven't seen any surveys or A/B testing results about (2) but since (1) is no longer true this is moot. It means you should just go for the cheapest certificate, which means free nowadays.

megous 7y ago
Firefox displays them differently.
- mytailorisrich 7y ago
  First thing to note is that Firefox is largely irrelevant versus Chrome and Safari in terms of marketshare. Chrome no longer displays EV certificates differently, I believe, that about 2 thirds of the market. The second thing is (2) is my previous comment: Even if an EV certificate is displayed differently, does anyone care? Does that impact my business to make it worthwhile? The general public could not care less, imo.
  - StavrosK 7y ago
    You're saying that Firefox's 9% is irrelevant versus Safari's 3%?
    - mytailorisrich 7y ago
      That's not the point of my comment both regarding EV certificates and regarding relevance of Firefox (and I don't know where you got those stats).
    - theevilsharpie 7y ago
      You are clearly excluding mobile browsing stats.

wbond 7y ago

Just yesterday someone asked if there was a way to verify if the email from a purchase was leading to the correct domain to log in to. They wanted to make sure they weren’t being phished. How I wished there was a simple button they could have clicked in their browser that would have shown a window with the company details for the website certificate. Everybody rails on how useless EVs are, yet it seems like no browsers have spent any time over the past years even trying to improve the UX related to certs. I mean, sure they’ve changed the color and removed the ambiguous company name and country. Which makes you ask why did they ever display country in situations where that isn’t the jurisdiction that issues business licenses, such as in the US? I mean, click on the lock and through N buttons, then expand various sections and read through dotted identifiers that only ASN.1 experts recognize (seriously, who though it would be a good idea to use OIDs for known fields in the UI?), and then maybe you’ll understand who the certificate is issued to. At least in the US, when obtaining and EV cert you need the jurisdiction (state), business registration number, they call the business phone number. They basically do some research - usually you need a DUNs number, publicly listed phone number, etc. Wouldn’t it make sense to have a button that when you click it you see a user-friendly window showing the information about the company for OV/EV? I mean, sure, you can register Stripe in a different state - how about providing some statistics like what year the company was formed (usually only file with business registration), a link to the company registration details on the jurisdiction website, the top level domain Whois info, etc? If you wanted to get fancy you could provide a link to the user’s search engine with the company name as the search terms. Instead it seems like we have a bunch of cryptographers (or maybe just infosec people) obsessed about 1. The money companies are charging for EV certs 2. that it is possible for mistakes to happen. This instead of improving how we present information about a company. So since there isn’t a perfect, foolproof identity verification system for companies online, now every user online needs to do their own reconnaissance to make sure this is really the website they should be at.

tialaramex 7y ago
Your proposal seems like it doesn't really change anything? Users are still left to "do their own reconnaissance". Research suggests they don't do a very good job at that.

commandlinefan 7y ago

When I saw that google, amazon, apple and Microsoft weren’t bothering with EV certs, I figured I didn’t need to either.

megous 7y ago
Google's cert is not really domain validated either. They have their own CA. Microsoft also has a CA. Apple has EV and Amazon uses DigiCert, which is the only one that may be domain validated, perhaps.
- tialaramex 7y ago
  All four of them own publicly trusted CAs. However, they are certainly required to validate all the certificates they issue even to themselves. Several (all?) of them are domain registrars and so they would be able to rely on that to shortcut issuance validation for names in domains for which they are both registrar and owner, but it still happens it's just easier.