5 ms·

It's legitimacy for the connection, not for the domain. Who trains people to trust every domain?

Deukhoofd 7y ago
Banks did for a while, many banks told you to look for the green padlock to ensure it was the right site.
wongarsu 7y ago
An EV certificate is still a decent proxy for legitimacy: it's somewhat expensive to get and allows you to track down a legal entity. Both points deter scammers and other evil-doers, even if they don't completely prevent them. Sadly there's no way to judge from just the URL if a site has an EV cert or just a cheap/free https cert, and by the time you opened it in the browser it might be too late.
- PeterisP 7y ago
  A lack of EV certificate is not a decent proxy for legitimacy, because most of legitimate important sites don't have an EV certificate - so people can't be trained to think that they should think twice if an EV certificate is absent.
  - SmellyGeekBoy 7y ago
    EV certificates are a scam anyway.
  - wongarsu 7y ago
    I sure would do a double take if I noticed a bank website using a non-EV cert or an EV cert issued to somebody other than the bank. But that's probably one of the few industries where you can expect it.
  - SAI_Peregrinus 7y ago
    They also don't show up any differently in browsers any more. There's no difference a user can see unless they go through the menus to view the cert itself.
- SAI_Peregrinus 7y ago
  Not really. "Legal Entity" doesn't mean much, it's cheap to register a company and the name doesn't have to be unique. One guy registered a company called "Stripe" and got an EV cert for his site.[1] Modern web browsers don't show anything different for EV certs (try it). They stopped last year, mostly because EV certs were ineffective. [1] https://stripe.ian.sh/ https://stripe.ian.sh/
Operyl 7y ago
The reality is a lot of _us_ did, because we were trying to train the older generations some sensible internet habits. At the time, it was just easier to say “look for the green, and the bank company name next to it.” When we started killing the EV UI stuff (due to lack of UI space or what have you), people just kept looking for the padlock.
- saagarjha 7y ago
  It’s easy to phish people with EV certificate name collisions.
  - Operyl 7y ago
    At the time nobody was thinking about that though. Times change, we get smarter, new flaws are exposed, etc.
tonetheman 7y ago
Yes. I am not sure it really says anything about legit-ness either. It really only guarantees you and the next person you are talking to in the chain have an encrypted connection. Hard to explain that to anyone really.

Banks did for a while, many banks told you to look for the green padlock to ensure it was the right site.

An EV certificate is still a decent proxy for legitimacy: it's somewhat expensive to get and allows you to track down a legal entity. Both points deter scammers and other evil-doers, even if they don't completely prevent them. Sadly there's no way to judge from just the URL if a site has an EV cert or just a cheap/free https cert, and by the time you opened it in the browser it might be too late.

PeterisP 7y ago
A lack of EV certificate is not a decent proxy for legitimacy, because most of legitimate important sites don't have an EV certificate - so people can't be trained to think that they should think twice if an EV certificate is absent.
- SmellyGeekBoy 7y ago
  EV certificates are a scam anyway.
- wongarsu 7y ago
  I sure would do a double take if I noticed a bank website using a non-EV cert or an EV cert issued to somebody other than the bank. But that's probably one of the few industries where you can expect it.
- SAI_Peregrinus 7y ago
  They also don't show up any differently in browsers any more. There's no difference a user can see unless they go through the menus to view the cert itself.
SAI_Peregrinus 7y ago
Not really. "Legal Entity" doesn't mean much, it's cheap to register a company and the name doesn't have to be unique. One guy registered a company called "Stripe" and got an EV cert for his site.[1] Modern web browsers don't show anything different for EV certs (try it). They stopped last year, mostly because EV certs were ineffective. [1] https://stripe.ian.sh/ https://stripe.ian.sh/

Operyl 7y ago

The reality is a lot of _us_ did, because we were trying to train the older generations some sensible internet habits. At the time, it was just easier to say “look for the green, and the bank company name next to it.” When we started killing the EV UI stuff (due to lack of UI space or what have you), people just kept looking for the padlock.

saagarjha 7y ago
It’s easy to phish people with EV certificate name collisions.
- Operyl 7y ago
  At the time nobody was thinking about that though. Times change, we get smarter, new flaws are exposed, etc.

tonetheman 7y ago

Yes. I am not sure it really says anything about legit-ness either. It really only guarantees you and the next person you are talking to in the chain have an encrypted connection. Hard to explain that to anyone really.