>it was easy to get CAs to issue EV certs for company names that misled the user into thinking the phishing site was secure The other way was an issue as well.

>it was easy to get CAs to issue EV certs for company names that misled the user into thinking the phishing site was secure The other way was an issue as well. We could only get an EV cert for our real/primary company name, but not the subordinate name we had registered for our B2C business. That would mean that our customers would see the correct URL, but the EV would show the name of a company they didn't know.