3 ms·
I fundamentally think this is not a solvable problem using certs. Short of calling up the company directly and asking no amount of signaling in the browser will
by zaphar 5y ago
I fundamentally think this is not a solvable problem using certs. Short of calling up the company directly and asking no amount of signaling in the browser will help.
Also why do I care about an EV cert as a user? does it tell me anything actually useful? Things I do care about as a user:
* Is my connection encrypted? (Browsers tell me this just fine)
* Is the site known to be malicious? (Browsers tell me this just fine)
* Have I been MiTM'd (Browsers protect against this just fine)
Things I don't care about as a user:
* Is this site actually owned by a specific Corporation?
Literally have never cared. Not once. Knowing this has never made me more secure or given me more confidence because fundamentally knowing who someone on the internet is does not tell me how trustworthy they are without way more context.
- snowwrestler 5y agoYou don’t care if the banking website you’re using is actually owned by your bank?
- Karunamon 5y agoThe EV UI was sunset in all browsers because as it turns out, ensuring that your address bar says 'wellsfargo.com' and that you didn't get MITM'd is plenty good enough due to the other protections.
- deleted 5y ago[deleted]
- ROARosen 5y agoFor physical banks, every piece of stationary from my bank states their domain name so once I have a DV verified showing I'm actually connected to that domain I can trust it. For online banks, I only got to them online by which automatically means I have their correct domain name. The question of how I get the online bank's domain name to begin with does not really come in to this conversation, can be an ad, a friend etc.
- nailer 5y agoMost people don’t visit URLs by typing them into their browser. Links, messaging apps, email, native apps etc. account for more than manually typed links do.
- nailer 5y ago> Short of calling up the company directly and asking no amount of signaling in the browser will help. EV is literally the result of calling up the company directly and asking, signed by someone your browser trusts.