6 ms·
From user's perspective only difference between EV certificate, LetsEncrypt certificate and no certificate are couple of words hidden somewhere in browser UI an
by 5560675260 5y ago
From user's perspective only difference between EV certificate, LetsEncrypt certificate and no certificate are couple of words hidden somewhere in browser UI and maybe an icon. You still need some level of expertise to use this info, IMO even more than you'd need to notice that "chase.com.xxx.xxx" isn't legit.
- Ajedi32 5y agoYes, and that's a problem with browser UI that should be solved. This is a major flaw I've seen with a lot of the anti-EV rhetoric that's been espoused in recent years by security experts and browser vendors. They correctly identify that the EV certificate system has major flaws, then incorrectly conclude that rather than fix those flaws, the solution is to get rid of the EV certificate system. Yes, EV certs are currently insufficient as means of identity verification. How does eliminating EV certificates solve that problem? What alternative is being proposed that would be better than EV certificates at verifying the identity of real-world entities? So far, the plan seems to be to just get rid of EV certificates and replace them with... nothing? That's not exactly helping the situation.
- nailer 5y ago> You still need some level of expertise to use this info Verification markers are common UI elements used on Instagram, Twitter, Facebook, WhatsApp and many other end user focused apps.