4 ms·

I never understood why, after finding out that users don't notice the EV security badge, Google/Mozilla decided the best course of action was to remove it compl

I never understood why, after finding out that users don't notice the EV security badge, Google/Mozilla decided the best course of action was to remove it completely. Rather the conclusion should've been that the browser gives the user a warning when attempting to submit information to a website that doesn't have an EV security certificate. Or at the very least allow websites to use HSTS to prevent downgrading an EV certificate.

pjsg 5y ago
Of course, it wouldn't have helped in this case as it was the third party site that had the bad certificate. That fact is not signalled anywhere. I don't recall anybody (even the most ardent supporters of EV) saying that the browser should warn you if any third party references were not EV.
- nilsbunger 5y ago
  But EV would give you a way to make a more secure website by hosting all the content yourself
- dboreham 5y ago
  That doesn't make sense since any content loaded from a second site has the ability to compromise the first. If nobody said that, they weren't thinking hard enough. Browsers already have this kind of transitive security enforcement -- you can't load a page with TLS that then pulls JS via plaintext http.
lexicality 5y ago
You think every website with a form on it should have to pay hundreds of dollars per year to certificate authorities?
- sp332 5y ago
  There should be a quick, visible way for a user to tell the difference between a connection that is merely encrypted and one where the identity of the certificate owner has been vetted. Then the user can decide for any given form whether they are comfortable sending that data over that kind of connection. Sometimes, the alternative to companies paying hundreds of dollars per year is customers losing millions.
- natpalmer1776 5y ago
  I think if a website with a form on it that involves transferring any sum of money around should pay hundreds of dollars per year to certificate authorities. Not every building needs to implement the security measures of Fort Knox. That doesn't mean that the security measures in-place at Fort Knox shouldn't exist.

pjsg 5y ago

Of course, it wouldn't have helped in this case as it was the third party site that had the bad certificate. That fact is not signalled anywhere. I don't recall anybody (even the most ardent supporters of EV) saying that the browser should warn you if any third party references were not EV.

nilsbunger 5y ago
But EV would give you a way to make a more secure website by hosting all the content yourself
dboreham 5y ago
That doesn't make sense since any content loaded from a second site has the ability to compromise the first. If nobody said that, they weren't thinking hard enough. Browsers already have this kind of transitive security enforcement -- you can't load a page with TLS that then pulls JS via plaintext http.

lexicality 5y ago

You think every website with a form on it should have to pay hundreds of dollars per year to certificate authorities?

sp332 5y ago
There should be a quick, visible way for a user to tell the difference between a connection that is merely encrypted and one where the identity of the certificate owner has been vetted. Then the user can decide for any given form whether they are comfortable sending that data over that kind of connection. Sometimes, the alternative to companies paying hundreds of dollars per year is customers losing millions.
natpalmer1776 5y ago
I think if a website with a form on it that involves transferring any sum of money around should pay hundreds of dollars per year to certificate authorities. Not every building needs to implement the security measures of Fort Knox. That doesn't mean that the security measures in-place at Fort Knox shouldn't exist.