4 ms·
Those instructions were always so clunky as was the process. Re: Godaddy, I was using their "EV" (Extended Validation) cert which added a company name indicato
by andirk 4y ago
Those instructions were always so clunky as was the process.
Re: Godaddy, I was using their "EV" (Extended Validation) cert which added a company name indicator in the address bar. I then learned that it's unwise to bring up security when someone isn't thinking about it because it puts them on undue alert. A couple years ago the browsers have done away with that EV badge altogether.
- mynameisvlad 4y agoBrowsers did away with it because it says nothing about the actual security status of a page compared to any other SSL page. All it means is that the organization was verified. Customers were seeing the prominent green text and assuming a heightened level of security and trust. Legal names are also not unique, and this loophole could be used for phishing. Instead, what browsers did was promote SSL as a default (regardless of certificate type) and point out HTTP connections as insecure.
- HWR_14 4y agoAnd make it almost impossible to use an out of date or self-signed cert. Some browsers make you click 3 times you know what you are doing, others don't seem to let you at all.
- meepmorp 4y agoFrom the client perspective, the difference between a self-signed certificate and a fake one that's part of MITM, etc., is completely invisible. It should be hard to get to ostensibly secured sites that can't prove they are who they say they are, and you don't want to train uses to just click through.
- HWR_14 4y agoIt's not invisible. An expired certificate is treated as worse than no certificate. All I want is for it to be easy enough to view it as an insecure site and stop trying to force me to https when there is a bad cert.
- deleted 4y ago[deleted]