3 ms·
Browsers did away with it because it says nothing about the actual security status of a page compared to any other SSL page. All it means is that the organizati
by mynameisvlad 4y ago
Browsers did away with it because it says nothing about the actual security status of a page compared to any other SSL page. All it means is that the organization was verified.
Customers were seeing the prominent green text and assuming a heightened level of security and trust.
Legal names are also not unique, and this loophole could be used for phishing.
Instead, what browsers did was promote SSL as a default (regardless of certificate type) and point out HTTP connections as insecure.
- HWR_14 4y agoAnd make it almost impossible to use an out of date or self-signed cert. Some browsers make you click 3 times you know what you are doing, others don't seem to let you at all.
- meepmorp 4y agoFrom the client perspective, the difference between a self-signed certificate and a fake one that's part of MITM, etc., is completely invisible. It should be hard to get to ostensibly secured sites that can't prove they are who they say they are, and you don't want to train uses to just click through.
- HWR_14 4y agoIt's not invisible. An expired certificate is treated as worse than no certificate. All I want is for it to be easy enough to view it as an insecure site and stop trying to force me to https when there is a bad cert.
- deleted 4y ago[deleted]