4 ms·

Being able to force CAs to fix issues is important, but I hope nobody is supporting the EFF's drama about Extended Validation certificates: They're a good idea,

Being able to force CAs to fix issues is important, but I hope nobody is supporting the EFF's drama about Extended Validation certificates: They're a good idea, DV is mostly pointless, and there's actually a new version of EV, the Verified Mark certificate, now being promoted to access new types of features like BIMI. EV was never the wrong path, it just needs stricter checking mechanisms. Google wants people to dislike them because those checking mechanisms require humans and intentionally doesn't scale. (Good security does not scale, people who tell you it does are wrong.)

amiga386 4y ago
Users care that their website connection is secure and private. They don't care who owns the website. Even if they did, EV certs still let you bamboozle them: https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... On the other hand, Let's Encrypt has _securely_ issued billions of DV certs, automatically and for free, meaning millions of websites have gone from plaintext to TLS-secured. That has given the world a tangible increase in privacy and security, which is not "mostly pointless". An ideal future is that _every website in the world_ is TLS-secured, and the US Government loses its panopticon
- ocdtrekkie 4y ago
  This is completely wrong and lacks an attachment to the real world. People absolutely care if they're sending money to Wells Fargo, the real world bank, or a random dude named Well S. Fargo in some other country. However, most users do not care if the US government can see their traffic. (Whether or not they should... not the point.) And MITM attacks aren't a practical concern for the vast majority of society in a real world sense. EV certs do something largely useful. DV certs are mostly useless in practice but make tech nerds happy.
  - amiga386 4y ago
    Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/ https://stripe.ian.sh/). Do you even read links? https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... EV certs are an expensive boondoggle that add little-to-no value over DV certs. It's why all browser makers (not just Google) dropped any special rendering for them. The real value is pervasive TLS. Phishing and website impersonation should be tackled with a variety of practises, and EV certs don't really come into it. Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Your browser history should have it. You can bookmark it. If you've clicked a phishing link and you're on wellsfargo.com.badguy.com instead of wellsfargo.com, don't you find it odd you can't auto-fill your user/password any more? Maybe you're on the wrong site? Oh yes, there on the URL bar is "wellsfargo.com.badguy.com", I see it now. Can you imagine if we still had that awful special rendering for EV certs, and the wellsfargo.com.badguy.com owners incorporated "Wells Fargo" in Timbuktu and bought an EV cert for their legitimate business, and the entire URL bar was covered up with " Wells Fargo"... lol
    - ocdtrekkie 4y ago
      > Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." This is merely an example of what I already stated: Validation practices and participation requirements need to be improved. I am well aware of this popular example. > Do you even read links? Please check the HN guidelines for conduct. I've actually already read all of the popular media on the topic. > Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Google regularly serves malware as the "top search result", because Google Ads appear to be search results to average users, and advertisers can lie about the destination URLs in text ads. Bing is not better in this respect either. If you trust your search engine, you might as well just plaintext all your traffic anyways.

amiga386 4y ago

Users care that their website connection is secure and private. They don't care who owns the website. Even if they did, EV certs still let you bamboozle them: https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... On the other hand, Let's Encrypt has _securely_ issued billions of DV certs, automatically and for free, meaning millions of websites have gone from plaintext to TLS-secured. That has given the world a tangible increase in privacy and security, which is not "mostly pointless". An ideal future is that _every website in the world_ is TLS-secured, and the US Government loses its panopticon

ocdtrekkie 4y ago
This is completely wrong and lacks an attachment to the real world. People absolutely care if they're sending money to Wells Fargo, the real world bank, or a random dude named Well S. Fargo in some other country. However, most users do not care if the US government can see their traffic. (Whether or not they should... not the point.) And MITM attacks aren't a practical concern for the vast majority of society in a real world sense. EV certs do something largely useful. DV certs are mostly useless in practice but make tech nerds happy.
- amiga386 4y ago
  Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/ https://stripe.ian.sh/). Do you even read links? https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... EV certs are an expensive boondoggle that add little-to-no value over DV certs. It's why all browser makers (not just Google) dropped any special rendering for them. The real value is pervasive TLS. Phishing and website impersonation should be tackled with a variety of practises, and EV certs don't really come into it. Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Your browser history should have it. You can bookmark it. If you've clicked a phishing link and you're on wellsfargo.com.badguy.com instead of wellsfargo.com, don't you find it odd you can't auto-fill your user/password any more? Maybe you're on the wrong site? Oh yes, there on the URL bar is "wellsfargo.com.badguy.com", I see it now. Can you imagine if we still had that awful special rendering for EV certs, and the wellsfargo.com.badguy.com owners incorporated "Wells Fargo" in Timbuktu and bought an EV cert for their legitimate business, and the entire URL bar was covered up with " Wells Fargo"... lol
  - ocdtrekkie 4y ago
    > Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." This is merely an example of what I already stated: Validation practices and participation requirements need to be improved. I am well aware of this popular example. > Do you even read links? Please check the HN guidelines for conduct. I've actually already read all of the popular media on the topic. > Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Google regularly serves malware as the "top search result", because Google Ads appear to be search results to average users, and advertisers can lie about the destination URLs in text ads. Bing is not better in this respect either. If you trust your search engine, you might as well just plaintext all your traffic anyways.