4 ms·

This is completely wrong and lacks an attachment to the real world. People absolutely care if they're sending money to Wells Fargo, the real world bank, or a ra

This is completely wrong and lacks an attachment to the real world. People absolutely care if they're sending money to Wells Fargo, the real world bank, or a random dude named Well S. Fargo in some other country. However, most users do not care if the US government can see their traffic. (Whether or not they should... not the point.) And MITM attacks aren't a practical concern for the vast majority of society in a real world sense. EV certs do something largely useful. DV certs are mostly useless in practice but make tech nerds happy.

amiga386 4y ago
Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/ https://stripe.ian.sh/). Do you even read links? https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... EV certs are an expensive boondoggle that add little-to-no value over DV certs. It's why all browser makers (not just Google) dropped any special rendering for them. The real value is pervasive TLS. Phishing and website impersonation should be tackled with a variety of practises, and EV certs don't really come into it. Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Your browser history should have it. You can bookmark it. If you've clicked a phishing link and you're on wellsfargo.com.badguy.com instead of wellsfargo.com, don't you find it odd you can't auto-fill your user/password any more? Maybe you're on the wrong site? Oh yes, there on the URL bar is "wellsfargo.com.badguy.com", I see it now. Can you imagine if we still had that awful special rendering for EV certs, and the wellsfargo.com.badguy.com owners incorporated "Wells Fargo" in Timbuktu and bought an EV cert for their legitimate business, and the entire URL bar was covered up with " Wells Fargo"... lol
- ocdtrekkie 4y ago
  > Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." This is merely an example of what I already stated: Validation practices and participation requirements need to be improved. I am well aware of this popular example. > Do you even read links? Please check the HN guidelines for conduct. I've actually already read all of the popular media on the topic. > Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Google regularly serves malware as the "top search result", because Google Ads appear to be search results to average users, and advertisers can lie about the destination URLs in text ads. Bing is not better in this respect either. If you trust your search engine, you might as well just plaintext all your traffic anyways.

amiga386 4y ago

Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/ https://stripe.ian.sh/). Do you even read links? https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... EV certs are an expensive boondoggle that add little-to-no value over DV certs. It's why all browser makers (not just Google) dropped any special rendering for them. The real value is pervasive TLS. Phishing and website impersonation should be tackled with a variety of practises, and EV certs don't really come into it. Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Your browser history should have it. You can bookmark it. If you've clicked a phishing link and you're on wellsfargo.com.badguy.com instead of wellsfargo.com, don't you find it odd you can't auto-fill your user/password any more? Maybe you're on the wrong site? Oh yes, there on the URL bar is "wellsfargo.com.badguy.com", I see it now. Can you imagine if we still had that awful special rendering for EV certs, and the wellsfargo.com.badguy.com owners incorporated "Wells Fargo" in Timbuktu and bought an EV cert for their legitimate business, and the entire URL bar was covered up with " Wells Fargo"... lol

ocdtrekkie 4y ago
> Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." This is merely an example of what I already stated: Validation practices and participation requirements need to be improved. I am well aware of this popular example. > Do you even read links? Please check the HN guidelines for conduct. I've actually already read all of the popular media on the topic. > Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Google regularly serves malware as the "top search result", because Google Ads appear to be search results to average users, and advertisers can lie about the destination URLs in text ads. Bing is not better in this respect either. If you trust your search engine, you might as well just plaintext all your traffic anyways.