3 ms·

Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/ https://stripe.ian.

Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." EV cert glowing green (actual url https://stripe.ian.sh/ https://stripe.ian.sh/). Do you even read links? https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/ https://arstechnica.com/information-technology/2017/12/nope-... EV certs are an expensive boondoggle that add little-to-no value over DV certs. It's why all browser makers (not just Google) dropped any special rendering for them. The real value is pervasive TLS. Phishing and website impersonation should be tackled with a variety of practises, and EV certs don't really come into it. Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Your browser history should have it. You can bookmark it. If you've clicked a phishing link and you're on wellsfargo.com.badguy.com instead of wellsfargo.com, don't you find it odd you can't auto-fill your user/password any more? Maybe you're on the wrong site? Oh yes, there on the URL bar is "wellsfargo.com.badguy.com", I see it now. Can you imagine if we still had that awful special rendering for EV certs, and the wellsfargo.com.badguy.com owners incorporated "Wells Fargo" in Timbuktu and bought an EV cert for their legitimate business, and the entire URL bar was covered up with " Wells Fargo"... lol

ocdtrekkie 4y ago
> Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." This is merely an example of what I already stated: Validation practices and participation requirements need to be improved. I am well aware of this popular example. > Do you even read links? Please check the HN guidelines for conduct. I've actually already read all of the popular media on the topic. > Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Google regularly serves malware as the "top search result", because Google Ads appear to be search results to average users, and advertisers can lie about the destination URLs in text ads. Bing is not better in this respect either. If you trust your search engine, you might as well just plaintext all your traffic anyways.

ocdtrekkie 4y ago

> Mmmhmm, yes I'd definitely trust the "Stripe, Inc." website with the "Stripe, Inc." This is merely an example of what I already stated: Validation practices and participation requirements need to be improved. I am well aware of this popular example. > Do you even read links? Please check the HN guidelines for conduct. I've actually already read all of the popular media on the topic. > Your preferred search engine should give you the "real" Wells Fargo site if you search for that. Google regularly serves malware as the "top search result", because Google Ads appear to be search results to average users, and advertisers can lie about the destination URLs in text ads. Bing is not better in this respect either. If you trust your search engine, you might as well just plaintext all your traffic anyways.