3 ms·

Chrome 77 removed the prominent green EV badge. "A series of academic research in the 2000s studied the EV UI in lab and survey settings, and found that the EV

by bux93 2y ago

Chrome 77 removed the prominent green EV badge. "A series of academic research in the 2000s studied the EV UI in lab and survey settings, and found that the EV UI was not protecting against phishing attacks as intended. The Chrome Security UX team recently published a study that updated these findings with a large-scale field experiment, as well as a series of survey experiments." [1] Extended Validation can still play a role in a corporate's IT control framework; the extended validation is essentially a check-of-paperwork that then doesn't need to be performed by your own auditor. Some EV certificates also come with some (probably completely useless) liability insurance. [1] https://chromium.googlesource.com/chromium/src/%2B/HEAD/docs/security/ev-to-page-info.md https://chromium.googlesource.com/chromium/src/%2B/HEAD/docs...

duskwuff 2y ago
> Some EV certificates also come with some (probably completely useless) liability insurance. Warranties / insurance on SSL certificates typically only pay out if a certificate is issued improperly, often in conjunction with other conditions like a financial loss directly resulting from the misissuance. Realistically, any screwup serious enough to result in that warranty paying out would also result in the CA being abruptly removed from browser root certificate programs.
- deleted 2y ago
  [deleted]
- uid65534 2y ago
  Ah yes, I too remember when COMODO was ripped out of browsers in 2011 when it came to light they gave sign-anything rights to a bunch of resellers, one of whom was hacked. And then again in 2016. And another fun one unrelated to signing was when they tried to trademark "Let's Encrypt" in 2015. But yes, it is not a common issue and effort would be better focused on improving site security in other ways. (unlike the rest of my comment, this line isn't sarcasm.)

by bux93 2y ago

duskwuff 2y ago

> Some EV certificates also come with some (probably completely useless) liability insurance. Warranties / insurance on SSL certificates typically only pay out if a certificate is issued improperly, often in conjunction with other conditions like a financial loss directly resulting from the misissuance. Realistically, any screwup serious enough to result in that warranty paying out would also result in the CA being abruptly removed from browser root certificate programs.

deleted 2y ago
[deleted]
uid65534 2y ago
Ah yes, I too remember when COMODO was ripped out of browsers in 2011 when it came to light they gave sign-anything rights to a bunch of resellers, one of whom was hacked. And then again in 2016. And another fun one unrelated to signing was when they tried to trademark "Let's Encrypt" in 2015. But yes, it is not a common issue and effort would be better focused on improving site security in other ways. (unlike the rest of my comment, this line isn't sarcasm.)