5 ms·

But aren't there some differences? LE doesn't verify identitiy. Though I'm not saying that the big CEs are that thorough.

by V__ 1y ago

Kwpolska 1y ago
Browsers stopped prominently showing the identities in EV certificates long ago. There is zero value in paying for a TLS certificate.
- Telemakhos 1y ago
  I remember many moons ago, like the Netscape era, when companies that paid for EV certs got special icons and a green address and all sorts of browser indications of trustworthiness. I just tried my (large, international) bank website in the latest Safari, and I can't even figure out how to view the cert. There's an assumption that every site will have some cert, but no special treatment for EV certs at all.
  - ctm92 1y ago
    In Chrome you can click on the icon next to the address and then on security, it will show the name of the company the cert is issued to. Quite hidden though. But yeah, Safari is always something i have trouble finding the cert, they are really hiding it.
    - kedihacker 1y ago
      Well it can be bypassed by setting up a new company with the same name. Someone had done that against stripe I remember.
      - TRiG_Ireland 1y ago
        EV certs show the company name and the country, for disambiguation, on the assumption that you cannot have two companies of the same name in the same country. However, this is not true in the USA, where names are unique only within each state. That's how someone got an EV cert for Stripe (USA).
- nailer 1y ago
  That’s true. It’s a bit of a self fulfilling prophesy: the browsers didn’t present a meaningful verification UI, then removed the UI because users didn’t find it meaningful. Steak isn’t delicious because, after I pee on it, people dislike the taste. The concept of matching an real world identity to a public key is very much intact outside the browser world.
  - Kwpolska 1y ago
    Browsers did display EV certs in very significant ways in the 2010s with green address bars. Safari even hid the URL and only displayed the certificate owner name.
    - nailer 1y ago
      > with green address bars. Yes. A green address bar isn't meaningful verification UI. That is why no other platform uses green bars for verification.
bruce511 1y ago
Whether the CA verifies identity or not is irrelevant. Since the end user does not see the certificate they are all functionally equivalent. And yes, the actual quality of the identity check is debatable but since nobody cares the utility of it is zero. For example- when was the last time you checked the certificate details of a web site? Have you ever left a site because you felt the certificate didn't verify identity?

But aren't there some differences? LE doesn't verify identitiy. Though I'm not saying that the big CEs are that thorough.

by V__ 1y ago

But aren't there some differences? LE doesn't verify identitiy. Though I'm not saying that the big CEs are that thorough.

Kwpolska 1y ago

Browsers stopped prominently showing the identities in EV certificates long ago. There is zero value in paying for a TLS certificate.

Telemakhos 1y ago
I remember many moons ago, like the Netscape era, when companies that paid for EV certs got special icons and a green address and all sorts of browser indications of trustworthiness. I just tried my (large, international) bank website in the latest Safari, and I can't even figure out how to view the cert. There's an assumption that every site will have some cert, but no special treatment for EV certs at all.
- ctm92 1y ago
  In Chrome you can click on the icon next to the address and then on security, it will show the name of the company the cert is issued to. Quite hidden though. But yeah, Safari is always something i have trouble finding the cert, they are really hiding it.
  - kedihacker 1y ago
    Well it can be bypassed by setting up a new company with the same name. Someone had done that against stripe I remember.
    - TRiG_Ireland 1y ago
      EV certs show the company name and the country, for disambiguation, on the assumption that you cannot have two companies of the same name in the same country. However, this is not true in the USA, where names are unique only within each state. That's how someone got an EV cert for Stripe (USA).
nailer 1y ago
That’s true. It’s a bit of a self fulfilling prophesy: the browsers didn’t present a meaningful verification UI, then removed the UI because users didn’t find it meaningful. Steak isn’t delicious because, after I pee on it, people dislike the taste. The concept of matching an real world identity to a public key is very much intact outside the browser world.
- Kwpolska 1y ago
  Browsers did display EV certs in very significant ways in the 2010s with green address bars. Safari even hid the URL and only displayed the certificate owner name.
  - nailer 1y ago
    > with green address bars. Yes. A green address bar isn't meaningful verification UI. That is why no other platform uses green bars for verification.

bruce511 1y ago

Whether the CA verifies identity or not is irrelevant. Since the end user does not see the certificate they are all functionally equivalent. And yes, the actual quality of the identity check is debatable but since nobody cares the utility of it is zero. For example- when was the last time you checked the certificate details of a web site? Have you ever left a site because you felt the certificate didn't verify identity?