3 ms·

Again, this is an incredibly naive and uninformed take. Yes. You can spend hundreds of dollars to make one attempt at malicious activity, and yeah, that could a

Again, this is an incredibly naive and uninformed take. Yes. You can spend hundreds of dollars to make one attempt at malicious activity, and yeah, that could also be fixed by tweaking EV requirements. (More than likely by putting a country flag on the EV banner.) One person as an example managing to get a problematic EV cert is not a sign of a broken system, it's a sign of a working system that only a few edge case examples exist. Cybercriminals work at scale. The opinion you shared here is why Google, Microsoft, and Amazon are so easy to use for cybercrime. It's incredibly easy to hide bad behavior in cheap, disposable attempts on free accounts. Cost virtually eliminates abuse. Bad actors are fronting effort and ideally small amounts of money to effectively bet on a high return. You make the cost to attempt high, it isn't worth it. Apart from some high profile blogs demonstrating the risk, EV certs have to my knowledge never been used maliciously, and hiding them from the browser bar just makes useful, high quality data about the trustworthiness of a site buried behind hidden menus.

crote 1y ago
> that could also be fixed by tweaking EV requirements. (More than likely by putting a country flag on the EV banner.) Wrong. Company names are not guaranteed to be unique per-country. The main issue you are missing is that putting undeserved trust in things like DV / EV flags greatly increase the value of such attacks. If users are trained to blindly trust that shiny green bar, the odd attacker will be able to walk away with an absolute fortune. Nobody will be suspicious about that page, because Green Bar. Why is the "bank" asking odd questions? Who cares, it had a Green Bar, so it must be legitimate. Why bother with hundreds of small attacks when one big one will make you rich?
- ocdtrekkie 1y ago
  The extreme majority of criminals aren't doing Ocean's 11-style grand plan attacks here (usually, because... they don't work, the cost is high, and there's too many ways they can fail leaving you out of money with nothing to show for it). Removing the EV bar because you're afraid one attacker might find a way to exploit it becomes an incredible gift to the 99.9999% of attackers who have a much, much easier job to do. Like, you need to realize most phishing scammers are perfectly happy to make a bankofamericaaa.glitch.me page, because it's free, and without any good indicators for the legitimate bank to use like EV, really doesn't look that much different to the nontechnical customer than bankofamerica.com.

crote 1y ago

> that could also be fixed by tweaking EV requirements. (More than likely by putting a country flag on the EV banner.) Wrong. Company names are not guaranteed to be unique per-country. The main issue you are missing is that putting undeserved trust in things like DV / EV flags greatly increase the value of such attacks. If users are trained to blindly trust that shiny green bar, the odd attacker will be able to walk away with an absolute fortune. Nobody will be suspicious about that page, because Green Bar. Why is the "bank" asking odd questions? Who cares, it had a Green Bar, so it must be legitimate. Why bother with hundreds of small attacks when one big one will make you rich?

ocdtrekkie 1y ago
The extreme majority of criminals aren't doing Ocean's 11-style grand plan attacks here (usually, because... they don't work, the cost is high, and there's too many ways they can fail leaving you out of money with nothing to show for it). Removing the EV bar because you're afraid one attacker might find a way to exploit it becomes an incredible gift to the 99.9999% of attackers who have a much, much easier job to do. Like, you need to realize most phishing scammers are perfectly happy to make a bankofamericaaa.glitch.me page, because it's free, and without any good indicators for the legitimate bank to use like EV, really doesn't look that much different to the nontechnical customer than bankofamerica.com.