4 ms·
> that could also be fixed by tweaking EV requirements. (More than likely by putting a country flag on the EV banner.) Wrong. Company names are not guaranteed
by crote 1y ago
> that could also be fixed by tweaking EV requirements. (More than likely by putting a country flag on the EV banner.)
Wrong. Company names are not guaranteed to be unique per-country.
The main issue you are missing is that putting undeserved trust in things like DV / EV flags greatly increase the value of such attacks. If users are trained to blindly trust that shiny green bar, the odd attacker will be able to walk away with an absolute fortune. Nobody will be suspicious about that page, because Green Bar. Why is the "bank" asking odd questions? Who cares, it had a Green Bar, so it must be legitimate.
Why bother with hundreds of small attacks when one big one will make you rich?
- ocdtrekkie 1y agoThe extreme majority of criminals aren't doing Ocean's 11-style grand plan attacks here (usually, because... they don't work, the cost is high, and there's too many ways they can fail leaving you out of money with nothing to show for it). Removing the EV bar because you're afraid one attacker might find a way to exploit it becomes an incredible gift to the 99.9999% of attackers who have a much, much easier job to do. Like, you need to realize most phishing scammers are perfectly happy to make a bankofamericaaa.glitch.me page, because it's free, and without any good indicators for the legitimate bank to use like EV, really doesn't look that much different to the nontechnical customer than bankofamerica.com.