6 ms·

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with

by btown 10mo ago

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar...

yabones 10mo ago
Call me old-school, but I really liked how EV certs looked in the browser. Same with the big green lock icon Firefox used to have. I know it's all theatrics at best and a scam at worst, but I really feel like it's a bit of a downgrade.
- wnevets 10mo ago
  > Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.
  - arccy 10mo ago
    i think the point was that EV didn't actually mean anything because the checks were too loose. it's a feel good false sense of security
  - RonanSoleste 10mo ago
    When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.
    - brians 10mo ago
      Having run an EV issuing practice… they were required to contact you at a D&B listed number or address.
    - Uvix 10mo ago
      Depends on the registrar. Globalsign required the phone number to be one publicly listed for the company in some business registry (I forget exactly which one), so it had to be someone in our main corporate office who'd deal with them on the phone.
      - bangaladore 10mo ago
        For an online business in a dubious (but legal) domain, my co-owner spent a few hundred bucks registering a business in New Mexico with a registered agent to get an EV cert. So, a barrier to entry, but not much of one.
        invokestatic 10mo ago
        I have an almost identical story except the state in question was Nevada. I’m curious what “dubious” domain it was, for me it was video game cheats. Maybe I’m actually the co-owner you’re talking about. :)
        dale-cooper 10mo ago
        This made me curious. Like selling cheats for games?
        bangaladore 10mo ago
        Yes, both in the case of them and I.
      - progmetaldev 10mo ago
        Dun and Bradstreet (?). I believe I'm remembering this correctly. I still deal with a few financial institutions that insist on using an EV SSL certificate on their websites. I may be wrong, but I believe that having an EV SSL gives a larger insurance dollar amount should the security be compromised from the EV certificate (although I imagine it would be nearly impossible to prove). When I last reissued an EV SSL (recently), I had to create a CNAME record to prove domain ownership, as well as provide the financial institution's CEO's information which they matched up with Dun & Bradstreet and called to confirm. The entire process took about three days to complete.
- woleium 10mo ago
  it’s okay, the scam continues with BIMI
- gerdesj 10mo ago
  "it's all theatrics at best" Only IT understand any of this SSL/TLS stuff and we screwed up the messaging. The message has always been somewhat muddled and that will never work efficiently.
unethical_ban 10mo ago
EV validated not only that a domain was under control of the server requesting the cert, but that the domain was under control of the entity claiming it. I kind of wish they still had it, and I kind of wish browsers indicated that a cert was signed by a global CA (real cert store trusted by the browsers) or an aftermarket CA, so people can see that their stuff is being decrypted by their company.
- arccy 10mo ago
  you can find quite of few examples online that the entity check wasn't all that strict...
- tadfisher 10mo ago
  Problem is, I can easily set up a company and get an EV cert for "FooBar Technologies, LLC" and phish customers looking for "FooBar Incorporated" or "International FooBar Corp.". Approximately zero users know the actual entity name of the real FooBar.
  - matrss 10mo ago
    Even if the users knew exactly what the name of the entity whose website they wanted to visit was: that name is not unique, as is shown by the "Stripe, Inc" example in the parents linked blog post.
  - btown 10mo ago
    BIMI, as misguided as it is, does aim to solve this by tying registration to insanely high prices and government-registered trademark verification. You would have a hard time registering the Stripe trademark nowadays in a way that would get you a BIMI certificate for that name/logo. https://www.thesslstore.com/resources/bimi-certificate-cost-for-cmcs-and-vmcs/ https://www.thesslstore.com/resources/bimi-certificate-cost-... But I'm glad that it hasn't caught on as strongly-expected by the public (or even commonly used). Big brands shouldn't be able to buy their way into inbox placement in ways that smaller companies can't replicate.
    - 10mo ago
charlesbarbier 10mo ago
It was a red herring the entire time. At Shopify we made experiment regarding conversion between regular certs and EV before they stop being displayed and there was no significant difference. The users don't notice the absence of the fancier green lock.
- bruce511 10mo ago
  I think the rebuttal to the CEO today is really very simple. a) How many of the sites you visit everyday have DV and how many have EV certificates? b) Name any site at all, that you have visited, where your behavior or opinion has changed because of the certificate? In truth the green-bar thing disappeared on mobile long before desktop (and in some cases it was never present.) In truth if you polled all the company staff, or crumbs just the people round the boardroom table (probably including the person complaining) a rounding error from 0 could show you how to even determine if a cert was DV or EV. EV could have an inspector literally visit your place of business, and it would still have no value because EVs are invisible to site visitors.
  - dijit 10mo ago
    it used to be that EV certs had higher insurance if there was a leak of the intermediate private keys and lost data. Since nobody ever actually leaked an intermediate private key for a CA, people don't recognise the value. If we had lost payment card information through MITM, we would have been liable for a lot more money. That was the business justification for EV back when I was doing major ecommerce stuff.
smurda 10mo ago
I loved the visualization of EV certs in browsers, but in 2014 vendors like GoDaddy charged $100/yr for them. https://web.archive.org/web/20131023033903/http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=9039 https://web.archive.org/web/20131023033903/http://www.godadd... I'm glad LE, browsers, and others like Cloudflare brought this cost to $0. Eliminating this unnecessary cost is good for the internet.

by btown 10mo ago

yabones 10mo ago

Call me old-school, but I really liked how EV certs looked in the browser. Same with the big green lock icon Firefox used to have. I know it's all theatrics at best and a scam at worst, but I really feel like it's a bit of a downgrade.

wnevets 10mo ago
> Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.
- arccy 10mo ago
  i think the point was that EV didn't actually mean anything because the checks were too loose. it's a feel good false sense of security
- RonanSoleste 10mo ago
  When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.
  - brians 10mo ago
    Having run an EV issuing practice… they were required to contact you at a D&B listed number or address.
  - Uvix 10mo ago
    Depends on the registrar. Globalsign required the phone number to be one publicly listed for the company in some business registry (I forget exactly which one), so it had to be someone in our main corporate office who'd deal with them on the phone.
    - bangaladore 10mo ago
      For an online business in a dubious (but legal) domain, my co-owner spent a few hundred bucks registering a business in New Mexico with a registered agent to get an EV cert. So, a barrier to entry, but not much of one.
      - invokestatic 10mo ago
        I have an almost identical story except the state in question was Nevada. I’m curious what “dubious” domain it was, for me it was video game cheats. Maybe I’m actually the co-owner you’re talking about. :)
        dale-cooper 10mo ago
        This made me curious. Like selling cheats for games?
        bangaladore 10mo ago
        Yes, both in the case of them and I.
    - progmetaldev 10mo ago
      Dun and Bradstreet (?). I believe I'm remembering this correctly. I still deal with a few financial institutions that insist on using an EV SSL certificate on their websites. I may be wrong, but I believe that having an EV SSL gives a larger insurance dollar amount should the security be compromised from the EV certificate (although I imagine it would be nearly impossible to prove). When I last reissued an EV SSL (recently), I had to create a CNAME record to prove domain ownership, as well as provide the financial institution's CEO's information which they matched up with Dun & Bradstreet and called to confirm. The entire process took about three days to complete.
woleium 10mo ago
it’s okay, the scam continues with BIMI
gerdesj 10mo ago
"it's all theatrics at best" Only IT understand any of this SSL/TLS stuff and we screwed up the messaging. The message has always been somewhat muddled and that will never work efficiently.

unethical_ban 10mo ago

EV validated not only that a domain was under control of the server requesting the cert, but that the domain was under control of the entity claiming it. I kind of wish they still had it, and I kind of wish browsers indicated that a cert was signed by a global CA (real cert store trusted by the browsers) or an aftermarket CA, so people can see that their stuff is being decrypted by their company.

arccy 10mo ago
you can find quite of few examples online that the entity check wasn't all that strict...
tadfisher 10mo ago
Problem is, I can easily set up a company and get an EV cert for "FooBar Technologies, LLC" and phish customers looking for "FooBar Incorporated" or "International FooBar Corp.". Approximately zero users know the actual entity name of the real FooBar.
- matrss 10mo ago
  Even if the users knew exactly what the name of the entity whose website they wanted to visit was: that name is not unique, as is shown by the "Stripe, Inc" example in the parents linked blog post.
- btown 10mo ago
  BIMI, as misguided as it is, does aim to solve this by tying registration to insanely high prices and government-registered trademark verification. You would have a hard time registering the Stripe trademark nowadays in a way that would get you a BIMI certificate for that name/logo. https://www.thesslstore.com/resources/bimi-certificate-cost-for-cmcs-and-vmcs/ https://www.thesslstore.com/resources/bimi-certificate-cost-... But I'm glad that it hasn't caught on as strongly-expected by the public (or even commonly used). Big brands shouldn't be able to buy their way into inbox placement in ways that smaller companies can't replicate.
  - 10mo ago

charlesbarbier 10mo ago

It was a red herring the entire time. At Shopify we made experiment regarding conversion between regular certs and EV before they stop being displayed and there was no significant difference. The users don't notice the absence of the fancier green lock.

bruce511 10mo ago
I think the rebuttal to the CEO today is really very simple. a) How many of the sites you visit everyday have DV and how many have EV certificates? b) Name any site at all, that you have visited, where your behavior or opinion has changed because of the certificate? In truth the green-bar thing disappeared on mobile long before desktop (and in some cases it was never present.) In truth if you polled all the company staff, or crumbs just the people round the boardroom table (probably including the person complaining) a rounding error from 0 could show you how to even determine if a cert was DV or EV. EV could have an inspector literally visit your place of business, and it would still have no value because EVs are invisible to site visitors.
- dijit 10mo ago
  it used to be that EV certs had higher insurance if there was a leak of the intermediate private keys and lost data. Since nobody ever actually leaked an intermediate private key for a CA, people don't recognise the value. If we had lost payment card information through MITM, we would have been liable for a lot more money. That was the business justification for EV back when I was doing major ecommerce stuff.

smurda 10mo ago

I loved the visualization of EV certs in browsers, but in 2014 vendors like GoDaddy charged $100/yr for them. https://web.archive.org/web/20131023033903/http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=9039 https://web.archive.org/web/20131023033903/http://www.godadd... I'm glad LE, browsers, and others like Cloudflare brought this cost to $0. Eliminating this unnecessary cost is good for the internet.