3 ms·
SSL/TLS Certs are trying to deal with two separate problems: 1. Over the wire encryption - where most of the criticisms in this thread are focused. Which I wil
by michaelbuckbee 12y ago
SSL/TLS Certs are trying to deal with two separate problems:
1. Over the wire encryption - where most of the criticisms in this thread are focused. Which I will also defer to tptacek's knowledge.
2. Site identification as an anti-phishing mechanism. For even the cheapest certs (domain+email validated) - the CAs will reject SSL cert requests for anything that might be a phishing target. Detecting "wellsfargo.com" is pretty easy, where it gets tricky is things like "wellsforgo.com", "wellsfàrgo.com" etc.
This has even gotten weird as the browser makers have started to really de-emphasize domain certs vs ev certs (cheap vs expensive), to the point where in most cases now having a domain cert does not know green at all.
Screenshots: https://www.expeditedssl.com/pages/visual-security-browser-ssl-icons-and-design https://www.expeditedssl.com/pages/visual-security-browser-s...