3 ms·
EV is simply a signal that the website is backed by a real company. Even if you can't trust the CA's to always do a good job (there are too many instances of CA
by jamiesonbecker 11y ago
EV is simply a signal that the website is backed by a real company. Even if you can't trust the CA's to always do a good job (there are too many instances of CA's really doing the opposite), they still don't give them away for free. To get one, you have to be prepared to spend hundreds of dollars on top of the typical incorporation and startup costs, so at least you can trust that someone actually ponied up for the certificate cost itself, incorporated, and maintains that incorporation in good standing.
We bought EV for https://Userify.com https://Userify.com even though we're a startup, because it demonstrates our level of commitment to security and that we're serious in the marketplace. We also use a wildcard TLS certificate for customer-specific logins. EV-TLS also fights phishing attacks.
It's somewhat shocking that AWS doesn't use EV-TLS for the console login, especially when they're so good about other things (like searching for customer keys on Github, watching for phishing exploits, etc.)
- twistedpair 11y agoAmazon is known to pinch pennies. Anything Jeff can do to save a few grand.
- huxley 11y agoIn case anyone was confused and thought you had a Wildcard EV certificate for subdomains/customer-specific logins, that (still) isn't possible, what you probably meant was that you have a regular wildcard certificate for the subdomains in addition to the EV certificate for your primary domain.
- jamiesonbecker 11y agoThat's absolutely correct and thanks for clarifying my imprecise language. I actually support that EV doesn't support wildcards and don't mind buying both. Wildcards can be harder/riskier to manage in large organizations but the specificity of EV means they're just naturally going to be shared around the organization a lot less.
- noinsight 11y ago> AWS doesn't use EV-TLS for the console login, especially when they're so good about other things You mean this AMZN?: http://imgur.com/S1Pz155,TdRDjIq#0 http://imgur.com/S1Pz155,TdRDjIq#0 It's shocking to me that they aren't even using proper TLS settings even though I'm sure they're perfectly capable and aware. Doesn't inspire confidence in their security.
- jamiesonbecker 11y agoAgreed! (but, in fairness, portal.aws.amazon.com might be an obsolete domain, since it just redirects to the correct aws.amazon.com... the actual console login does use TLS 1.2 etc.) Even so, it still blows my mind that even the main Amazon.com main page uses no SSL at all by default, and they're an e-commerce site, unlike Google and FB. Seems to show a lack of respect for customer privacy.