3 ms·

That's true, but EV on its own does provide real value as well. When you see the green bar, it's proof that it's at least nominally certified to be served from

That's true, but EV on its own does provide real value as well. When you see the green bar, it's proof that it's at least nominally certified to be served from the entity displayed (barring key theft etc). Barring parallel certs, even if it was possible, wouldn't necessarily be a good idea, since there's a lot of legitimate uses for them. For instance, we also have a wildcard (non-EV) certificate for the same domain, covering *.userify.com that we currently use for customer subdomains. I'm far from an apologist for CA's. I think the entire system is broken. It's ridiculous that my browser trusts a Chinese govt CA with the same level of trust as the best US or EU CA, and it's ridiculous that it's so hard for me to customize that level of trust. Still, it's what we have right now. EV does represent some actual effort for every single issued certificate on the part of the CA's, and they do deserve to get paid for that. Whether that payment should cost many hundreds or even thousands of dollars is debatable, however!

0x0 11y ago
EV is kinda what the CAs should have done from the beginning anyways for any certificate. :-/ Btw, for parallel certs on customer subdomains, that sounds like a very niche use cache. Maybe you could have used a different base domain for user content. (Isn't that best practice anyways, to avoid xss'ing cookies onto the main site?)
- jamiesonbecker 11y ago
  Agreed! And wayyy back when (until the late 90's I think), all SSL certificates were actually identity certified, but then cheaper DV certs became common -- but still operating under the same trust model (no way to show the user that you spent more for a better certificate). Even now, lots of CA's charge you for organizational authentication even though there's no EV bar[1], which is just dumb -- since those certificates really don't prove anything more to the user than much cheaper DV certs. I like DV certs because they enable cheap (or completely free[2]) crypto, but EV-TLS does have a valid purpose for orgs that need it. Lots of startups do wildcard for customer hostnames. (Freshbooks, Campaign Monitor, I'm sure there are many more.) But we're actually moving away from it anyway. Incidentally, Same Origin policy prevents XSS or cookies across domains like that[2], so e.g. userify.github.com would actually be safer than github.com/userify. 1. https://www.symantec.com/page.jsp?id=compare-ssl-certificates&tid=ssl-sem https://www.symantec.com/page.jsp?id=compare-ssl-certificate... 2. https://letsencrypt.org/ https://letsencrypt.org/ 3. https://en.wikipedia.org/wiki/Same-origin_policy#Origin_determination_rules https://en.wikipedia.org/wiki/Same-origin_policy#Origin_dete... EDIT: good point, iirc Microsoft even had an SSL cert spoofed that way one time.. or maybe it was a domain.
  - nailer 11y ago
    Agreed re: EV should be been what happened from the beginning, but there was some pretty bad late 90s SSL too: I remember having a 'fax on company letterhead' as being sufficient for getting a (what's now called) a DV cert back in the day.

0x0 11y ago

EV is kinda what the CAs should have done from the beginning anyways for any certificate. :-/ Btw, for parallel certs on customer subdomains, that sounds like a very niche use cache. Maybe you could have used a different base domain for user content. (Isn't that best practice anyways, to avoid xss'ing cookies onto the main site?)

jamiesonbecker 11y ago
Agreed! And wayyy back when (until the late 90's I think), all SSL certificates were actually identity certified, but then cheaper DV certs became common -- but still operating under the same trust model (no way to show the user that you spent more for a better certificate). Even now, lots of CA's charge you for organizational authentication even though there's no EV bar[1], which is just dumb -- since those certificates really don't prove anything more to the user than much cheaper DV certs. I like DV certs because they enable cheap (or completely free[2]) crypto, but EV-TLS does have a valid purpose for orgs that need it. Lots of startups do wildcard for customer hostnames. (Freshbooks, Campaign Monitor, I'm sure there are many more.) But we're actually moving away from it anyway. Incidentally, Same Origin policy prevents XSS or cookies across domains like that[2], so e.g. userify.github.com would actually be safer than github.com/userify. 1. https://www.symantec.com/page.jsp?id=compare-ssl-certificates&tid=ssl-sem https://www.symantec.com/page.jsp?id=compare-ssl-certificate... 2. https://letsencrypt.org/ https://letsencrypt.org/ 3. https://en.wikipedia.org/wiki/Same-origin_policy#Origin_determination_rules https://en.wikipedia.org/wiki/Same-origin_policy#Origin_dete... EDIT: good point, iirc Microsoft even had an SSL cert spoofed that way one time.. or maybe it was a domain.
- nailer 11y ago
  Agreed re: EV should be been what happened from the beginning, but there was some pretty bad late 90s SSL too: I remember having a 'fax on company letterhead' as being sufficient for getting a (what's now called) a DV cert back in the day.