Agreed! And wayyy back when (until the late 90's I think), all SSL certificates were actually identity certified, but then cheaper DV certs became common -- but

Agreed! And wayyy back when (until the late 90's I think), all SSL certificates were actually identity certified, but then cheaper DV certs became common -- but still operating under the same trust model (no way to show the user that you spent more for a better certificate). Even now, lots of CA's charge you for organizational authentication even though there's no EV bar[1], which is just dumb -- since those certificates really don't prove anything more to the user than much cheaper DV certs. I like DV certs because they enable cheap (or completely free[2]) crypto, but EV-TLS does have a valid purpose for orgs that need it. Lots of startups do wildcard for customer hostnames. (Freshbooks, Campaign Monitor, I'm sure there are many more.) But we're actually moving away from it anyway. Incidentally, Same Origin policy prevents XSS or cookies across domains like that[2], so e.g. userify.github.com would actually be safer than github.com/userify. 1. https://www.symantec.com/page.jsp?id=compare-ssl-certificates&tid=ssl-sem https://www.symantec.com/page.jsp?id=compare-ssl-certificate... 2. https://letsencrypt.org/ https://letsencrypt.org/ 3. https://en.wikipedia.org/wiki/Same-origin_policy#Origin_determination_rules https://en.wikipedia.org/wiki/Same-origin_policy#Origin_dete... EDIT: good point, iirc Microsoft even had an SSL cert spoofed that way one time.. or maybe it was a domain.