Hacker News Reader

Comment by michaelbuckbee | Hacker News Reader

There's a shift happening in the browser space as well to "downgrade" the UI for DV certs, much less green locks and bars and more gray and no red security warnings.

We're entering a world where every site has a DV cert (most likely for free with registering a domain) but that all of the things for which we now consider "needing SSL" will require an EV cert.

View on HN

Firefox recently changed DV from gray to green: https://blog.mozilla.org/security/2015/11/03/updated-firefox...

As long as browsers don't start popping up scary warnings about submitting forms to a site that only has DV certs, I think it'll be fine.

And hopefully soon they can pop up scary warnings for unencrypted sites.

And as long as they do pop up scary warnings when the DV certificates change possibly due to a MitM attack it'll be even more fine.

Yes and no:

- Safari uses a grey lock for DV certs

- Edge uses a hollow grey lock for DV certs

- Mozilla launched Let's Encrypt, and then changed DV certs from grey to green in Firefox.

- Chrome still uses green for DV and hasn't changed

Chrome downgraded to plain gray for mixed content though.

it's not really a downgrade though, because it used to throw a yellow exclamation warning about not being secure which was problematic.

EV certs will only make sense (for the vast majority of sites) when consumers start actually recognizing the difference between EV and DV, personally I don't see that happening real-soon as many non-technical consumers don't even notice if there's no SSL cert at all...

Ask yourself do you remember what sites use EV certs and would you notice if one had a DV instead... if you wouldn't ask yourself why a company would pay more money for that EV cert, when they can get a perfectly good DV one for free

I'm looking forward to that world.

Reply on news.ycombinator.com