Hacker News Reader

> OV are considered more secure than DV due to the higher registration requirements[0]

Nonsense. OV is no more secure than DV, just more expensive.

To be fair, it's more secure in the sense that someone who gets access to their domain name service can't generate their own OV cert without more access.

They could however create their own DV cert.

So while it uses the same technology, if you see an OC cert you can be more sure that it's the actual organization and not a cert that just proves that the domain is the domain.

But unless clients or humans do anything in response to the extra OV information, or in response to a lack of the extra OV information, that information has no security value.

No browsers do anything with OV data unless humans manually take action to examine the certificate. So I'm comfortable saying they offer negligible security value.

I think if a browser said "hey, this site used to have an OV cert, but now has a DV cert", and explained why that could be bad, that could be useful, though many non-technical users would probably not get the distinction. Sure, they don't do that now, but UI/UX around TLS has been improving a lot over the past few years.

(Certificate Patrol's noting of the reverse is a little silly though; why would you flag a change that denotes an increase in security...?)

Reply on news.ycombinator.com