Hacker News Reader

Comment by enord | Hacker News Reader

Top 10 sites are not using EV because they don't wan't to meet the expectations of EV-level trust.

If twitter compromises your account details, you can change your passwords. If your (E-validated) electronic banking service compromises your account details, you can sue.

EV is laborious for social reasons (and some technical reasons ofcourse, nobody likes ASN1 extensions etc.), your effort to secure and validate a service is proportional to your stake in the transaction.

View on HN

I'm not sure I follow, why does a site's use of Extended Validation affect your ability to sue them? Or do you mean it's a psychological thing - "If our site uses EV, we're more likely to get sued"?

Well it's expected in contexts where legal responsibilities are defined and widely understood (or misunderstood, depending) and also because it's literally the reason they exist.

To quote wikipedia: >An Extended Validation Certificate (EV) is a certificate used for HTTPS websites and software that proves the legal entity controlling the website or software package.

I still don't quite follow. You were talking about adoption among top 10 sites - is your argument that Twitter is not using an EV certificate[1] because a judge might say something along the lines of "That's all great but how do I know this twitter dot com thing is actually a site operated by Twitter, Inc? They're not using EV!" if some users sues them over a data breach?

[1]: Not really important for this discussion, but slightly relevant: For some reason Twitter uses both EV and non-EV certificates depending on geolocation.

To adress your aside: If twitter uses EV somewhere end non-EV elsewhere (depending on geolocation) then I'd wager they do it to comply minimally to the juridistiction in which they serve requests, that is: minimise legal exposure by foregoing EV-certs where this is legally tenable.

ps: I'm getting some downvotes for my view on this, but little in the way of arguments. I'm happy to be corrected. Am I coming off as an asshat on this?

Without getting into whether I agree with this or whether there's any data supporting such a statement, I think you could make the argument that the EV indicator might make users feel like there's a legal entity behind a site that they could go after, compared to sites without EV indicators.

I don't think you can make the argument that businesses don't adopt EV because that'd expose them to legal risk. That's just doesn't fit into my understanding of how the law and courts work. I'm not aware of any evidence or precedence that would support this, and the EV guidelines don't mention anything of this nature either.

Something that I see a lot in the discussions around EV is "the EV indicator might make users feel" x, y or z.

Not to sound too harsh but I don't care about making the user 'feel' anything. I want to make them more secure.

Yeah I don't think google not using a EV certificate really changes whether I can sue them

Obviously the law applies regardless of certificate type, but your ability to prove claims is affected.

At least for top 10 websites, would I not be able to prove that google is responsible for everything on their site?

Probably yes. More probably if the interaction was validated with an EV-cert.

Essentially yes, but that can be established through other channels in legal proceedings involving large, well established actors.

An ev-cert tells the user that the operator of a site has taken pains to make themselves legally accountable, and have confirmed details about juridistiction, legal entity, liason, etc. to the CA, which in turn connects cryptographic non-repudiation to legal non-repudiation (i.e. a signature).

All this is to state that with EV, every http response is basically signed and dated by the legal organisation that operates the site (grossly simplified, but sufficient for this argument). This signals where and how any dispute is to be arbitrated and settled (officially, and possibly legally), and conversely how seriously the security and integrity of the interaction is considered.

The ev-cert acknowledges legal exposure, and therefore it also informs users of legal exposure.

Would the certificate really help you here though? If we look back at most of the big data breaches over the last few years then we regularly find out long after it's happened. It's generally a news story or a headline somewhere that xyz company was hacked.

I see what you're saying but I can't see where this would happen whilst the user has the browser window open showing EV information. If Twitter leaks your data you'd likely get an email notifying you or watch it on the news and then take action as a result of that.

If the validation process to obtain a certificate is rigorous then you have little deniability if and when you are held accountable for any shenanigans. Where I work, if the process to obtain a certificate is rigorous enough, certain entrusted CAs can issue certificates with legal non-repudiation (legal signature) and identifying power. This is written into law. You can bet your car this will create tons of case law when GDPR lands.

The EV-cert doesn't help twitter or facebook (other than making them seem more trustworthy), it doesn't provide any extra cryptographic or operational security, it helps the user better ascertain who is accountable and where when the shit inevitably hits the fan.

Reply on news.ycombinator.com