Hacker News Reader

Comment by enord | Hacker News Reader

Well it's expected in contexts where legal responsibilities are defined and widely understood (or misunderstood, depending) and also because it's literally the reason they exist.

To quote wikipedia: >An Extended Validation Certificate (EV) is a certificate used for HTTPS websites and software that proves the legal entity controlling the website or software package.

View on HN

I still don't quite follow. You were talking about adoption among top 10 sites - is your argument that Twitter is not using an EV certificate[1] because a judge might say something along the lines of "That's all great but how do I know this twitter dot com thing is actually a site operated by Twitter, Inc? They're not using EV!" if some users sues them over a data breach?

[1]: Not really important for this discussion, but slightly relevant: For some reason Twitter uses both EV and non-EV certificates depending on geolocation.

To adress your aside: If twitter uses EV somewhere end non-EV elsewhere (depending on geolocation) then I'd wager they do it to comply minimally to the juridistiction in which they serve requests, that is: minimise legal exposure by foregoing EV-certs where this is legally tenable.

ps: I'm getting some downvotes for my view on this, but little in the way of arguments. I'm happy to be corrected. Am I coming off as an asshat on this?

Without getting into whether I agree with this or whether there's any data supporting such a statement, I think you could make the argument that the EV indicator might make users feel like there's a legal entity behind a site that they could go after, compared to sites without EV indicators.

I don't think you can make the argument that businesses don't adopt EV because that'd expose them to legal risk. That's just doesn't fit into my understanding of how the law and courts work. I'm not aware of any evidence or precedence that would support this, and the EV guidelines don't mention anything of this nature either.

Something that I see a lot in the discussions around EV is "the EV indicator might make users feel" x, y or z.

Not to sound too harsh but I don't care about making the user 'feel' anything. I want to make them more secure.

Yeah I don't think google not using a EV certificate really changes whether I can sue them

Obviously the law applies regardless of certificate type, but your ability to prove claims is affected.

At least for top 10 websites, would I not be able to prove that google is responsible for everything on their site?

Probably yes. More probably if the interaction was validated with an EV-cert.

Essentially yes, but that can be established through other channels in legal proceedings involving large, well established actors.

An ev-cert tells the user that the operator of a site has taken pains to make themselves legally accountable, and have confirmed details about juridistiction, legal entity, liason, etc. to the CA, which in turn connects cryptographic non-repudiation to legal non-repudiation (i.e. a signature).

All this is to state that with EV, every http response is basically signed and dated by the legal organisation that operates the site (grossly simplified, but sufficient for this argument). This signals where and how any dispute is to be arbitrated and settled (officially, and possibly legally), and conversely how seriously the security and integrity of the interaction is considered.

The ev-cert acknowledges legal exposure, and therefore it also informs users of legal exposure.

Reply on news.ycombinator.com