Hacker News Reader

Comment by nlh | Hacker News Reader

I would argue that the top 10 sites aren’t using EV because they don’t need to use EV, precisely because they’re top 10 sites.

If I’m visiting Amazon, I’m pretty sure that I’m getting the security I’m expecting simply by seeing Amazon’s domain, the pages I recognize, and some semblance of SSL.

It’s the lesser-known sites, I think, where this sort of “trust” (for some version of trust) matters more — random-ecommerce-site.com doesn’t have the brand value or trust factor of Amazon, so they need every (perceived) advantage they can get, EV being one.

View on HN

Disclosure: I work for https://certsimple.com, we're a startup that focuses on making the EV verification process faster and less painful than other verification methods.

There's a few different reasons people use EV. Most are similar to verification on other platforms, eg AirBnB, Whatsapp, Facebook (Twitter is unique as that has additional requirements beying identity verification).

- You're a smaller company, handing sensitive information, and you want people to know there's a real legal entity behind the website they're giving it to. Eg fintech startups and new dating sites.

- You're a company that has resellers, counterfeiters or other non official sites and want to distinguish you're the actual brand. Typically fashion retail is the buggest demand here.

- You simply want to match a public key to a real world identity, just like any other cryptosystem, in the same way that the fields in the CSR were checked in the 90s, prior to GeoTrust inventing DV to save money in the early 2000s. Typical case here is a lot of old school sysadmins who dislike public keys that haven't actually been proven to be owned by anyone.

- Phishing.

Your site looks great, we don't have EV on Construct.net because it's just to laborious. Will be ordering soon from you.

I do touch on that point in the article but the numbers show that larger sites are more likely to use EV and smaller sites are less likely to use it. The figures seem to go against the logical assumption. I grabbed the figures and published them because I thought as you do.

Amazon may do it because others are doing it and as you say they don't have to because they are already trusted and at the top of the heap. And further they don't want to empower other sites as being legit by featuring a design element (the green at the top) that others can easily copy.

An example of this?

Let's say back in the day you were the market leader and had "intel inside" (the processor). But you didn't use the 'intel inside' logo because then others could have the same sticker and the public would think 'oh ok it's the same stuff in brand X'.

Manufacturers frequently come up with different names for product features for a similar reason.

> It’s the lesser-known sites, I think, where this sort of “trust” (for some version of trust) matters more

I think this also goes by the 'nobody got fired for buying IBM rule'.

For the nominal cost of the EV you don't want to take a chance that you are wrong. It can't hurt and it might help.

Additionally I bought one also because I kind of like the green at the top and I think that as a design element it adds to a page in the position that it's at.

I don't know anyone who would say "oh this ecommerce website must be legit because it has its name next to the green lock"

May be true from a user's perspective, but EV could still be useful to ward off phishing.

Reply on news.ycombinator.com