Hacker News Reader

Comment by nailer | Hacker News Reader

> How is the user supposed to know what to verify in the EV indicator though?

In the proposal, the user doesn't know anything about the EV indicator.

The browser simply prominently shows the user the highest level of identity information on first POST (maybe with a two week delay on fresh browsers).

Do you trust:

- amazon.com

- Apple, Inc. (United States)

- apple.com-yolo.swag.ru

The proposal is particularly neat as it doesn't discriminate against well known domains with DV, just shows users what the cert proves at the time they most need to know.

I could make this in a day, and prove it improves end user security, if Ryan (or anyone else) would let me.

(I'll address your scenarios in another comment, just wanted to clarify the identify-on-first-POST proposal first)

View on HN

I'm not opposed to your proposal but I would have some hesitation about an intersitial like that. The example works well with Amazon and Apple but what about:

- some-company.com - Other Company [United Kingdom] - some-company.com-fake.uk

Unless you already know you wanted Other Company [UK] (pre-existing knowledge) the EV indicator really doesn't help.

Thanks. Again there's no explicit EV indicator being proposed in identify-on-first-POST: just a single UI with the highest amount of info known about the site's identiy. Re your examples:

> This is the first time you've visited this site. The owner has been verified as some-company.com

"OK. Have I heard of these people before? The dash is a bit weird. Not bad, not good - which is reasonable for site that isn't telling me anything."

> This is the first time you've visited this site. The owner has been verified as Other Company [United Kingdom]

"OK cool. I live in the UK and I know who is handling my data."

> This is the first time you've visited this site. The owner has been verified as some-company.com-fake.uk

"Euw gross. I'm out of here."

I totally disagree with #2. What relevance is the country I reside or the country the company was founded matter? Half of the time companies have registered addresses all over the world for tax reasons, not to mention things like franchises, subsidiaries and other legal structures that complicate things further.

"I know who is handling my data", really? You know their registered name but nothing about them or who they are, where they are (in the country), are they big/small, reputable, been established 2 days or 2 years, have 5 staff or 500 staff, nothing. In all honesty, the browser presenting that to me in the address bar has absolutely no value. It's a simple text string, how can it?

> I totally disagree with #2. What relevance is the country I reside or the country the company was founded matter?

As you live in the UK, and you noticed business you thought was local or US based turned out to be from the Philippines or Russia, would you care? It's essential the country be included.

> You know their registered name

You know more than that, you know the specific legal entity you are dealing with - the name is part of that, but it's what the name signifies. It's accountability, exactly like every other verification platform: Instagram, Facebook, whatsapp, GPG + university directory with keys, GPG keybase. Oddly enough the verification process for verifying individuals on these platforms is almost identical to EV's.

The only place we trust random pubkeys and a network address is the web, and that's because GeoTrust wanted to save money in the early 2000s.

> are they big/small, reputable, been established 2 days or 2 years, have 5 staff or 500 staff

You are confusing identification with approval. See: every platform listed above (except Twitter, which does actually confuse them and in currently in a heap of turmoil over it). Also your passport - it doesn't mean you're a good person, it just means we know which person you are.

> As you live in the UK, and you noticed business you thought was local or US based turned out to be from the Philippines or Russia, would you care? It's essential the country be included.

If I "thought" it was local or if I "knew" it was local. The information is only useful if I knew it was local (prior knowledge) and EV UI tells me it's not (and I notice, and then act accordingly).

> You know more than that, you know the specific legal entity you are dealing with - the name is part of that

No, I really just know the name, because that's all that's in the EV UI unless I go digging...

> it just means we know which person you are.

And a DV certificate tells you which website I am, scotthelme.co.uk, which is what you typed into the address bar.

Reply on news.ycombinator.com