Hacker News Reader

Comment by ubernostrum | Hacker News Reader

As Troy Hunt has been at pains to point out, some of the largest, most important and most spoofed/phished sites on the internet use only DV certs.

Google, Amazon, Facebook, and eBay are all DV. If they don't see value in EV/OV, then who on earth is it meant for?

View on HN

Google, Amazon, Facebook and eBay all use OV certs, but you're probably right in that they don't see value in EV.

Like any security/UX thing there are issues all the way down. One of them being that you can't get an EV wildcard (because they want them to be "more secure" in certain respects) and so they're harder to manage - in particular harder to manage in big heterogenous environments.

OTOH: your bank, Apple, GitHub, npm, most fintech companies do.

And yes your bank account is a higher value target than your gmail.

Getting access to someone's personal email account is often sufficient to gain access to everything else they use, including banks and other financial services, at least for long enough to clean out some money.

In some cases - most banks use 2FA, compromising email wouldn't be sufficient to handle that, but a phishing site can do a pass through attack and get both from the user.

But the point still stands: getting access to someone's bank account is far more direct way of getting access to their money than their gmail.

It's all very well that my bank does, but it displays "National Savings and Invest..." which isn't its full name and would also be shown for any number of businesses with the same start to their name.

My mother's bank says "Lloyd's Banking Group PLC" which isn't its name, you'd have to know that it's owned by another group of banks to decode that.

Another of my accounts says "first direct (HSBC Bank plc)". It so happens I know that First Direct is owned by HSBC, but if I didn't shouldn't that further concern me?

This all ends up as extra cognitive load for humans, and it barely contributes to helping with the problem, because this information is only (can only be) displayed after all the backend stuff has finished happening, so it's too late to tell me that wasn't really my bank after I tell them my password...

It's a seperate topic, but yes, there's definitely a need to improve how names map to human understanding. Most people know 'Coke' or 'Coca Coca' than 'The Coca Cola Company' or 'CCA Amatil' or cocacola.com.im. There's discussion (mainly led by DigiCert) now about making EV use trademarks.

Reply on news.ycombinator.com