Hacker News Reader

Comment by jzl | Hacker News Reader

I'm surprised no one has mentioned the main practical benefit of EV certs: the fact that a green cert in the browser ensures that there is no man-in-the-middle network proxy/appliance intercepting the traffic even if a trusted certificate for the proxy/appliance (or bad guy) has been placed in your machine's cert store. Browsers will only honor the EV setting in the cert if it was signed by a hardwired (and much shorter) list of CAs.

As long as you, the user, trust that the browser itself hasn't been modified (for example if you downloaded it yourself), then it's a nice reassurance when using a browser in a not totally trusted environment.

View on HN

Browsers are moving away from showing differences between EV and DV certs nowadays though. And anyone can register a company name and get an EV cert - that doesn't make it trusted. https://stripe.ian.sh/ is a prime example of this.

HTTPS is a nice reassurance, sure, but an EV cert isn't.

> https://stripe.ian.sh/ is a prime example of this.

It used to be. All his EV certs were revoked.

Sure, but my point doesn't change. https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-c... is a good write-up about that.

Company homonyms are an issue, albeit a US specific one. The industry is looking at verifying trademarks, which tend to be monopolies.

The article is precisely about this: regardless of practical use, people don't follow the behaviour associated with supporting that practice, so it's worthless.

And people who would follow the correct behaviour...are probably capable of doing so without the EV anyway.

> "The article is precisely about this"

No, I don't believe it is. The point debunked over and over again by Troy in this and other articles of his is the supposed anti-phishing aspect of EV certs: that because the browser shows the company name separate from the url, the user can know that they're really at e.g. Amazon and not amaz0n.com.

I'm referring to a very specific situation that is much more rarely mentioned: when you are using a computer with a managed cert store (usually a company computer behind a firewall) and you want to know if the site you are visiting is getting "legitimately" (per company policy) SSL-sniffed by a network appliance. This is completely different from phishing attacks or whether you think you are at the real Amazon. All you need to do is go to a single site that you know has EV and see if it shows up as EV in the browser. Sure, they could selectively sniff, but in practice I believe most companies that do this have an all or nothing approach.

Reply on news.ycombinator.com