Hacker News Reader

Comment by V__ | Hacker News Reader

But aren't there some differences? LE doesn't verify identitiy. Though I'm not saying that the big CEs are that thorough.

View on HN

Browsers stopped prominently showing the identities in EV certificates long ago. There is zero value in paying for a TLS certificate.

I remember many moons ago, like the Netscape era, when companies that paid for EV certs got special icons and a green address and all sorts of browser indications of trustworthiness.

I just tried my (large, international) bank website in the latest Safari, and I can't even figure out how to view the cert. There's an assumption that every site will have some cert, but no special treatment for EV certs at all.

In Chrome you can click on the icon next to the address and then on security, it will show the name of the company the cert is issued to. Quite hidden though.

But yeah, Safari is always something i have trouble finding the cert, they are really hiding it.

Well it can be bypassed by setting up a new company with the same name. Someone had done that against stripe I remember.

EV certs show the company name and the country, for disambiguation, on the assumption that you cannot have two companies of the same name in the same country. However, this is not true in the USA, where names are unique only within each state.

That's how someone got an EV cert for Stripe (USA).

That’s true. It’s a bit of a self fulfilling prophesy: the browsers didn’t present a meaningful verification UI, then removed the UI because users didn’t find it meaningful.

Steak isn’t delicious because, after I pee on it, people dislike the taste.

The concept of matching an real world identity to a public key is very much intact outside the browser world.

Browsers did display EV certs in very significant ways in the 2010s with green address bars. Safari even hid the URL and only displayed the certificate owner name.

> with green address bars.

Yes. A green address bar isn't meaningful verification UI. That is why no other platform uses green bars for verification.

Whether the CA verifies identity or not is irrelevant. Since the end user does not see the certificate they are all functionally equivalent.

And yes, the actual quality of the identity check is debatable but since nobody cares the utility of it is zero.

For example- when was the last time you checked the certificate details of a web site? Have you ever left a site because you felt the certificate didn't verify identity?

Reply on news.ycombinator.com