Hacker News Reader

> But the thing is, we've killed off a lot of these certificate types. We don't have EV certs anymore.

EV certificates are no longer in use? Do you know why?

They turned out to be expensive theater. One major problem is that company names aren't actually unique. An EV cert for "Stripe, Inc" still doesn't tell you that you're talking to the correct "Stripe, Inc". The other big problem was that users had no clue they were a thing, and when browsers tried to emphasize them in the UI it just confused users and made phishing easier.

You can still buy EV certs if you want to donate money to a CA, but that's about all they accomplish.

> You can still buy EV certs if you want to donate money to a CA, but that's about all they accomplish.

To be more precise, the browsers de-emphasized them and removed any distinguishing marks or indicators that made them valuable. EV certs used to display the company name in the URL bar, but they were stripped back.

Reply on news.ycombinator.com