Hacker News Reader

Comment by antihero | Hacker News Reader

What are some trustable providers of EV certificates? LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? What's an easy way to check if a provider (for instance Gandi, who I use for my domains) is going to be culled by this?

In fact, I don't even seem to able to find certificate information in Chrome any more - clicking on the padlock just gives me a bunch of settings and "Learn more" which is some annoying page.

Edit: It's in Developer Tools under "Security"

View on HN

You will need an Extended Validation (EV) certificate to get your name in the bar. To get it to go green you "only" need a Domain Validation (DV) certificate.

In simple terms: DV proves you own your DNS domain and EV proves that your real world entity owns the DNS domain.

Lets Encrypt will only do DV and quite right too. EV costs a far bit more because it should require some proper checks - for example checking Company's House in the UK for a Limited Company's details and matching them up against real people.

You can set a flag in Chrom{ium!e} that will put a link to the cert in the menu that drops down when you click on the green bit, saving you a trip to dev tools. Go to chrome://flags and search for "Show certificate link". Don't know why it isn't the default.

Yeah I figured that EV is out of scope for LetsEncrypt. Thanks for the tip about the flags!

> Go to chrome://flags and search for "Show certificate link". Don't know why it isn't the default.

Thanks for this tip! I like to check the certificate, so this will save me some clicks. I also don't know why it's not enabled by default.

https://certsimple.com

It’s incredibly fast, the guy who runs it is nice, great customer service. It just does what you need.

Thanks James! Mike from CertSimple here. HN folk can give me a shout anytime (mike@certsimple.com) or ask here - it's midnight in the UK but I'll be back up in the morn!

I believe that EV certificates cannot be wildcard certs, is this still true?

yes.

Yep, what @detaro said. Here's the specifics: https://certsimple.com/blog/wildcard-ev-certificate

Like the site, but the example seems off.

It talks about 'bankofamerica.com.fraud.ru' in the first paragraph, but then discusses how 'fraud.ph' (why did we change TLDs? This should stick to ru or the above should be changed to ph) gets a wildcard cert for '* .com.fraud.com' (we changed TLDs again, to com this time. I assume we're talking about 'fraud.ph' getting a cert for * .com.fraud.ph - or .. we stick with ru)

Good point - I was experiencing a bunch of fraud from the Phillippines and thought the Russian example was too cliched. I'll tweak the example to be more consistent.

Generally a quick google answers the question as well, Gandi lists their partnership with Comodo on their EV certificate ("SSL business") page [1] as well as a coule places on their wiki.

So yes, if you're using Gandi (and I still do myself for things LetsEncrypt cannot be used for, namely things where frequent rotation requires time-consuming manual intervention) you are safe from Symantec's distrust.

[1] https://v4.gandi.net/ssl/business

I'm unfamiliar with the problem space. What are some of the use-cases for EV certificates?

It looks like lots of big name sites don't use them. Why do some companies feel they need it, while letting internet giants such as Facebook, Google, Microsoft, etc. get away without it?

EV shows (in the address bar and in the cert details) the legal entity that the certificate is for.

Eg anyone could register "bankofanerica.com" and get a DV cert issued for it.

Only Bank of America can get a cert that shows their legal/trading company name.

Well, that's the idea. I'm not aware of any ev misissuance but I don't follow this stuff like a hawk either.

Starting w/ version 60, go to chrome://flags/#show-cert-link, click "Enable", and restart your browser. Ta-da!

> LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using?

Sorry, what's a company that needs to show the company name beside the padlock? (Except maybe: Company that has too much money to spend on pointless "premium" security services without any shown benefit.)

EV is an option for companies that worry about branding - specifically ones that are well-known to do business offline. This extra layer of trust, relayed to the user from the web browser, reinforces the fact that they are on the correct website.

For example, I can go grab something like "bannk.com" (notice two 'n's) and get a DV cert for it - because I hypothetically own that name. Now, I can copy the real "bank.com" onto the site and perform a phishing attack. They both appear to be encrypted but the EV'd one has the organization noted, the fake one will not be able to have that legitimacy.

I am not saying the system isn't without its faults (people might not even notice), but it's an extra measure a company can do to keep itself distinguished from phshing websites or copycat services.

Too many negatives in that last sentence.

> without any shown benefit

on the contrary, I know that the presence of an EV line has helped my mother avoid a pretty decent phishing attempt. Any company holding confidential details or data should have one, its just a shame they are so expensive (which due to their verification is unlikely to come down too far).

> I'm a company that needs to show the company name next to the padlock

Does anyone actually look at or care about that?

Yes, everyone who cares about their security when using online banking.

See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would?

[1] https://www.troyhunt.com/journey-to-an-extended-validation-c...

It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.

> Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.

Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.

amazoone.com actually redirects to www.amazon.com, as do amazoon.com, aamazon.com, and amezon.com. It seems like finding a domain name that is "close" to amazon.com that is not already registered by Amazon is not that easy.

We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.

> We need an 'Expect-EV' header, just like 'Expect-CT'.

What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it.

> Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV.

EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses.

Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)

> What good would that header do?

It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful.

>EV certificates are not available to everyone.

I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable.

>how do you enforce a requirement like that

If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.

Marketing often cares about that a lot.

Users seem to notice but often times there's confusion as to why the address bar is, for lack of a better term, stuttering.

And god help you if your certificate uses a name you don't have any branding for.

Exactly for example the fiasco of behringer whose site is get this "www.music-group.com".

It always seem to be German firms that don't just get the internet at all

I definitely do for my bank. And the country code that is shown next to it.

>Does anyone actually look at or care about that?

No. You'll note that Amazon doesn't. They spent a bunch of time trying to figure out if it made a difference for customers. It turns out it doesn't, so they don't bother with the extra expense.

Apple does, as a counterpoint.

I'm interested in the Amazon study if you have a link, I haven't seen that before.

(Note, I run CertSimple and we specialise in making the verification process for EV faster and much less painful, so I'm biased)

I don't have any link... but off the top of my head they found that such a tiny percentage of people actually noticed the EV, even amongst technical people, that the value added was negligible. Even those that notice the EV certificate indicated that it didn't change their decision to purchase from a site.

You can make the EV process as smooth and simple as you like, but unless there's good solid business value provided by it (in $$s terms), you've got way more of an uphill struggle ahead.

For someone as big as Amazon, isn't it cheaper to just get an EV cert than spending significant time figuring out whether it's worth it?

Not if it increases conversation rate by X%.

That would only reinforce the point.

It's proof of identity, matching a pubkey to a legal name. Debian does it, Windows does it, your university does it, keybase does it. HTTPS is one of the few areas where it (since DV was invented) no longer the common practice.

Note: I'm biased. See bio.

if I am logging onto a bank or my broker Abso-fragging-lutely, damn it :-)

Reply on news.ycombinator.com