> I'm a company that needs to show the company name next to the padlock
Does anyone actually look at or care about that?
Does anyone actually look at or care about that?
Users seem to notice but often times there's confusion as to why the address bar is, for lack of a better term, stuttering.
And god help you if your certificate uses a name you don't have any branding for.
It always seem to be German firms that don't just get the internet at all
[1] https://www.troyhunt.com/journey-to-an-extended-validation-c...
Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.
What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it.
> Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV.
EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses.
Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)
It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful.
>EV certificates are not available to everyone.
I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable.
>how do you enforce a requirement like that
If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.
No. You'll note that Amazon doesn't. They spent a bunch of time trying to figure out if it made a difference for customers. It turns out it doesn't, so they don't bother with the extra expense.
I'm interested in the Amazon study if you have a link, I haven't seen that before.
(Note, I run CertSimple and we specialise in making the verification process for EV faster and much less painful, so I'm biased)
You can make the EV process as smooth and simple as you like, but unless there's good solid business value provided by it (in $$s terms), you've got way more of an uphill struggle ahead.
Note: I'm biased. See bio.