Comment by dagenix | Hacker News Reader

Comment by dagenix | Hacker News Reader

Parent Full thread

The article makes a pretty compelling point that EV certs are worthless. Google and Apple seem to think that EV is worthless - that is why they are removing special treatment for them from their browsers. Many of the largest sites in the world that are the most appealing targets to phish have voted that they are worthless by not purchasing them.

> forcing people to use HTTPS to avoid scare tactic "Not Secure" warnings.

"Not Secure" is a literal description of the state of the connection. Its not secure. What should a browser say? I guess nothing because your site is so special that its users should be ok with having someone MITM the connection and inject who knows what into the page. Whether or not that is OK isn't your decision to make - its the right of your users to make that decision and saying "Not Secure" helps them. That you find that inconvenient for you is well ... inconvenient for _you_.

> HTTPS is far less helpful than something like EV that includes identity

The article makes a pretty compelling point that EV certs are worthless and do no better a job at providing security than regular certs.

I don't find the articles' arguments compelling at all, hence my statements contrary to it. Many of the arguments against EV, including in this article, are circular and depend on appeal to authority towards companies who don't like them.

So present an actual argument.

When people insist EV have value, they almost always base it on some hand-wavy claims about preventing phishing. Cite to research (not to advertising claims from CAs) showing that significant numbers of users are aware of EV and use it as an indicator when deciding whether to trust a site, for example.

The problem is you won't be able to; the average web user is barely aware of what the various things in the URL bar mean, if they're even aware of the URL bar at all, as decades of user research have taught us. So it always just comes back to hand-wavy stuff. And hand-wavy isn't enough to justify the cost of the system.

Meanwhile, we have real, hard evidence that even technically-literate, security-savvy users can easily be fooled into giving up their credentials, and even will bypass mechanisms intended to get in the way of them giving up their credentials. I'm going to keep plugging this phishing talk until everyone has internalized that message:

https://www.youtube.com/watch?v=ZjW12K0IHgo

What about the article isn't compelling?

We have an expert here, writing they are useless.

We have various case studies of different websites using them and then switching away from them without any user outcry - again, showing they are useless.

We have various examples of CAs making highly misleading claims with a clear intent to financially benefit themselves.

We have a "warranty" that no one will explain what it means.

We have major browsers, saying they are worthless by removing their special treatment.

We have major websites voting with their feet, never using them, indicating they are useless.

Its extremely unclear to me exactly what you are objecting to. Maybe if they were useful, then, they would be useful, but, that's circular.

Reply on news.ycombinator.com