Hacker News Reader

An idea to make EV certs somewhat more useful:

EV Preload List

Similar to HSTS Preload List, a domain owner can enroll the domain into an "EV only" program on a yearly basis, such that the list of "EV only" domains will be preloaded into major web browsers. Browsers will refuse to accept any certificate for the domain which is not EV. The browser UI does not need to change.

View on HN

Would be cool, but IDK how much it'd help. The modern threat model it seems is very much phishing / getting people to enter creds onto sites that they think belong to their bank or whatnot, but are in reality different, unrelated domains. Since the domain is different HSTS, etc don't apply.

Training people to "look for the big green badge and make sure it says JPM Chase, USA" seems easier than "you have to make sure it's chase.com EXACTLY". But in reality the solution is to use a password manager with URL matching (or passkeys... But ehh)

Reply on news.ycombinator.com