Difference between revisions of "EV Cert"
(→Problems) |
(→Problems) |
||
| Line 6: | Line 6: | ||
==Problems== | ==Problems== | ||
| − | Ian Carroll summarized some of the issues [https://stripe.ian.sh/ here. | + | Ian Carroll summarized some of the issues [https://stripe.ian.sh/ here] which includes this comment EV "certificates include information about the legal entity behind the certificate, but not much else. What a legal entity can be turns out to be quite flexible; James Burton, for example, recently obtained an EV certificate for his company "Identity Verified". Unfortunately, users are simply not equipped to deal with the nuances of these entities, and this creates a significant vector for phishing." |
==Solutions== | ==Solutions== | ||
Revision as of 20:09, 9 September 2018
Full Title or Meme
Extended Validation Certificates for SSL Web Sites with added Assurance as to the real-world identity of the Enterprise hosting the site.
Context
In response to concerns that TLS (HTTPS) encrypted interchanges could not be Validated by regular users, the CA|B forum created an audited from of certificate to satisfy users concerns. It has not lived up to expectations.
Problems
Ian Carroll summarized some of the issues here which includes this comment EV "certificates include information about the legal entity behind the certificate, but not much else. What a legal entity can be turns out to be quite flexible; James Burton, for example, recently obtained an EV certificate for his company "Identity Verified". Unfortunately, users are simply not equipped to deal with the nuances of these entities, and this creates a significant vector for phishing."
Solutions
The
