Not just chrome, also Paypal, which allows basically unlimited access to your account with just a username and password.

I wish. I don't even have unlimited access to my own account. Paypal sucks both ways.

That would imply that there is no security benefit whatsoever provided by a DV certificate. To prove that DV certificates are usually seen as "better than nothing", just consider the difference browsers make in their treatment of self-signed certificates.

I'm also in the position of running a small online business on the side, and such a change would almost certainly require and upgrade to an EV certificate. While we have thought about it (and I have tried to find some data on changes in conversion rates possibly coming from it), I haven't quite been able to convince myself that the costs and hassle are worth it.

The process may be prohibitively expensive in some countries, or for some very small operations.

Maybe it's time to think about improvements to identity-verifying certificates. Either by improvements to the process towards automation, or maybe another certificate class relying on a reputation system for judging trustworthiness.

> That would imply that there is no security benefit whatsoever provided by a DV certificate.

The security benefit is that the connection to the server is authenticated and encrypted. Nobody in between can inspect or mutate the data. This is a huge win over unauthenticated HTTP.

> I haven't quite been able to convince myself that the costs and hassle are worth it.

Have you ever heard a regular user talk about the URL bar not being green?

No, but then again the URL bar's color rarely comes up when I do smalltalk. I've also never heard anybody in real life mention the size or color of "order" buttons, but I have pretty reliable data that even among choices that will seem to be completely reasonable, some will convert at 3x the rate of others.

Chrome's long-term plan is to show no visual indicator for (valid) HTTPS, and a non-secure indicator for HTTP[1], so that's essentially what you're describing. IIRC Firefox has similar plans. HTTPS deployment numbers don't quite allow for that yet.

[1]: https://www.chromium.org/Home/chromium-security/marking-http...

I agree the blame is misplaced. Browsers should do a better job at highlighting scammy sites. There is a counter-argument on http://www.thewhir.com/blog/web-encryption-needs-the-freedom...