News for hackers. Stuff that matters.

A comment on 14,766 Let's Encrypt SSL Certificates Issued to PayPal Phishing Sites. Parent comment

Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by matt4077 on Sunday March 26, 2017 @01:32PM (#13961890)
That would imply that there is no security benefit whatsoever provided by a DV certificate. To prove that DV certificates are usually seen as "better than nothing", just consider the difference browsers make in their treatment of self-signed certificates.

I'm also in the position of running a small online business on the side, and such a change would almost certainly require and upgrade to an EV certificate. While we have thought about it (and I have tried to find some data on changes in conversion rates possibly coming from it), I haven't quite been able to convince myself that the costs and hassle are worth it.

The process may be prohibitively expensive in some countries, or for some very small operations.

Maybe it's time to think about improvements to identity-verifying certificates. Either by improvements to the process towards automation, or maybe another certificate class relying on a reputation system for judging trustworthiness.

[ Parent | on HN ]
Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by lfam on Sunday March 26, 2017 @01:40PM (#13961938)
> That would imply that there is no security benefit whatsoever provided by a DV certificate.

The security benefit is that the connection to the server is authenticated and encrypted. Nobody in between can inspect or mutate the data. This is a huge win over unauthenticated HTTP.

[ Parent | on HN ]
Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by tokenizerrr on Sunday March 26, 2017 @01:41PM (#13961944)
> I haven't quite been able to convince myself that the costs and hassle are worth it.

Have you ever heard a regular user talk about the URL bar not being green?

[ Parent | on HN ]
Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by matt4077 on Sunday March 26, 2017 @02:01PM (#13962094)
No, but then again the URL bar's color rarely comes up when I do smalltalk. I've also never heard anybody in real life mention the size or color of "order" buttons, but I have pretty reliable data that even among choices that will seem to be completely reasonable, some will convert at 3x the rate of others.
[ Parent | on HN ]