News for hackers. Stuff that matters.
Re:The Power to Revoke Lies with the Certificate Authority by notatoad on Friday April 27, 2018 @02:40AM (#16938836)
I'm not sure how EV certs have continued to be a thing for so long.

Does anybody trust an EV cert more than a DV cert? It's hard enough to get the average person to check for the green padlock before they enter their password, how can we hope to convince anybody to check the company details in the certificate?

Re:The Power to Revoke Lies with the Certificate Authority by regecks on Friday April 27, 2018 @03:03AM (#16938937)
I did a contract in a corporate environment where the SSL interception proxy passed-through any site with an EV certificate.

I first noticed that it wasn't intercepting my connection to my bank, and then after some experimentation, that turned out to be the pattern. Sounds stupid, but there you go, somebody uses EV as a signal for something.

Re:The Power to Revoke Lies with the Certificate Authority by crdoconnor on Friday April 27, 2018 @10:03AM (#16940814)
You made me curious - I work at a company that does that.

As it turns out it appears to intercept everything except connections to major high street banks.

Re:The Power to Revoke Lies with the Certificate Authority by gruez on Friday April 27, 2018 @01:11PM (#16942427)
I wonder whether they're doing it by IP, DNS, SNI, or certificate. because if it's by SNI or DNS, it's pretty easy to get pass the intercepting proxy.
Re:The Power to Revoke Lies with the Certificate Authority by crdoconnor on Friday April 27, 2018 @01:18PM (#16942475)
It's by certificate although the company does run an HTTP proxy for techies that doesn't MITM certs.

These days I can't be bothered to circumvent. If I want to do any sort of sensitive browsing at work (e.g. online banking) I just tether my laptop to my phone.

Re:The Power to Revoke Lies with the Certificate Authority by njitbew on Friday April 27, 2018 @03:04AM (#16938940)
In my experience, EV certs are not a technical thing but a marketing thing. EV certs show your name in the address bar, so it's certainly more visible. If an EV cert boost sales by 1% and costs 500$ a year, then it will make sense for even the smallest webshop. And as long as this is the case, there will be a market for EV certs.
Re:The Power to Revoke Lies with the Certificate Authority by waterbomb0 on Friday April 27, 2018 @09:01AM (#16940457)
Ordinary SSL certificates only require you to have access to domain's DNS records, or to the server where they point to. They only prevent MITM attacks, and you cannot really know who is behind some domain.

With the EV certs, you can be assured that it actually belongs to the company it claims to belong. If I see "PayPal, Inc. (US)" in the address bar, I'm sure I'm accessing the correct server. However, I didn't really know that business names are not unique between different US states, but I assume this is not the case for other countries.

The issue with EV certs is how they are presented in the browser, since they are indistinguishable to the ordinary certs, at least to the majority of the users.

Re:The Power to Revoke Lies with the Certificate Authority by ubernostrum on Friday April 27, 2018 @01:31PM (#16942579)
However, I didn't really know that business names are not unique between different US states, but I assume this is not the case for other countries.

Uniqueness of business entity names is something you should never ever assume or rely on.

Re:The Power to Revoke Lies with the Certificate Authority by hannob on Friday April 27, 2018 @08:08AM (#16940143)
> I'm not sure how EV certs have continued to be a thing for so long.

EV certs are currently the cash cow of certificate authorities. If you'd take away EV certs it would become apparent that there's no valid business model for CAs any more.

So the whole CA industry kinda depends on keeping the illusion that EV is a valid concept.

Re:The Power to Revoke Lies with the Certificate Authority by stephen_g on Friday April 27, 2018 @03:22AM (#16939015)
Yes, but only for banks, Government services and things like that.

I really wouldn't care for a web shop etc.