Re:Extended Validation Certificates Are Really Dead
by tptacek on Monday August 12, 2019 @05:11PM
(#20680052)
You keep answering this question with an unrelated question. Like I said: phishing works and is too easy to accomplish. That isn't an answer to the question I just asked you.
Re:Extended Validation Certificates Are Really Dead
by ocdtrekkie on Monday August 12, 2019 @05:18PM
(#20680112)
You are dismissing the primary issue at hand, which underpins the entire conversation. Phishing is what EV addresses. And if you're not addressing phishing, you're not meaningfully addressing any sort of Internet security whatsoever.
Re:Extended Validation Certificates Are Really Dead
by tptacek on Monday August 12, 2019 @05:45PM
(#20680381)
The incoherence of EV as a response to phishing is part of why it's failed. But I'm not talking about EV; I could care less about EV. I'm addressing your (false, increasingly so as thread deepens) claim that HTTPS doesn't require any form of PKI and that users might as well rely on self-signed certificates. Obviously: no.
I am not saying issuing self-signed certs are great, merely that CAs do not meaningfully improve on them if domain validation is all we have, because domain validation doesn't tell you a heck of a lot.
As you said in another response, the CA system has problems. EV, at least, represents something useful when issued by a CA and solves a real problem. And the problems with EV Troy complains about are all fixable.