News for hackers. Stuff that matters.

A comment on Extended Validation Certificates Are Really Dead. Parent comment

Re:Extended Validation Certificates Are Really Dead by tptacek on Monday August 12, 2019 @05:11PM (#20680052)
You keep answering this question with an unrelated question. Like I said: phishing works and is too easy to accomplish. That isn't an answer to the question I just asked you.
[ Parent | on HN ]
Re:Extended Validation Certificates Are Really Dead by ocdtrekkie on Monday August 12, 2019 @05:18PM (#20680112)
You are dismissing the primary issue at hand, which underpins the entire conversation. Phishing is what EV addresses. And if you're not addressing phishing, you're not meaningfully addressing any sort of Internet security whatsoever.
[ Parent | on HN ]
Re:Extended Validation Certificates Are Really Dead by tptacek on Monday August 12, 2019 @05:45PM (#20680381)
The incoherence of EV as a response to phishing is part of why it's failed. But I'm not talking about EV; I could care less about EV. I'm addressing your (false, increasingly so as thread deepens) claim that HTTPS doesn't require any form of PKI and that users might as well rely on self-signed certificates. Obviously: no.
[ Parent | on HN ]