Re:Extended Validation Certificates Are Really Dead
by ocdtrekkie on Monday August 12, 2019 @05:18PM
(#20680112)
You are dismissing the primary issue at hand, which underpins the entire conversation. Phishing is what EV addresses. And if you're not addressing phishing, you're not meaningfully addressing any sort of Internet security whatsoever.
[ Parent
| on HN ]
Re:Extended Validation Certificates Are Really Dead
by tptacek on Monday August 12, 2019 @05:45PM
(#20680381)
The incoherence of EV as a response to phishing is part of why it's failed. But I'm not talking about EV; I could care less about EV. I'm addressing your (false, increasingly so as thread deepens) claim that HTTPS doesn't require any form of PKI and that users might as well rely on self-signed certificates. Obviously: no.