Extended validation certificates
Posted Nov 2, 2006 14:06 UTC (Thu) by gerv
In reply to: Extended validation certificates
Parent article: Extended validation certificates
You really should read the guidelines and look at IE's UI before commenting :-)
The UI in IE is of the following form:
SecureWebsite Ltd. (US)
so the country of origin is displayed.
Secondly, the certificate will contain (and the CA will hold) sufficient information about SecureWebsite Ltd. to enable the boys in blue in Lagos to track down the people behind it. The guidelines have been designed to raise the cost (in revealed information as well as money) of spoofing them above the possible return from getting a certificate fraudulently. In other words, you can't make them impossible to get round, but you can make it so expensive or time-consuming or dangerous that it's not worth it for the return you'd get from one phishing site.
Note that OCSP is mandatory for EV certificates, so they can be revoked quickly.
Of course, the vetting guidelines probably aren't perfect yet; if you can see holes in them, please do submit your points via the public comment system.
to post comments)