Most of the comments against EV certificates on this list have been focused on whether or not the current Firefox EV UI is relied on by Firefox users to make security decisions. (Actually, I have only seen a Google paper on this issue in Chrome, no research from Firefox.)
But there is an ecosystem of anti-phishing browser filters (e.g., Google Safe Browsing, Microsoft Smart Screen) and services (e.g., PhishLabs) as well as others that use the current identity information in EV certs to make better determinations of positive and false positive phishing sites and thereby protect users, as well as for other user security purposes. Many on this discussion would like to see EV certs disappear entirely and move all websites to DV certs. But remember, if EV certs disappear, so does all the EV identity information that’s being used today by security software to protect users. So my question to those who want EV certificates to disappear is this: OK, then what is *your* plan for protecting users? Browser filters will be weaker without EV information (and some browser filters today miss 20% of phishing sites at zero hour, according to NSS studies). How will you replace the EV information that’s being used today by phishing filters and services to protect users? Any decision on removing the EV UI in Firefox should consider all the related impacts on user security, and not just focus on a single issue (namely, “Do users rely on the EV UI?”), especially when the current Firefox EV UI is doing no harm. _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
