PayPal's Beautiful Demonstration of Extended Validation FUD
On the HN thread on Troy&#x27;s last post about this, I said [1]:<p><i>&quot;Big sites can get by with DV because people trust big sites by fiat, just by mental associations they already have to a URL. There&#x27;s no benefit to Facebook having an EV cert, because literally everyone who&#x27;d want to visit Facebook knows Facebook&#x27;s URL. User error about entering credentials on the wrong site -- accidentally due to typosquatting, or through leading such as phishing -- is better mitigated in other ways: multi-factor authentication (especially unproxiable such as U2F); not by making the high-profile site pay thousands of dollars for a text string in green, when there&#x27;s users who fall victim to phishing from bizarre domains too.&quot;</i><p>Ultimately, this is a bad example to show that EV is pointless. The biggest benefit of EV is as a flawed signal of legitimacy [1] for sites whose URLs aren&#x27;t widely known and get a fair amount of first-time visitors: web presence for real-life service businesses, specialized payment portals accessed through redirects, and the like.<p>This is because people&#x27;s mental model of the trust that EV confers is broken. People typically care about whether the site they arrived at was the one they were intending to visit, which the computer can&#x27;t possibly know without additional input, but EV has attained a role of serving as a flawed signal of such, because the browser bar said something that doesn&#x27;t look alarmingly different.<p>EV formalizes the vetting between legal entity and domain name, so it translates okay to entities that are firmly anchored in meatspace. But all of this chaining is trust in people&#x27;s heads is done by names and strings, and experiments like stripe.ian.sh prove [2] why it&#x27;s fallible. Nonetheless, EV effectively allows one extra indirection between (1) the name of the business as people refer and recognize it, and (2) the domain name that&#x27;s likely correct, than DV does -- and some operators and some visitors benefit from this indirection, when the URL doesn&#x27;t roll off the tongue.<p>[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=18010961#18011914" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=18010961#18011914</a>
[2] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=15904513#15909273" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=15904513#15909273</a>