Slashdot Mirror

← Back to Stories (view on slashdot.org)

Extended Validation SSL, More Secure or Just a Racket?

Posted by ryuzaki0 on from the fun-with-revenue-generation dept.

Nalfeshnee writes "The Register is reporting on the new 'Extended Validation SSL' cert currently being touted by Verisign. Vista and IE7 will be using this but not, apparently, Firefox anytime soon. For this the Verisign Product Marketing Director Tim Callan squarely blames the Firefox dev team for 'not keeping up' with their new technology. However, the whole thing just seems to be a way for Verisign to enjoy ridiculous markup on selling 'more secure' certs."

1 of 205 comments (clear)

  1. Re:I don't get it by Anonymous Coward · · Score: 5, Informative

    I used to work at a certain SSL place, so here's what I could gather.

    Right now to get a cert it's a phone call verification or something else that can be done remotely.

    For High Assurance CAs, the issuer has to fly a person out to the physical site, take pictures of the site, go inside, take pictures of at least two(?) employees, get names of workers, get signatures, and so on. At least that was the idea last I heard.

    Rather than a remote validation, which I guess is easier to forge and easier to issue a mistake to by accident, this requires in person validation and lots of other crap you can't do without actually going there and checking it out. You decide if it's worth it. If not seeing that "special green color" stops just a few customers from using your site, it probably is.