As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) phishing attacks? Are there any other differences between EV SSL and regular SSL?
3 Answers
SSL certificates are used for setting up an encrypted connection between client and server. The identity verification part is in theory done by the certificate issuer before issuing the certificate.
But the SSL market is a bit of a scam, really. Many SSL certificates are issued with an absolute minimum of verification of identity. You can easily find SSL certificates for less than 20 USD, and how much detective work can you get for 20 USD... And mind you, these are not self-signed certificates, but certificates with the same root as the expensive ones from Comodo, Thawte etc.
Extended Validation (EV) certificates are only different in one aspect, but it's an important one: There are clear minimum standards for the verification of identity before issuing the certificate. Based on this, all modern browsers give EV certificates a much more prominent treatment in the user interface -- the 'green bar'.
So the big question for site owners is "Do EV certificates reduce abandonment rate?". Predictably the certificate issuers have released whitepapers stating that they do work, and are worth their much higher price tags. I'm not so sure. I have looked for independent proof of this, and I haven't seen any yet.
Getting a regular SSL certificate is easy, getting an EV one is much harder. You'll generally have to jump through more hoops to establish your identity for EV certs.
Is it true that EV SSL verifies the host itself, thus preventing (in theory) phishing attacks?
They help, but they do not prevent phishing attacks. A phishing attack is someone else impersonating you, in any media from websites to the telephone or fax. If your users look for the EV green bar with your company name, then a EV cert offers some protection against phishing on the web. But how many users really pay attention to this? I'm guessing it's a minority.
-
I wouldn't be surprised if social engineering was a more effective way of getting someone's login details - in which case an EV SSL won't help you one little bit. Commented Sep 20, 2010 at 4:52
Is it true that EV SSL verifies the host itself, thus preventing (in theory) phishing attacks?
Correct, that's the theory, and after having gone through an EV application, I can report that they are incredibly stingent. Our company address was oh-so-slightly different in our application as to what was listed in some company register they were referring to, and our application was rejected multiple times until we got all of the details sorted out.
answered Sep 20, 2010 at 1:13
Many of the current phishing techniques rely on driving customers to spoofed Web sites to capture personal information. Technology such as Secure Sockets Layer (SSL) and Extended Validation (EV) SSL are critical in fighting phishing and other forms of cyber crime by encrypting sensitive information and helping customers authenticate your site.
To help prevent phishing attacks from being successful and to build customer trust, companies also need a way to show customers that they are a legitimate business. Extended Validation (EV) SSL Certificates are the answer, offering the highest level of authentication available with an SSL Certificate and providing tangible proof to online users that the site is indeed a legitimate business.
EV Certificates gives Web site visitors an easy and reliable way to establish trust online by triggering high security Web browsers to display a green address bar with the name of the organization that owns the SSL Certificate and the name of the Certificate Authority that issued it.
