Hacker News new | ask | show | jobs
by wannacboatmovie 584 days ago
Source? I'm not questioning it, I'd like to know more. DV always seemed vulnerable to DNS tampering.
2 comments
ta1243 583 days ago
And EV is vulnerable to a fancy looking fax (remember them?)

Do you really check your site has an EV every single time? Especially now browsers treat them the same?

If not, how do you know someone hasn't got a DV certificate for this specific visit?

Scott Helme has a thorough takedown of them, and that was 7 years ago when they were still a thing.

https://scotthelme.co.uk/are-ev-certificates-worth-the-paper...

link
aaomidi 583 days ago
I’m active in the WebPKI community (you might want to check out my Substack: https://webpki.substack.com/)

EV and OV when it includes dns names still requires domain control validation anyway.

EV certs are generally manually verified. This means there’s a human factor in the middle of this process. DV certs can, and should, be fully automated.

Multi perspective validation is about to be required too: https://cabforum.org/2024/11/07/ballot-smc010-introduction-o...

link