Andrew Pollack's Blog

Technology, Family, Entertainment, Politics, and Random Noise

Extended Validation Certificates -- Or "How can top level registrars screw you even more?" (already hacked, btw)

By Andrew Pollack on 07/21/2008 at 11:28 AM EDT

It isn't enough for Verisign and their ilk to suck a hundred bucks a year from every mom and pop internet shop on the market. Now they've created a new standard with the purpose of turning that $100 cost into $500 a year.

By paying for this "Extended Validation Certificate" you get a new special certificate that turns the address bar "GREEN". The browser makers have been talked into supporting this apparently.

Next comes the big advertising campaign that tells all the shoppers out there that if it doesn't make the address bar go green, its not a safe place to shop.

Why did they need this? They've offered higher cost certificates for years.

The advantage you get buying one of their "special" certificates now is the right to a badge or graphic emblem proclaiming your site to be super duper. Very few business pay for this. It means nothing to users.

By getting this new standard built into browsers, they want to make a universal trust sign that they can teach users to watch. Sure, that's what the "Lock" symbol on SSL pages was meant to do, but that's not good enough for these guys. They need to control it specifically for a higher tier (cost) of certificate.

I predict this will quickly become a "race to the bottom" for pricing, but it will still end up costing you twice the price of a regular certificate once the dust settles.

Wikipedia: Extended_Validation_Certificate

I did a quick Google search on "Extended Validation SSL" to compare pricing:

NetworkSolutionsDigicertVerisignThawteInstant SSLGoDaddy
Basic Authentication$89$144$399$99 (Sale)
$149
$89$29.99
* Basic Authentication standards vary. Some do more authentication than others, but all will look the same to most users.
Extended Validation$399.50 (sale)
$599.50
$488$995$899$359$499

By the way -- its already been hacked:

This Document (link) describes in depth the details on making IE7 (the first browser to natively support the money making SSL) turn the bar green for a self created certificate. They include a chart showing what versions were tested, with patches (complete as of June 2nd) and what versions of the OS required a user prompt and which ones did not.


There are  - loading -  comments....



Other Recent Stories...

  1. 04/04/2020How many Ventilators for the price of those tanks the Pentagon didn't even want?This goes WAY beyond Trump or Obama. This is decades of poor planning and poor use of funds. Certainly it should have been addressed in the Trump, Obama, Bush, Clinton, Bush, and Reagan administrations -- all of which were well aware of the implications of a pandemic. I want a military prepared to help us, not just hurt other people. As an American I expect that with the ridiculous funding of our military might, we are prepared for damn near everything. Not just killing people and breaking things, but ...... 
  2. 01/28/2020Copyright Troll WarningThere's a copyright troll firm that has automated reverse-image searches and goes around looking for any posted images that they can make a quick copyright claim on. This is not quite a scam because it's technically legal, but it's run very much like a scam. This company works with a few "clients" that have vast repositories of copyrighted images. The trolls do a reverse web search on those images looking for hits. When they find one on a site that looks like someone they can scare, they work it like ...... 
  3. 03/26/2019Undestanding how OAUTH scopes will bring the concept of APPS to your Domino serverWhile a full description of OATH is way beyond what I can do in this quick blog entry, I wanted to talk a bit about how "SCOPES" interact with the already rich authorization model used by Domino. Thanks to the fantastic work by John Curtis and his team, the node.js integration with Domino is going to be getting a rich security model. What we know is that a user's authorizations will be respected through the node.js application to the Domino server -- including reader names, ACLs, Roles, and so on. The way ...... 
  4. 02/05/2019Toro Yard Equipment - Not really a premium brand as far as I am concerned 
  5. 10/08/2018Will you be at the NYC Launch Event for HCL Domino v10 -- Find me! 
  6. 09/04/2018With two big projects on hold, I suddenly find myself very available for new short and long term projects.  
  7. 07/13/2018Who is HCL and why is it a good thing that they are now the ones behind Notes and Domino? 
  8. 03/21/2018Domino Apps on IOS is a Game Changer. Quit holding back. 
  9. 02/15/2018Andrew’s Proposed Gun Laws 
  10. 05/05/2016Is the growing social-sourced economy the modern back door into socialism? 
Click here for more articles.....


pen icon Comment Entry
Subject
Your Name
Homepage
*Your Email
* Your email address is required, but not displayed.
 
Your thoughts....
 
Remember Me  

Please wait while your document is saved.