Who Are You? EV SSLs Not Engouh to Say For Sure
SearchSecurity has a compelling read in "EV SSL certificates won't stop phishers, researchers say" which isn't just a "No, it won't work" critque of extended validation SSL certificates. Researchers Billy Rios and Nitesh Dhanjan call EV SSLs commendable, but not enough. They call for a radical solution to the problem of phishing:
"What we really need is a revamp of the financial system in how identities are established in the real world."
That was part of the point of EV SSLs. By having a trusted 3rd party vouch for the identity of a business, customers would know they are working with the real McCoy. How exactly we should improve identity establishment is unclear. My first concern is cost. EV SSL have fairly extensive reporting and verification costs, what will a new and improved solution entail?
I'm looking forward to hearing more from Billy Rios and Nitesh Dhanjani. They've put forward some bold ideas that warrant attention, perhaps they've opened a subject we should have been discussing all along.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
