Changes to extended validation indicators put users at risk. Issue 12 (December 2019)

• Record Type: Journal Article
• Authors: Callan, Tim; Bailey, Chris
• Is Part Of: Network security. Volume 2019:Issue 12(2019)
• Page Start: 6
• Page End: 8
• Publication Date: 2019-12
• Subjects: Computer security -- Periodicals; Computer networks -- Security measures -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; Computers -- Access control -- Periodicals; 005.805
• DOI: 10.1016/S1353-4858(19)30142-4
• Languages: English
• ISSNs: 1353-4858

Abstract

Abstract : In 2019, both Google and Mozilla declared their intentions to remove distinctive extended validation (EV) certificate indicators from their browsers – indicators that tell consumers that a website has been vetted and validated through a thorough authentication process. At a time where the push towards increased consumer privacy exists on a global scale, with the US Congress proposing a handful of bills on the matter, and the General Data Protection Regulation (GDPR) taking effect in the European Union, these changes to Chrome and Firefox browsers seem to be a step in the opposite direction. Consumer privacy suffers in the absence of strong website identity. At a time where there's a push towards increased consumer privacy, Google and Mozilla removing extended validation (EV) certificate indicators from their browsers is a step in the wrong direction. Consumer privacy suffers in the absence of strong website identity. Rather than removing the indicators, the industry should work together to improve them. Browser companies can also engage Certificate Authorities to create training schemes to help users protect themselves online, argue Tim Callan of Sectigo and Chris Bailey of Entrust Datacard.