vtlynch

>they seem to be resellers for DigiCert/Symantec certificates

>they should at the very least have either ETSI TSP² or WebTrust³ certifications to meet the security/trust requirements for operating a CA

A reseller does not need to meet any of these certifications. Resellers have a business relationship with a CA, and all the steps related to certificate verification and issuance are handled by that CA.

On the backend, a certificate request for your site is handled the same by the CA whether if comes through a reseller or through them directly.

This is a common concern, but in reality, it does not mean anything. "Sharing" your cert with a weird site is similar as taking the same bus route as someone who is bad.

From a security standpoint, there is little to no risk. Worst case scenario one of the other sites is doing something that results in the cert being revoked... and I imagine CloudFlare has a way to just move you (and everyone else) onto another cert seamlessly.

Corrections:

1. Unicode Homograph attacks don't work in a business registration. Someone would have to be able to legally register a business name that fits your look-alike example. That is not possible in most places AFAIK.

So what you re actually pointing out is that domain names are vulnerable to these attacks, which is another reason why DV certificates can fall short.

2. Correct, different companies. This is as intended, but admittedly a weakness in the human-readability of EV certificates.

3. Not all roots can issue EV certificates.

4. It becomes much harder to remain anonymous if you do these things. You are right, it isn't impossible to register a company solely for malicious use. But it carries with it legal risk.

There are no Wildcard EV certificates. You are just describing Wildcards.

Crypto nerds do trust the HTTPS PKI that is why there are about a dozen industry-leading crypto people working at Chrome, Mozilla, etc on PKI crypto.

>But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? But aren't regular non-devs supposed to verify certificate name and the name of the website they are on?

The browser does this for you. Chrome (and all major browsers) have a certificate validation that parses the hostname in the certificate and compares it to the site you are on.

Checking certificate details manually is primarily useful for troubleshooting. It serves little to no security benefit for 99% of users.

Let's edit this comment for accuracy:

"[Some of us chose] to debug viruses, worry about floppy disk compatibility, learn how to change out failed hard drives, etc. if we simply wanted to use technology at all"

Now, Millennials is a pretty uselessly broad term, so depending on what age range you are actually talking about, there is slightly more truth to this. If you are talking about someone who is 29-34 today, then you would be an early adopter of these technologies and it did require a high level of expertise. However this was a very small portion of the population.

If you are talking about 22-25 year olds, then computers and the internet had become more common in households and de-skilling. I know plenty of people who have used and owned computers most of their lives and have never debugged a thing.

Nerds have the inability to understand that most people use computers like any other tool. They do not obsess over it, seek to understand how it works, or otherwise care.

Like a microwave, they buy a new one if their current computer "breaks." Like a light fixture, if it malfunctions, most people hire a repairman instead of doing it themselves.

This has always been true for the mainstream users of computers. It only seems more absurd now because 16-19 year olds have had smartphones and other technology luxuries their whole lives, and so we expect them to have invested more interest into truly learning how to use them and how they work.

But availability of a technology does not have much of a connection to proficiency of said technology.

Ironically, I am sure most of the people here who whine about how little other people understand computers have a similar lack of understanding for other objects they use everyday. How many people in programming/I.T. know anything about plumbing or car maintenance?

You mean in order to place it back on the machines? Sure, just one line.

But there seems to be a rather big difference between basic software that is guaranteed to be available and software that requires any amount of scripting/preparation to install, even if it is just one line.

Paint is one executable file, no? Getting rid of this does literally nothing to combat bloat and seems like a pointless move that will irritate users.

"Microsoft to remove ability to right-click."

Makes sense. Microsoft is missing out on recurring revenue. I'm sure there will be a Windows 10 Creators Pack for Mouse Power Users for $6.99/mo.