<story><title>The Power to Revoke Lies with the Certificate Authority</title><url>https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-ca/</url></story><parent_chain></parent_chain><comment><author>cm2187</author><text>On EV certs, Troy Hunt rightly pointed that no one really cares about them and many major websites (amazon, youtube, facebook) don&amp;#x27;t even bother:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.troyhunt.com&amp;#x2F;on-the-perceived-value-ev-certs-cas-phishing-lets-encrypt&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.troyhunt.com&amp;#x2F;on-the-perceived-value-ev-certs-cas...&lt;/a&gt;</text></comment>
<story><title>The Power to Revoke Lies with the Certificate Authority</title><url>https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-ca/</url></story><parent_chain></parent_chain><comment><author>solatic</author><text>The idea behind EV&amp;#x27;s (to tie domain ownership to real-world legal entities) is sound, it&amp;#x27;s just that the implementation is poor.&lt;p&gt;If the EV badge identifies a legal entity plus its country of origin, then how is it supposed to be the CA&amp;#x27;s fault that there&amp;#x27;s this leaky abstraction of multiple legal entities with the same name in the same country? If we have a good idea and a poor implementation, then the correct response is to fix the implementation, not throw out the whole idea as fundamentally broken.&lt;p&gt;Unfortunately, there&amp;#x27;s also not much that the CAs can do to fix this by themselves. If we want to have a digital representation of a legal entity&amp;#x27;s identity, the best way to do that is to have a first-class digital identity rather than the hack of a system we have today which attempts to create a poorly supported, non-portable identity on the basis of emailed paperwork and phone calls. Such a first class identity - with private keys controlled by the legal entity, entrusted to the entity when it was first created - will allow clients to verify the identity against the &lt;i&gt;source which actually governs it&lt;/i&gt;.&lt;p&gt;I can understand the privacy concerns surrounding the creation of legal digital personal identities - the creation of a definitive population ledger that goes along with it etc. But for &lt;i&gt;companies&lt;/i&gt;? That the US doesn&amp;#x27;t have such a solution for companies in this day and age is just myopic.</text></comment>