Q:

SSL is Extended Validation more secure?

Talking about SSL certificates, there are 3 types.

Basic validation
Business validation
Extended Validation

The first one checks only if a domain name is registered for the user which issues the certificate.
The second one also requires information about the company.
The last one checks the physical location of a company.
My question here, do the 2nd and 3rd option make the connection more secure? Because our users know the domain is ours (100% verified with them) and they all contain a 128-bit encryption.

Will the 1st certificate be enough for us, or do you recommend the 2nd? I consider number 3 an option for banks.

A:

A certification authority is supposed to verify the identity of whoever request a certificate before issuing (signing) that certificate; a certificate containing the name www.example.com shall be awarded only to an entity who indeed "owns" the domain example.com. An Extended Validation Certificate is a certificate where the CA made that identity verification more thoroughly.
Theoretically, this extra validation makes it harder for attackers to obtain fake certificates for domains that they do not own. In practice this does not really increase security for two reasons:

This extra validation will block attackers only if end users enforce it. Namely, you could buy an EV certificate for your server, but the attacker, supposedly, will only be able to bamboozle the CA into issuing a fake non-EV certificate. So what ? The attacker will run his fake Web site with the fake non-EV certificate. Nothing has changed, unless the end user (the poor guy who is about to see his bank account siphoned out) makes sure that he connects only to an EV-certified bank site, and refuses to type his password if his browser does not show the extra-green thingy. Real users don't do that. At best, most users will abstain if they get an explicit, red, scary warning; but expecting users to react on the simple lack of a green rectangle is too optimistic.
Phishing, as it is done today, does not use fake certificates. Obtaining a fake certificate is too much trouble. 99% of the phishing is about showing a non-SSL site (http://, not https://) to the victim, and hoping that the victim won't notice. It works well. After all, if the phisher can plunder the bank accounts of only, say, the 10% most gullible victims, then... the phisher still gets rich.

Peter Gutmann calls EV certificates an illustration of the PKI-me-harder effect; the main consequence is that commercial CA can charge more for certificates, in the name of better solving a problem that we did not have before.
The end user is the important element here. You will need an EV certificate when (if) end users begin to require the greenish graphical element, and go spend their money elsewhere if they don't see it (and, at that point, it would become non-ridiculous to claim that EV certificates actually increase security). I don't see such things happening any time soon. Unless browser vendors collude with the big commercial CA to make non-EV certificate appear red and scary.

A:

They don't make the connection any more secure in terms of the encryption being hard to break, but they do make it more secure in that it is less likely an intruder was able to trick a CA in to issuing a certificate in error.  
The level of validation is entirely about earning the trust of your users.  Personally, I just do basic validation, but that's just validating to a name or a domain a lot of the time.  Knowing that I'm actually talking to the server www.iamevil.com doesn't really help instill confidence.  Business validation allows you to have the certificate use the business name and proves that I'm talking to a real organization.  Extended validation results in the green bar being presented on most browsers indicating that there is a high degree of trust in the identity of the party they are communicating with.

A:

As AJ says it doesn't have any impact on the level of encryption but it is intended to protect the trust model underpinning SSL/TLS.
For most sites using SSL, the overriding consideration is how this is perceived by customers. AFAIK there is no visible difference between the first 2, but EV adds a green thing to your location bar in most browsers. Whether this actually makes a difference to users, I don't know - not suprisingly the CAs claim they do but I've seen little evidence to support this. I remember reading a research paper several years ago where the investigators found that more users thought a site was more secure if it contained a picture of a padlock than if it were served up over HTTPS.
Hence the value is in user perception. 
This paper from 2007 says that users can't tell the difference, while Geocerts assert that another study in 2007 said it did have an impact.
I'd like to think that users are getting more sophisticated - and therefore this is likely to change over time. But you'll need to bit of a bit of research to device if there's a measurable benefit (or run an A/B test)

