I wasn’t clear what I meant by “who” – the owner of the domain.
EV still doesn't give you that
Not in anything that resembles a useful metric:
In fact, Mozilla went even further and referenced the great work that Ian Carroll did when he registered a colliding entity name and got an EV cert for it:
More recently, it has been shown that EV certificates with colliding entity names can be generated by choosing a different jurisdiction. 18 months have passed since then and no changes that address this problem have been identified.
All Ian had to do was spend $100 registering "Stripe Inc" in a different US state to the payment processor you'd normally associate the name with then another $77 on the EV cert and less than hour later, he had this newsworthy result… (https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead)
EVs have had no use (outside of yet-to-be-updated compliance guidelines) for years:
- https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas-phishing-lets-encrypt
- https://www.troyhunt.com/extended-validation-certificates-are-dead
- https://scotthelme.co.uk/alexa-top-1-million-analysis-august-2018
- https://twitter.com/troyhunt/status/885757111182934017
- https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is
- https://www.typewritten.net/writer/ev-phishing
- https://en.wikipedia.org/wiki/Extended_Validation_Certificate#Criticism
- https://stripe.ian.sh
October 08, 2019 at 10:10AM
via reddit https://www.reddit.com/r/security/comments/denirw/can_you_trust_a_remote_binary/f300ymi?utm_source=ifttt