Hide EV certificate badge in url field


  • Vivaldi Translator

    For some websites like https://nos.nl the green padlock icon in the address bar is accompanied by the name of the certificate holder. This is a waste of space.
    Please move this surplus information to a Mouse Over info box.


  • Vivaldi Translator

    @S_Paternotte said in Hide certificate badge in url bar:

    nos.nl

    This is standard browser behaviour.
    That extra info is because they have an extended validation certificate
    https://en.wikipedia.org/wiki/Extended_Validation_Certificate


  • Vivaldi Translator

    @Dr-Flay That may be the case. My suggestion is to move this piece of (superfluous) information to a 'mouse over' popup.


  • Moderator

    That should not be changed.
    The current state is on browser a default and shows for very trusted certificates more information.
    That is needed and useful for f.ex. banking, shops, etc. to see if they have a trusted EV certificate or only a fake Let's Encrypt.


  • - Ambassador -

    @Gwen-Dragon The request is not to remove the information, just to move it to a tooltip to save space in the URL field.

    Let's be honest here, the fast majority of users have no clue what it means. Those who do can hover the green padlock to see the details.


  • Vivaldi Translator

    @Pesala yeah, thank you


  • Moderator

    @Gwen-Dragon Often, many users don't actually know what this means. You or me may recognise the significance, but I know plenty of ordinary users who would not even notice the difference between a regular padlock and an EV certificate.

    Many browsers are now phasing this technology out as it is security theatre, and some browsers just plain don't support it.

    Placing more focus on the domain in the URL will be helpful for spotting phishing.


  • Vivaldi Translator

    I would happily swap the cert info for DANE validation info which makes more sense to end users.
    Certificates can be as secure as possible, but with no validation that the domain you are on matches the correct IP, it is worthless.


  • Moderator

    Here are more pro-arguments by security experts:

    FWIW, Chrome has tested this already (and has a flag for it, which doesn't work in Vivaldi unfortunately) and Brave browser has this feature enabled by default.



  • You are suggesting a feature so Vivaldi users are more insecure while browsing online? That would make it easier to phish and trick Vivaldi users with fake banking and other payment pages that rely on this security feature so users take a bit more attention while surfing online. Phishing EV certificates is not easy and this is why most banking sites use one.

    The purpose of EV certificates is precisely that. To display the full company name and location that was approved for that certificate. You can't just go and buy an EV without actually passing some certification that includes proving the company is real, the process is manual and attackers don't like anything manual because they it costs them time as opposed to automated things.

    If you hide that information then Vivaldi would be the only browser that is not in compliance with EV certificates.



  • @LonM

    Security theater? The only persons that hate his are phishing authors and hackers as it makes their job harder. Plenty of people from newbies to more advanced users will know something is wrong if they go to Apple.com and don't see the name on the URL bar. They might not know what or how it works, but they will noticed something is off. Same goes for their banking sites and other major sites. You cannot fake that. Anything phishing authors can't fake unless they already compromised your browser or computer is not a security theather but improves visibility while browsing online.



  • @Pesala said in Hide EV certificate badge in url field:

    @Gwen-Dragon The request is not to remove the information, just to move it to a tooltip to save space in the URL field.

    Let's be honest here, the fast majority of users have no clue what it means. Those who do can hover the green padlock to see the details.

    That is the same as removing it. If you are saying most users have no clue what it means, how many of them do you think will click on it to see if its displaying the company name? Hiding security elements that make the URL or web address more secure is not a feature but a downgrade. People don't remember things that are not visible all the time when it comes to GUI and interfaces. Forcing users to click on the URL bar in order to check if they are on their major banking site and verify if its the proper website is a disservice and just helps more people being tricked into phishing pages.


  • Moderator

    @terere

    You are suggesting a feature so Vivaldi users are more insecure while browsing online? That would make it easier to phish and trick Vivaldi users with fake banking and other payment pages that rely on this security feature so users take a bit more attention while surfing online. Phishing EV certificates is not easy and this is why most banking sites use one.

    Yet not all payment systems use EV and real people do not stop the payment process if they don't see EV, because they don't always look for it and they still see the lock itself. Some antiviruses prevent the display of any EV, too.

    If you hide that information then Vivaldi would be the only browser that is not in compliance with EV certificates.

    Brave has it by default, Edge has had it (not sure about the Chromium-based one), Chrome has tested it with real users and every mobile browser currently does not display EV, even Safari removed it.

    Please have a look at the articles I linked above, they explain the arguments against EV in detail.


  • Vivaldi Translator

    @terere I think you're overreacting here.
    I'm not asking to remove the green padlock icon. So a clear indicator of the secure connection is still there, isn't it?
    My suggestion focusses on the (quite few) websites that use these extended certificates where the certficate holder may not necessarily reflect the URL. The only thing I'm suggesting here is that this "extended" certificate information, which I deem superfluous, is moved to a tooltip.

    Practical example:
    0_1563180697065_2b043ce9-6ad4-478f-be6e-0af8c969166e-image.png

    1. Keep the green padlock icon indicating the secure (not necessarily safe!) connection,
    2. Hide the extended information "Vivaldi Technologies AS (NO)"
    3. Introduce a mouse over tooltip showing the Extended Certificate Information, i.e. "Vivaldi Technologies AS (NO)"

    No harm done, less clutter and more spave available for the vigilant user to keep a close watch on nasty long URL's in the address bar.



  • @S_Paternotte
    Hi, you can hide it or it is hide for me.
    Address bar settings seams not influence it.
    Is it may different in Windows?

    0_1563184692248_2019-07-15 11.55.27 forum.vivaldi.net 72596b0ec048.jpg

    Opensuse Tumbleweed x86_64
    CPU i7-3520M 8 GB
    GPU Intel HD4000
    xf86-video-intel 2.99.917-6.1
    KDE Plasma 5.59.0-1.1
    Vivaldi: 2.7.1594.4 (Official Build) snapshot (64-bit)

    Cheers, mib


  • - Ambassador -


  • Vivaldi Translator

    @mib2berlin or look at https://vivaldi.com/, which was the example I was using



  • Oh, OK, sorry for the noise. doh

    Cheers, mib


  • Moderator

    @terere said in Hide EV certificate badge in url field:

    Plenty of people from newbies to more advanced users will know something is wrong if they go to Apple.com and don't see the name on the URL bar

    Which name? Both of my main Web browsers on mobile just show "apple.com" and leave it at that.

    As for other sites, so many use a random name of the umbrella company that owns the company that runs the site that I think it is unrealistic for a user, who may be totally new to a website, to know which name they expect to see the first time they visit a site.


  • Vivaldi Translator

    Personally I wouldn't use what Chrome do or want to do as a good example, as they want to hide everything, such as HTTP/HTTPS WWW and the section of the site you are on.
    If Google have their way all you will see is the domain name and no extension, eg.
    www.vivaldi.com and www.vivaldi.net would just show as vivaldi.
    This is the company that decided having a switch to enable/disable certificate revocation was "too confusing" so hid it and removed it from the advanced settings.

    Yes Malware authors have gameified the system by also buying certificates.
    Until an alternative is in use we still need to see the details, or you may as well not bother with certificates at all.
    It's not like Chrome will check properly for revocation or validity anyway.
    Personally I would rather that the system is fixed instead of ignored.



Looks like your connection to Vivaldi Forum was lost, please wait while we try to reconnect.