Kaminsky DNS Flaw + Domain Validated SSL = Phisher's Paradise

The real issue here is the browsers virtually treat all root certs in the browser as if they have identical proceedures and policies, so if one CA is affected by this BIND* issue, then the browser will happily treat their cert just the same as every other CA that isn't effected.

At the end of the day X.509 needs a serious over haul, and Mozilla and others missed the boat big time during the time EV was being drawn up, they need to be able to give end users more control, or at least a lot more info on the CA doing the signing, that way if one CA starts issuing bad certs for whatever reason that CA is effectively ostracised as a result. At present all CAs and by default all certificates are virtually identical to most end users, they don't really care if the bar is green or yellow no matter how much the snake oil sales men keep trying to push the smelly cow poo.

* Unlike people keep spouting this isn't a general DNS problem, well depends what the stats are on BIND and BIND derived v other deployments for resolving name servers I suppose.

The CAB Forum did develop the EV standard, but what is most important is they also developed an industry standard for validation of these certificates. For any CA to issue these certificates, they must be audited on an ongoing basis or they will loose the right to issue the certificates.

This is a good thing for the industry and provides the type of policing that was not happening before.

The difficult part is that the EV Validation process is stringent, and difficult to execute on international organizations or small companies. This will improve over time as the forum is constantly listening to the CA's to try and enhance the specifications to make business easier while ensuring high integrity of issued certificates.

Once a CA figures out how to cost effectively issue EV's, you will see other cert types disappear.

The reason is simple: If you could use a certificate that validates the web sites identity (which means if you were ripped off you have access to legally validated contact information for the site owners) would you even browse to other sites?

If you could protect your site with a certificate that is issued quickly and costs as much as a GoDaddy DV cert, yet provides your customers with the confidence that you are contactable in any circumstance.... would you pass it up?

EV is here to stay, it will get easier to obtain, quicker to issue and remain a strong validation source that will continue to grow in value as vulnerabilities like Kaminskies continue to be found.

But they aren't, you are dealing with multi-jurisdictional areas if not multi-countries so even if you know who you often have little recourse unless you have the resources to sue them in their jurisdiction.

Identity is one thing, but how many people get ripped off year after year after year in person, how exactly will EV save you?

The best advice I can give is use a credit card, you have easy recourse with your financial institution who in turn would have contracts or agreements with similar organisations to return funds if you are ripped off.

Anyone thinking they can get a more effective recourse more easily is living in a pure fantasy world and they probably believe other fairy tales are true too.