Are extended validation certs worth the extra money?

I find the Tec-Ed study

I find the Tec-Ed study methodology flawed in at least two ways:
1) Participants had to already be familiar with the lock icon to be part of the study. I don't think that's representative of most Internet users. Based on the success of phishing sites, most of which do not use SSL at all, people don't know when to look for a lock icon. So this wasn't a representative sampling of Internet users.

2) The study taints the participants. At the beginning of the survey, participants are shown an EV and non-EV site, then told all sbout the benefits of EV. Then they are asked if they recognized EV features in IE7 and whether they feel more comfortable with EV. It's human nature to not feel stupid so most people would agree that they saw something (even if they didn't) and would agree that they want to be more safe than less safe.

It would have been more helpful if this was a blind or double-blind study where participants were asked what differences they noticed between site A and site B, or how they felt entering their credit card in each site. Doubly helpful if the tester also didn't know what the EV features were either.

If SiteKey has shown us anything is that users don't recognize when security indicators are missing and don't know when a website is "secure" or not. I don't see the EV-specific features in IE7 really helping the problem.

Bill Burns
Security Hype blog and podcast

It seems to me that that the

It seems to me that that the value of an extended validation certificate increase exponentially with the likelihood of an anonymous transaction. Customers dealing with an established vendor care not about extended validation; trust has already been created. Most my ecommerce vendors fit this model.

However, websites selling to strangers are most apt to benefit from said validation. I'm surprised by the level of increased performance supposedly reported by DebtHelp & OverStock.com so soon after the release of browsers sensitive to extended validation certificates. But I expect that green address bars will become increasingly more effective over time.

Clifford Scarborough
Sage Computing
Sonoma, CA USA

Tim, Part of what I am

Tim,

Part of what I am saying is that people need to look into the EV cert (just like everything else) before they spend the extra money. If there is definite ROI there, then I say go for it.

In that vein, I wanted my friend to look at it from his business position and determine if it is cost justified. It turns out that his business model is not going to be helped by this, so I did advise against it.

And please don't get me wrong. From a security perspective, the idea of the EV cert is great. I like it when more vetting is behind the cert. I just don't think it is for everyone.

Thanks for your response and the great information. That will help those trying to determine if this is a good idea for them.

Have a good weekend.

Michael R. Farnum

Better to be despised for too anxious apprehensions than ruined by too confident a security.
Edmund Burke (1729 - 1797)