Who killed the EV cert? A browser whodunit for Halloween

Extended Validation certificates once displayed a company’s verified name prominently in browser address bars, promising users a visible way to distinguish legitimate businesses. That promise weakened because research found people rarely noticed or acted on the indicator; browsers consequently moved EV details behind extra clicks. A 2017 demonstration exposed another limitation: researcher Ian Carroll obtained a valid certificate for a Kentucky company also named Stripe, Inc. The certificate was accurate, but the browser’s abbreviated display could make it seem connected to the better-known payment company. Meanwhile, Let’s Encrypt made basic domain-validation certificates free and automatic, helping HTTPS adoption rise from below 30% to roughly 80% in Firefox-based measurements. These certificates encrypt connections but do not establish whether a site or business is trustworthy. Since legitimate sites and phishing operations can both use HTTPS, the familiar lock is not proof of identity either.

The argument is that verified website identity may become useful again through EU Qualified Website Authentication Certificates, or QWACs. Unlike EV, the proposed “2-QWAC” design keeps identity in a separate certificate linked to a site’s regular TLS certificate, allowing businesses to add independently verified identity while retaining free HTTPS. Browsers are required to support the system starting in January 2027. The author sees AI agents as a potential audience better suited than people to use certificate details: software could compare a site’s legal identity and jurisdiction with trusted records, flagging mismatches such as the two Stripes. Identity alone will not prevent fraud, but it could give automated systems an additional signal alongside reputation and other evidence - and make verified identity worth adopting again.