As someone with a direct interest in this (I run <a href="https://certsimple.com" rel="nofollow">https://certsimple.com</a>, a startup that focuses on steamlining the EV verification process), this is predictable but still hilarious:<p>> Through our own research as well as a survey of prior academic work, the Chrome Security UX team has determined that the EV UI does not protect users as intended (see Further Reading in the Chromium document). Users do not appear to make secure choices (such as not entering password or credit card information) when the UI is altered or removed, as would be necessary for EV UI to provide meaningful protection.<p>Chrome has never tested a verification marker that resembles ANY of the common standards for verification used on Twitter, Whatsapp, Facebook, Apple's App Store or Google Play.<p>No research into better indicators has been done because Google do not wish to do research into better indicators. Decisions are:<p>- made by one individual who believes users should be able to detect bad sites because they "don't look right"<p>- supported by another person who thinks users can use DNS to decider whether sites are real. Ask a regular web user, or even an infosec expert to determine which out of "google.im", "google.co.uk" and "withgoogle.com" is actually controlled by Google.<p>- and further supported by somebody else who thinks a study of IE7's UI:<p><pre><code> foo.com VeriSign [US]
</code></pre>
is relevant research (see this article).<p>Yes UX designed in the mid-2000s, prior to modern
verification standards, is sub optimal.<p>I've suggested Google's UX people investigate better alternatives for years. They're not interested.<p>The CAs aren't that much better either (being slow to realise how much the market is changing around them) but Google are absolutely not interested in finding out what would be possible with a modern verification UI, or making sure users know who they're connected to.