"Green is good" and related security advice

Question

From Citizen's bank login page:

Should my browser address bar have a "green" indicator when I use Online Banking?

Yes. As an added measure, Online Banking gives you the capability to easily verify that you are on the authentic Citizens Bank website and not on a fake site created by fraudsters. Just look for the green bar (or some variation of it) in your browser address. The green bar should remind you that "green is good" and that our website has passed a sophisticated authentication process, letting you know you are good to go.

This seems heavily overstated to me. Isn't it trivial to get an HTTPS certificate? If so, is this just terrible advice, or am I missing something and is this in fact good advice?

(Do all browsers show the name of the entity that the certificate is issued to? If so, could the advice be amended to say "look for the name Citizen's Bank" in the green section of the adress bar"?)

Answer 1

Isn't it trivial to get an HTTPS certificate?

Yes

If so, is this just terrible advice, or am I missing something and is this in fact good advice?

Most phishing pages (hosted in compromised sites) are served under http, so asking the user to verify that the page is https does help somewhat to avoid phishing.

Moreover, what they call the "green bar" is probably the indicator of an Extended Validation certificate, offered by some CAs, which are harder (both in money and in requisites) to obtain. In which case the browsers will show (in some format) the name of the entity to which it was issued.

It's arguable how much the trick of looking for https: would help, given that those are often urls that would not pass even the most basic check, eg. http://woodenchairs.freehosting/wp-includes/yourbank.com/updateyourcreditcard

In my opinion the bank is trying to simplify his recommendations at maximum, hoping that even their most dumb customers may remember that "green is good" idea.

The main problem for them is that their customers actually don't need to remember that "it is good that it is shown in green" but that "it is not good that the green bar is not shown", and reacting on missing indicators is quite harder.

It is nonetheless a terrible advice, as the fact that a page is https (letters shown in green under Chrome, btw) only means that the communication with the other side is secure. Not that the other side won't make bad use of that.

Answer 2

The green bar means that it has an extended validation certificate which does carry a much higher burden of verification (and higher cost).

This does mean that it is much less likely to be used fraudulently, although obviously not impossible.

https://en.m.wikipedia.org/wiki/Extended_Validation_Certificate

Answer 3

Isn't it trivial to get an HTTPS certificate?

Yes

If so, is this just terrible advice, or am I missing something and is this in fact good advice?

This is not very good advice. Different browsers have different ways of displaying a green indicator, and those ways change over time. So what you should be looking for would change over time.

We don't have great evidence of how many phishing sites are or are not SSL.

What I recommend is that you use a bookmark every time you want to visit your bank. (Ideally, it's a bookmark in a different browser, but many people find that advice hard to act on.)

If so, could the advice be amended to say "look for the name Citizen's Bank" in the green section of the adress bar"?)

Yes, that might be better in some ways, but again, it's a moving target. The right advice, I think, is to have a bookmark, and encourage people to use it. That's easy to follow, develop a habit, and its under your control.