A certification authority is supposed to verify the identity of whoever request a certificate before issuing (signing) that certificate; a certificate containing the name
www.example.com shall be awarded only to an entity who indeed "owns" the domain
example.com. An Extended Validation Certificate is a certificate where the CA made that identity verification more thoroughly.
Theoretically, this extra validation makes it harder for attackers to obtain fake certificates for domains that they do not own. In practice this does not really increase security for two reasons:
This extra validation will block attackers only if end users enforce it. Namely, you could buy an EV certificate for your server, but the attacker, supposedly, will only be able to bamboozle the CA into issuing a fake non-EV certificate. So what ? The attacker will run his fake Web site with the fake non-EV certificate. Nothing has changed, unless the end user (the poor guy who is about to see his bank account siphoned out) makes sure that he connects only to an EV-certified bank site, and refuses to type his password if his browser does not show the extra-green thingy. Real users don't do that. At best, most users will abstain if they get an explicit, red, scary warning; but expecting users to react on the simple lack of a green rectangle is too optimistic.
Phishing, as it is done today, does not use fake certificates. Obtaining a fake certificate is too much trouble. 99% of the phishing is about showing a non-SSL site (
https://) to the victim, and hoping that the victim won't notice. It works well. After all, if the phisher can plunder the bank accounts of only, say, the 10% most gullible victims, then... the phisher still gets rich.
Peter Gutmann calls EV certificates an illustration of the PKI-me-harder effect; the main consequence is that commercial CA can charge more for certificates, in the name of better solving a problem that we did not have before.
The end user is the important element here. You will need an EV certificate when (if) end users begin to require the greenish graphical element, and go spend their money elsewhere if they don't see it (and, at that point, it would become non-ridiculous to claim that EV certificates actually increase security). I don't see such things happening any time soon. Unless browser vendors collude with the big commercial CA to make non-EV certificate appear red and scary.