Why the Address Bar Lost Its Trust Signals — QWACs, AI Agents and Website Identity | MyTechDailyNews

By Sarah Chen · MyTechDailyNews, General desk

Most people hit pay without asking who is really running the page in front of them. That question — not the certificate paperwork behind it — is why this story still matters in 2026. A decade ago, a green company name sitting beside the address was the closest thing the web had to a licence displayed in a shop window. Today that cue lives behind one or two clicks, encrypted connections are the default almost everywhere, and the identity of the business on the other side has quietly gone back to being invisible.

The chain of events reads like an Agatha Christie plot with several culprits instead of one: Two companies sharing a brand name, a nonprofit giving certificates away, three browser vendors redesigning the same strip of interface, and research suggesting that people simply never looked at the signals. With Halloween approaching, this explainer reopens the case in everyday language, then looks at the two forces that could rewrite the ending: the EU’s new certificate framework and AI agents that browse on our behalf.

What you need to know in sixty seconds

• Certificates come in three levels of identity checking: Domain Validation (DV) for control of a domain, Organization Validation (OV) for a vetted organisation, Extended Validation (EV) for a detailed check of the legal entity.
• EV’s reward was interface real estate: browsers displayed the verified company name in the address bar, often in green.
• Browser vendors removed or buried that display after studies of user behaviour and after a company-name collision proved that accurate data could still mislead.
• Free, automated DV certificates made HTTPS normal, which also drained the commercial certificate market of its main consumer-facing argument.
• The outcome is nearly universal encryption with nearly no visible identity checking — the gap that QWACs, 2-QWAC and AI agents are now aimed at.

DV, OV, EV: the difference is how much checking happened

Certificates do two separate jobs. The first is scrambling traffic between your device and a website so nobody in the middle can read it. The second is recording how carefully a third party confirmed who stands behind the domain, and not every certificate does that job to the same depth.

Type	What gets verified	Main purpose	Address-bar treatment
DV	Control of the domain	Encryption	The padlock, same as any HTTPS site
OV	Domain plus review of the organisation behind it	Encryption with organisational backing	Not surfaced
EV	The most detailed check of the legal entity, including incorporation jurisdiction and registration number	Identity plus encryption	Company name beside the URL, often green

The bargain that never paid off: paying for a label people ignored

The EV arrangement worked as a trade. A business paid extra for a deeper legal check and received visible reassurance on every page view. In Chrome and Firefox, that reassurance was the company name beside the URL, typically rendered in green.

The weak link was human attention. People are poor at detecting trust indicators, and equally poor at detecting their absence, so EV never became the security measure it promised to be. When Chrome explained moving EV information out of the address bar in Chrome 77, it cited research showing that changing or removing the indicator did little to change users’ security decisions: people still entered sensitive information for fraudsters even with no company name on screen.

Other vendors converged on the same conclusion. Safari lowered EV’s visibility in 2018; in 2019, Firefox relocated its indicator into the site-information panel.

The Kentucky episode: a true statement that still fooled people

It also became clear that a company name on its own cannot establish trust. In 2017, security researcher Ian Carroll incorporated a business in Kentucky called Stripe, Inc. and obtained a valid EV certificate for it. The widely known payments brand Stripe is incorporated in Delaware, so there was no collision on paper and the certificate was genuinely correct. Browsers, however, displayed both firms as Stripe, Inc.

The demonstration set off a real debate among browser-security specialists about identity information that is accurate and still confusing. Carroll’s company really was Carroll’s company, but with only the name on screen it inherited the reputation of a different business. EV certificates could carry finer detail, such as the registration state, that would separate the entities; the limited browser-bar user interface had nowhere for it, so the extra data was discarded. And few internet users could be expected to know the incorporation jurisdiction of everyone they dealt with. Kentucky Stripe was one of the nails in the coffin: Mozilla later cited name collisions of this kind among its reasons for burying the indicator behind clicks.

Free certificates fixed encryption and broke the business model

While identity was being argued over, Let’s Encrypt — a service from the nonprofit Internet Security Research Group (ISRG) — was fixing a larger, less glamorous problem: most of the web still travelled in the clear. Basic DV certificates became free for any website, and automated renewal removed the three things that had kept owners away from SSL — fees, manual configuration and recurring maintenance.

It worked. Let’s Encrypt’s tenth-anniversary account describes global HTTPS usage, measured through its Firefox-based data, rising from below 30% to around 80% over roughly five years, with browser changes and hosting providers also driving that progress.

Let’s Encrypt did not, and does not, issue OV or EV certificates. That stopped mattering once browsers removed the prominent badge, because the paid certificate and its additional vetting had basically no utility left. The commercial CA industry, whose core business had been paid SSL certificates, took the hit. EV and OV certificates are still on sale for niche buyers with identity, procurement or service requirements, but paying extra to reassure ordinary visitors was effectively dead.

A padlock for everyone, including the fraudsters

Here is the consequence ordinary readers feel. An authentic site and a phishing imitator can both get free DV certificates, pass exactly the same TLS checks, and show exactly the same icon — because a fraudster can protect card data in transit and prevent man-in-the-middle attacks just as well as an honest shop.

Let’s Encrypt explained that limitation before launching publicly: a CA’s responsibility begins at encryption and ends at content, and deciding legitimacy is the job of others.

The padlock never earned much public understanding either. In its 2023 explanation of the icon’s retirement, Chrome reported that only 11% of participants in a 2021 study understood its precise meaning, and noted that nearly all phishing sites used HTTPS. Chrome swapped the lock for a settings-style icon; Safari retained the lock. So in 2026, internet users still face the nagging question of who is responsible for a particular website.

The EU route: QWACs and the 2-QWAC split

The EU never let go of the idea that websites should have an identity behind them. Qualified Website Authentication Certificates, or QWACs, are the foundation for bringing verified business identity back into browsing, and as of January, 2027, browsers are required to support it.

QWACs carry verified identity data like EV did, but inside the EU’s regulated trust ecosystem instead of leaving presentation decisions to browser companies. Unlike EV, the newer 2-QWAC approach keeps that identity in a separate certificate, cryptographically linked to the site’s ordinary TLS certificate.

Separating the concerns is the practical point. A site can keep its existing HTTPS setup — including a free Let’s Encrypt certificate or subscription — and add identity as an optional component. Owners get the useful combination of free automated connection security and independently checked business identity for users.

Why AI agents change the maths

The obvious objection remains: humans do not pay attention to certificates. That critique still stands for people. What changed is the audience. In 2026, software can programmatically check identity claims on every visit, examine available attributes and compare them with a known trust list; an LLM’s attention budget can take in far more than a green label squeezed beside a URL.

Run the earlier case through this lens. Where a person saw the same brand name twice, a personal AI agent could compare the certified entity’s jurisdiction in QWAC certificate metadata with a trusted record of the intended merchant, then flag a mismatch to the human user. Because the verification infrastructure is already part of browsing software as of January, an agent can extract identity data, use it when evaluating a transaction, and make it available to the person approving the purchase.

That is not to say identity will stop internet fraud. It gives the agent a missing piece of evidence for a holistic legitimacy evaluation next to signals such as reputation or PageRank. EV’s old bargain asked a distracted human to notice a small label and decide better. If AI agents, not humans, become the primary web browsers, the cost and value of publishing verified identity change, and businesses may have a reason to invest in it again.

Four common misconceptions

• “The padlock means the company is real.” It means the connection is encrypted. A fake shop and a genuine one can both display it.
• “A missing company name proves a scam.” The indicator was reduced or buried by design, and the research showed its presence or absence barely moved what people did.
• “Free certificates are weaker certificates.” For the encryption job, a DV certificate from Let’s Encrypt passes the same TLS checks as a paid one. What differs is identity checking, not transport security.
• “A newer badge replaced EV.” Nothing took its place in the interface. QWACs and 2-QWAC restore verified identity as data, handled differently from the old address-bar label.

FAQ

Why did browsers stop showing the green company name?

Two pressures reinforced each other. Studies of user behaviour, cited by Chrome when it moved EV information out of the address bar in Chrome 77, found the indicator had little effect on decisions, and identity collisions such as Kentucky Stripe showed that a correct company name could still mislead. Safari and Firefox reduced visibility in 2018 and 2019 respectively.

Did free certificates cause the identity problem?

Only indirectly. Let’s Encrypt, run by the Internet Security Research Group (ISRG), focused on encryption and said plainly that judging legitimacy belongs to others. Once browsers stopped displaying verified names, the paid tiers that supplied them lost their visible advantage.

What is the practical difference between EV and a QWAC?

Both hold verified identity data. EV depended on browser vendors for presentation, while QWACs sit within the EU’s regulated trust ecosystem, and the 2-QWAC design keeps identity in a separate certificate tied to the site’s TLS certificate, so existing HTTPS setups stay untouched.

When does browser support become mandatory?

Browsers are required to support the EU framework as of January, 2027.

Is this something I need to install or switch on?

No extra tool is implied by this story. The changes sit in browser identity data and in automated checks performed by AI agents; the useful shift for readers is how you interpret what your browser shows.

Action checklist

If you mostly browse and buy

1. Treat the padlock as a statement about the connection, not about the company.
2. For anything involving money or personal data, look for verified identity in the site-information panel or certificate details instead of relying on a brand name on screen.
3. Be wary of near-identical names: the two Stripes incident proved a certificate can be accurate and still point at the wrong business.
4. Once QWAC-based identity data appears in your browser after January, 2027, compare it with the merchant you intended to reach.
5. If you let an AI agent shop for you, make identity verification part of its instructions before it approves a transaction.

If you run a website

1. Solve encryption first: free automated DV certificates removed the cost and maintenance friction that used to block HTTPS.
2. Stop budgeting for a visual trust badge as a conversion tool — the EV era showed visitors barely registered it.
3. Treat identity as a data layer you publish rather than a label you buy: with 2-QWAC, the TLS certificate and the identity certificate stay separate, so your current HTTPS setup survives.
4. Track the January, 2027 browser support requirement as the moment machine-readable identity starts to matter for automated agents and for procurement conversations.

The green badge did not die because encryption failed. It disappeared because one job of the web — scrambling the wire — was solved for everybody while the other job — knowing who is on the counter — quietly left the interface. The 2026 version of the story splits those jobs back apart: free automated certificates for the connection, regulated certificates for the identity, and software patient enough to read both on every visit. Website identity may yet rise from the grave, but only once checking it stops being a chore nobody has time for.