Advantages with code-signing EV certificates other than the Smartscreen ones?

Question

I have to buy a code-signing certificate, for signing Win32 applications, and I was considering whether to pick an EV one.

The advantages of EV certificates I was able to find are:

1. Immediate Smartscreen reputation establisment (instead of waiting for 3k downloads? [source] )

2. Maintainance of Smartscreen reputation across certificate renewals [source] (probably a moot point if point 1 applies anyway)

3. Option for delivery on a hardware token, often not available for normal certificates

I wonder if they bring other advantages, for example if applications signed with them are more trusted than applications signed with non-EV certificates by antivirus, firewalls and other security applications (they get less blocked, provoke more favourable warnings, etc.).

I restate the case I'm most interested in: are you aware of differences in treatment by some specific antivirus/firewall/security application of applications signed with EV certificates, vs. applications signed with standard certificates?

Answer 1

Disclosure: I work for an AV vendor.

I wonder if they bring other advantages, for example if applications signed with them are more trusted than applications signed with non-EV certificates by antivirus, firewalls and other security applications

This depends on the vendor making the security application, or their current(*) policy. Both security vendors I have worked for ignored the presence of the certificate when scanning for malware. There are several reasons for this:

• Just because the code is signed doesn't mean it is not malicious. It only means it has not been modified after it has been signed. For example, a relatively large number of adware applications is signed.

• Malware writes have used stolen certificates in past, and thus we cannot be truly sure it was used by the original author. This is why I mentioned "current policy" above, as this could change overnight.

• Verifying a certificate is a complex and relatively slow process which requires reading the whole file from disk - an expensive operation for a non-SSD storage. It also requires performing some public key cryptography operations which are CPU-intensive. Thus for some large executable files checking the certificate might take longer than scanning the file for malware.

And since we generally don't look at certificate at all, it doesn't matter whether it is standard or EV.