Re: [TLS] [pkix] Cert Enumeration and Key Assurance With DNSSEC

["Jeffrey A. Williams" <[e-mail]>]

Martin and all,

  Execellent point!


-----Original Message-----
>From: Martin Rex <[e-mail]>
>Sent: Oct 18, 2010 1:28 PM
>To: Bruno Harbulot <[e-mail]>
>Cc: [e-mail]
>Subject: Re: [TLS] [pkix] Cert Enumeration and Key Assurance With DNSSEC
>
>EV vs. DV is primarily about "risk management", based on the
>flawed assumption that "green-bar" vs. blue-bar/white-bar 
>would affect user behaviour.
>
>Look at the real world:
>signin.ebay.<country> uses an EV-Cert, probably because ebay may
>have to pay for damages if someone steals user account credentials
>and abuses them.
>
>payments.ebay.<country> uses a DV-Cert, because the user bears all
>risks from his payment data getting leaked.
>
>
>-Martin
>
>
>
>Bruno Harbulot wrote:
>> 
>> On 04/10/10 21:04, Phillip Hallam-Baker wrote:
>> >
>> > For the past five years, CA certificates have been divided into Domain
>> > Validated and Extended Validated. As some of you know, I instigated the
>> > process that led to the creation of EV certs because I was very worried
>> > about the low quality of many DV certificates.
>> >
>> > Some DV certificates are of very low quality. Which is why I would like
>> > to see the padlock icon phased out entirely. Why does the user need to
>> > know if encryption is being used at all?
>> 
>> I'm still not convinced about the greatness of EV certificates.
>> 
>> Why should an organization that wants to deploy its own PKI have to 
>> depend on one of the big players who've managed to get their signature 
>> hard-coded into browsers?
>> 
>> How beneficial are EV certs for the end-users? Green-bar secure v.s. 
>> Blue-bar insecure (or less secure) really is a confusing 
>> over-simplification.
>> 
>> A DV certs bind a cert to a domain, whereas an EV cert bind a cert to a 
>> company name. However, some companies use domain names that have nothing 
>> to do with their company name, and which could look like competitors 
>> instead: http://www.ietf.org/mail-archive/web/tls/current/msg06528.html
>_______________________________________________
>TLS mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/tls

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [e-mail]
Phone: [phone]