Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-26 Thread Gervase Markham
Julien Pierre wrote: Actually having separate builds for localized versions is a can of worms in itself. Are the localized builds built from separate branches ? I was under the impression that they simply had additional language modules. The usual practice, I believe, is to swap out the

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-26 Thread Ian Grigg
Frank Hecker has mentioned in his draft of a metapolicy that a threat model should be used. AFAIK, there is only a fairly poor attempt at a threat model for browser security, a great lack in the original design. Here is my attempt at a threat model:

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-25 Thread Julien Pierre
Gervase, Gervase Markham wrote: Frank Hecker wrote: There's still the trademark issue, but I don't see why this couldn't be handled consistently with other localization-specific changes. For example, if the Mozilla Foundation allows the creators of the France-localized version to include,

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-23 Thread Frank Hecker
Ian Grigg wrote: This points out the difficulty of correctly analysing the threat model that is appropriate. Consider American credit card holders, versus non-Americans holding credit cards, as discussed recently here. snip Which risk is a security modeller to pick? It's very tricky. I have no

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-19 Thread Jean-Marc Desperrier
Julien Pierre wrote: [...] My experience is that's more protection than is afforded to credit cards in France. In particular, the quality of goods provision means that most US merchants have flexible return policies. I have tried returning stuff I bought that I was unhappy with in France (with

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-19 Thread Julien Pierre
Hi, Jean-Marc Desperrier wrote: Julien Pierre wrote: [...] My experience is that's more protection than is afforded to credit cards in France. In particular, the quality of goods provision means that most US merchants have flexible return policies. I have tried returning stuff I bought that

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-18 Thread Jean-Marc Desperrier
Ian Grigg wrote: [...] Outside USA, most countries have laws on the books that put the banks in charge of fraudulent credit card transactions. Not so in America, it seems. I didn't say exactly that. I reported I heard the level of protection is lower in America, but I don't have the exact

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-18 Thread Ian Grigg
Jean-Marc Desperrier wrote: Ian Grigg wrote: [...] Outside USA, most countries have laws on the books that put the banks in charge of fraudulent credit card transactions. Not so in America, it seems. I didn't say exactly that. I reported I heard the level of protection is lower in America,

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-18 Thread Julien Pierre
Ian Grigg wrote: Jean-Marc Desperrier wrote: I didn't say exactly that. I reported I heard the level of protection is lower in America, but I don't have the exact description of the difference, I might even be proven wrong. Or it might be different depending on the state. I also was

Re: Proposed CA certificate metapolicy - 7. threat models

2004-02-17 Thread Ian Grigg
7. Risks to typical Mozilla users should be assessed in accordance with a documented threat model based on the activities in which those users might tpically engage, e.g., online shopping and banking, using other access-controlled web sites and services, submitting personal information to