Re: CABForum place in the world

2009-01-02 Thread Daniel Veditz
Kyle Hamilton wrote: (legitimate sites will never ask you to add an exception my ass.) If we shorten the phrase to Legitimate banks and stores will not ask you to do this would you not agree that is true enough as far as the average non-expert user need be concerned? The furor seems to be

Re: CABForum place in the world

2009-01-02 Thread Ian G
On 1/1/09 22:34, Gervase Markham wrote: Ian G wrote: 2. In general, such a group will reject any proposal that appears to favour one member against another; but they will accept any proposal that requires the same amount of additional work, and increases the power of the group. In other

Re: CABForum place in the world

2009-01-02 Thread Ian G
On 2/1/09 09:16, Daniel Veditz wrote: Kyle Hamilton wrote: (legitimate sites will never ask you to add an exception my ass.) If we shorten the phrase to Legitimate banks and stores will not ask you to do this would you not agree that is true enough as far as the average non-expert user

Re: CABForum place in the world

2009-01-02 Thread Kyle Hamilton
Legitimate sites will never ask you for your credit card, national ID number, or any other sensitive information after asking you to add an exception. -Kyle H On Fri, Jan 2, 2009 at 12:16 AM, Daniel Veditz dved...@mozilla.com wrote: Kyle Hamilton wrote: (legitimate sites will never ask you to

Re: PositiveSSL is not valid for browsers

2009-01-02 Thread Kyle Hamilton
A few amusing (lies, damned lies, and) statistics... Small business accounts for slightly more than 50% of the US gross domestic product (source: http://www.smallbusinessnotes.com/aboutsb/rs299.html). There were, in 2005 (latest year for which statistics are available), 6 million small employers

Re: [Fwd: Follow-Up on www.verisign.com SSL Order]

2009-01-02 Thread Johnathan Nightingale
On 28-Dec-08, at 11:43 AM, patri...@certstar.com wrote: I have a good friend who is working 24/7 and sometimes uses my PC whe visiting. It is easy to forget to change username on Google groups, but of course it was my mistake. Sorry about the confusion. Hi Patricia, As you have no doubt

Re: MD5 broken, certs whose signatures use MD5 now vulnerable

2009-01-02 Thread geoff . tolley
On Dec 31 2008, 3:10 pm, Paul Hoffman phoff...@proper.com wrote: I read that blog posting to mean that they were going to keep issuing certs using MD5 signatures, but would use unpredictable sequence numbers like other VeriSign CAs do. Someone can validate that by buying a new cert from

Re: MD5 broken, certs whose signatures use MD5 now vulnerable

2009-01-02 Thread Paul Hoffman
At 11:05 AM -0800 1/2/09, geoff.tol...@gmail.com wrote: On Dec 31 2008, 3:10 pm, Paul Hoffman phoff...@proper.com wrote: I read that blog posting to mean that they were going to keep issuing certs using MD5 signatures, but would use unpredictable sequence numbers like other VeriSign CAs do.

Re: CAs and external entities (resellers, outsourcing)

2009-01-02 Thread Eddy Nigg
On 01/02/2009 06:55 PM, ro...@comodo.com: That thread has a lot going on and I don't propose to try to address it all. However, I will address your reading of our CPS in an attempt to bring some degree of clarity. If I correctly understood your referenced post, you asserted that: 1)

Re: Full Disclosure!

2009-01-02 Thread Eddy Nigg
On 01/03/2009 05:38 AM, Eddy Nigg: Before anybody else does, I prefer from posting it myself :-) http://blog.phishme.com/2009/01/nobody-is-perfect/ http://schmoil.blogspot.com/2009/01/nobody-is-perfect.html For the interested, StartCom is currently checking if I can release our internal

Re: Full Disclosure!

2009-01-02 Thread Ben Bucksch
On 03.01.2009 04:59, Eddy Nigg wrote: The report is available from here: https://blog.startcom.org/?p=161 That's surely interesting, but the report does not contain any details of interest. It only says The attack ... involved proxying ,intercepting all communication from and to the

Re: CABForum place in the world

2009-01-02 Thread Kyle Hamilton
On Fri, Jan 2, 2009 at 6:17 PM, Nelson B Bolyard nel...@bolyard.me wrote: There are some (few) users who have become aware of the advice that they must check that the certificate belongs to the intended party, but they still have no concept of a MITM attack, so they look at the subject name in

Re: Full Disclosure!

2009-01-02 Thread Eddy Nigg
On 01/03/2009 07:31 AM, Ben Bucksch: On 03.01.2009 04:59, Eddy Nigg wrote: The report is available from here: https://blog.startcom.org/?p=161 That's surely interesting, but the report does not contain any details of interest. It only says The attack ... involved proxying ,intercepting all