Subject: Re: The new High Assurance SSL Certificates

From: Paul Hoffman <[email-masked]>
Date: Sat, 14 Jan 2006 13:46:34 -0800

At 12:05 PM -0800 1/14/06, Mark wrote:
>Applications need to have mechanisms embedded into them to 
>distinguish between high assurance and other certificates.

Applications only need that if there is a difference that is 
noticeable to the user.

Question: what is the difference between VeriSign high assurance and 
VeriSign low assurance certificates? If a developer can't answer the 
question, then the app doesn't need to differentiate.

--Paul Hoffman, Director
--VPN Consortium

---

From: "todd glassey" <[email-masked]>
Date: Sat, 14 Jan 2006 14:58:48 -0800

Paul, if I may, one of the problems that this group is running into is
whether there is a mechanical process that High-Reliability requires or
whether the issuance and maintenance models are sufficient with these new
'reliance models' to support the proposed use models, and personally its all
about how they are used that should force the stratification between
high-reliance and low-dollar value transactions...

Todd Glassey

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Sat, 14 Jan 2006 16:37:04 -0500

I apologize, as I am joining this thread a little late.... and I haven't
had time to read every single message.

That said, I believe the issue of a High Assurance CA (HCA) isn't
ensuring that private keys are properly protected (not that it isn't
important), but ensuring that when consumers go to a site signed by a
High Assurance CA, that they know they can trust it to properly handle
their personal information. This is a much broader problem.

To me this means that when AOL.COM goes to a HCA to obtain a certificate
they get it. But when AO1.COM attempts to apply for one they are denied.

The trick is how do you do this. If I start a company named ?AO1
Vacuums? and have the legal right to use ?AO1? in my name, how can
another company (or oligarchy) deny me the right to have my customers
trust my website? Perhaps what is needed is legal language that let's
AO1.COM obtain a certificate provided they agree to not intentionally
attempt to confuse people into believing that they are AOL.COM. I'll
leave it to the lawyers to figure out the language that accomplishes
this goal.

So now the real problem is revocation. If AO1.COM obtains a HCA
certificate and turns out to be a bad actor, there needs to be an
effective way of revoking their certificate. We don't have a deployed
mechanism today. Perhaps this is what we need from a technical perspective.

			-Jeff

- --
=============================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue  Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email-masked]
============================================================================

---

From: Mark <[email-masked]>
Date: Sat, 14 Jan 2006 12:05:38 -0800

I agree with your two points.  Applications need to have mechanisms 
embedded into them to distinguish between high assurance and other 
certificates.  One of the standards I'm currently working on that may 
help is looking at using XML to classify documents.  I know that it 
does not directly relate to high assurance SSL server certificates and 
I will get to that point later.  There must be a way to distinguish how 
information and assets are differentiated by applications.  One of the 
ways is to enable a policy based management of information and 
certificates.  Using information classification you can set up policies 
to manage how that information is treated when it is sent or received.  
It still depends very much on the applications being able to 
differentiate the information.  However in looking at standards and how 
we could use PKI to provide a layer of security to further protect 
sensitive information and transactions we need some standards around 
how information is classified to improve interoperability.

On the second point it boils down to an organization issuing the high 
assurance certificates.  Somehow there needs to be a way to authorize 
and authenticate the certificate using existing methods.  We already 
deal with SSL certificates and can check revocation.  If several 
organizations are authorized and accredited to issue high assurance 
certificates, then applications can check CRLs or whatever the 
organization uses to validate high assurance certificates.  Now what 
organization should authorize and accredit organizations issuing high 
assurance certificates?  It should be not be government.

Sorry for getting a bit off-topic on the XML and information 
classification but I believe that there are a number of pieces to this 
issue and it gets down to business automation and there is a connection 
between using XML and PKI to enable policy based management of 
transactions and information.  I'd like to hear from others if I'm off 
base or this resonates with people.

Cheers

On 14-Jan-06, at 3:16 AM, Anders Rundgren wrote:

>
> Apparently a number of commercial issuers of certificates are
> currently considering creating a new class of "High Assurance"
> (HA) SSL server-certificates, in order to improve the somewhat
> bad reputation associated with the current scheme.
>
> In a recent Mozilla blob, it was suggested that Firefox in order to
> recognize that it is really dealing with a high assurance certificate
> (and presumably showing that to the user in some way), should rely on
> a specific set of agreed-upon RFC 3280 policy identifiers.  This is
> in my opinion not a particularly good idea for two reasons:
>
> 1.  SSL server-certificates are extensively used for other 
> applications, both
> in server-mode and in client-mode (as signature certificates).  Few if
> any of these applications, are currently "trained" to rely on anything
> but root anchors.   If you roll your own certs which is quite common
> in local installations, current instructions on how to use SSL such as
> featured in IIS, OpenSSL, Tomcat, JDK etc. never go into policy
> identifiers.
>
> 2. I may be wrong here, but is there actually anything that prevents a 
> low-
> assurance certificate issuer to include high assurance policy 
> identifiers?
>
> That is, the new HA certificates should preferably support the 
> following
> policy scheme:
>
>        CA_root => Implicit Policy + Explicit Policy
>
> ======================================================================
> Commercial issuers should seriously consider the liability issues
> associated with having a single root for different kinds of
> certificates.  It can in such a scheme hardly be the relying party
> who is responsible for unintentionally accepting "wrong" certificates.
> ======================================================================
>
> Note that this should not be interpreted as that there should not be
> any HA policy identifiers, it is just the idea to FORCE their usage
> on applications that I believe would in fact only complicate rollout.
>
> Comments?
>
> Anders Rundgren
>
> Disclaimer: The views expressed in this message are solely the
> author's and should not be attributed to his employer or their clients
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 14 Jan 2006 12:16:50 +0100

1.  SSL server-certificates are extensively used for other applications, both

2. I may be wrong here, but is there actually anything that prevents a low-
assurance certificate issuer to include high assurance policy identifiers?

That is, the new HA certificates should preferably support the following
policy scheme:

Comments?

Anders Rundgren

---

From: "Joel S. Kazin" <[email-masked]>
Date: Mon, 16 Jan 2006 09:13:18 -0500

As discussed at the October 2005 ABA ISC meeting, a HCA does not address 
the handling of a consumer's personal information.

----System Information
Platform: Windows 2000
Machine Type: Intel
System Version: 5.00.2195
Processor: Pentium II or III Model 8, Stepping 6
Physical RAM Installed: 261532 Kb
Eudora: Version 5.1
Mode: Sponsored Mode
Registration #:
MSHTML Version: 6.00
WININET Version: 6.00

At 04:37 PM 1/14/2006 -0500, Jeffrey I. Schiller wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.1 (GNU/Linux)
>Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
>iD8DBQFDyW7+8CBzV/QUlSsRAkqYAKDWtkD0OQ6UDGCKGUz3buS6z2OdfgCg5W0H
>Dhey/w4/bCR1dvDqjduKpzo=
>=mED5
>-----END PGP SIGNATURE-----

Joel S. Kazin CPA, CISA, CISSP, CISM
Senior Consultant
Atos Origin
40 Old Sleepy Hollow Road
Pleasantville, New York 10570-3802
USA
Phone  +1 914-769-8780
Mobile  +1 914-564-1484
email    [email-masked]
www.atosorigin.com
[Settings]
NC=1
Code=NC
NeverRegister=1
DontShowUpdates=1
DontShowAudit=1
WarnLaunchExtentions=exe|com|bat|cmd|pif|htm|do|xl|reg|lnk|vbs|
TabooHeaders=Received,Status,X-,In-Reply,Mime-Version,Content-,Resent-Message,References,Return,X400,X,Mail-System,Errors-To,Delivery,Disposition,Precedence
Mode=0
UserSignatures=1
SeenIntro=1
POPAccount=[email-masked]
RealName=Joel S. Kazin
SMTPServer=usarx006.namerica.na.int.atosorigin.com
ReturnAddress=[email-masked]
ACAPServer=
ACAPUserID=
PopServer=usarx006.namerica.na.int.atosorigin.com
LoginName=JKazin
LastOptionsCategory=0
AutoReceiveAttachmentsDirectory=D:\Documents\Mail\Attach
MailboxPreviewPane=1
MailboxSuperclose=1
WarnMapiAutoSend=1
NetworkCaching=0
EmptyTrashOnQuit=1
Commercial32Version=16
AdToolbarFloat=0
AdToolbarDock=2
MainWindowState=3
NGBase1=972453254
NGLast1=972453254
NGBase2=972453254
NGLast2=972453254
NGBase3=972453254
NGLast3=972453254
NGBase4=972453254
NGLast4=972453254
NGBase5=972453254
NGLast5=972453254
UseBidentAlways=1
LastWindowMax=0
Signature=Joel S. Kazin
MAPIUseNever=1
MAPIUseEudora=0
AutoExpandNicknames=1
DomainQualifier=
ImapDirectoryPrefix=
Stationery=
LeaveOnServerDays=0
BigMessageThreshold=40960
IMAPMaxDownloadSize=0
TrashMailboxName=Trash
CheckMailByDefault=1
LeaveMailOnServer=0
AuthenticateKerberos=0
AuthenticateAPOP=0
UseWinSock=1
AuthenticateRPA=0
UsesIMAP=0
UsesPOP=1
AuthenticatePassword=1
DeleteMailFromServer=0
ServerDelete=0
SkipBigMessages=0
IMAPMinDownload=1
IMAPOmitAttachments=0
TransferToTrashOnDelete=0
MarkAsDeleted=1
SmtpAuthAllowed=1
SuccessfulSend=1
CurrentTipOfTheDay=31
CheckForMailEvery=10
DontCheckUnconnected=1
TaskStatusStateWidth=120
TaskStatusStatusWidth=182
TaskStatusProgressWidth=133
NicknameLastActivePropertyPage=0
NicknameViewByIndex=6
FindMsgsCriteria1=Anywhere;contains;bank
FindMsgsCriteria2=Anywhere;contains;
FindMsgsCriteria3=Anywhere;contains;
FindMsgsCriteria4=Anywhere;contains;
FindMsgsCriteria5=Anywhere;contains;
FileBrowserNameWidth=100
FileBrowserTypeWidth=80
FileBrowserSizeWidth=45
FileBrowserModifiedWidth=120
PersonaViewNameWidth=90
PersonaViewAccountWidth=200
SearchResultsDateWidth=167
SearchResultsSubjectWidth=357
FindMsgsCriteriaCount=1
WarnDefaultMailto=0
RegistrationFlag=-1
CompactMailbox=10
CompactDisk=10
WarnExternalLaunchAttach=0
RegFirstNamePro=
RegLastNamePro=SiteLicense
RegCodePro=
SeenPlugins=x515x
SSLReceiveUse=0
SSLSendUse=0
LastTextColor=12
CompleterListHeight=41
ShowTipOfTheDay=0
AutoOK=1
Alert=0
WarnQueueStyledText=0
TaskMgrWaitTime=0
TaskStatusShowColDetails=1
TaskStatusDetailsWidth=320
NetworkBufferSize=409600
OfflineLinkAction=1
FetchInlineCOntent=0
RunHtmlCode=1
EasyOpen=1
LinkHistoryNameWidth=100
LinkHistoryDateVisitedWidth=140
LinkHistoryTypeWidth=50
ShowMailboxLines=1
MessageWidth=133
Profile=d0320018b4349321bc6558d4c0854c6c
WarnDeleteUnread=0

[Mappings]
out=txt,ttxt,TEXT,text,plain
both=doc,MSWD,,application,msword
out=mcw,MSWD,WDBN,application,msword
in=xls,XCEL,,,
out=xls,XCEL,XLS4,,
both=xlc,XCEL,XLC3,,
both=xlm,XCEL,XLM3,,
both=xlw,XCEL,XLW,,
both=ppt,PPT3,SLD3,,
both=wav,SCPL,WAVE,audio,microsoft-wave
both=grp,,,application,microsoft-group
both=wri,,,application,microsoft-write
both=cal,,,application,microsoft-calendar
both=zip,pZIP,pZIP,application,zip
both=rtf,MSWD,TEXT,application,rtf
both=pdf,,,application,pdf
both=ps,,,application,postscript
in=eps,,EPSF,,
out=eps,dPro,EPSF,application,postscript
both=jpg,JVWR,JPEG,image,jpeg
out=jpeg,JVWR,JPEG,image,jpeg
both=jfif,JFIF,JPEG,image,jpeg
both=gif,JVWR,GIFf,image,gif
both=tif,JVWR,TIFF,image,tiff
both=mpg,mMPG,MPEG,video,mpeg
both=mpeg,mMPG,MPEG,video,mpeg
both=mov,TVOD,MooV,video,quicktime
both=qt,TVOD,MooV,video,quicktime
both=png,,PNGf,image,png
both=htm,,,text,html
out=html,,,text,html
out=1st,ttxt,TEXT,text,plain
both=aif,SCPL,AIFF,,
both=arc,arc*,mArc,,
both=arj,DArj,BINA,,
out=asc,ttxt,TEXT,text,plain
out=asm,ttxt,TEXT,text,plain
both=au,SCPL,ULAW,,
out=bas,ttxt,TEXT,text,plain
out=bat,ttxt,TEXT,text,plain
out=bga,JVWR,BMPp,,
both=bmp,JVWR,BMPp,,
out=c,ttxt,TEXT,text,plain
both=cgm,GKON,CGMm,,
out=cmd,ttxt,TEXT,text,plain
out=com,mdos,BINA,,
out=cp,ttxt,TEXT,text,plain
out=cpp,ttxt,TEXT,text,plain
both=cpt,CPCT,PACT,,
out=csv,XCEL,TEXT,,
both=cvs,DAD2,drw2,,
out=dif,XCEL,TEXT,,
both=dl,GKON,DLdI,,
both=dvi,OTEX,ODVI,,
out=exe,mdos,BINA,,
out=faq,ttxt,TEXT,text,plain
out=flc,GKON,FLI,,
both=fli,GKON,FLI,,
both=fm,FMPR,FMPR,,
out=for,ttxt,TEXT,text,plain
both=gl,AnVw,,,
both=gz,Gzip,Gzip,,
out=h,ttxt,TEXT,text,plain
both=hqx,BnHq,TEXT,application,mac-binhex40
both=ico,GKON,ICO,,
both=iff,GKON,ILBM,,
both=ima,dCpy,dImg,,
both=img,GKON,IMGg,,
out=ini,ttxt,TEXT,text,plain
both=lbm,GKON,ILBM,,
both=lha,LARC,LHA,,
both=lzh,LARC,LHA,,
out=m3,ttxt,TEXT,text,plain
both=mac,dPro,PICT,,
out=mak,ttxt,TEXT,text,plain
out=me,ttxt,TEXT,text,plain
both=mod,SCPL,STrk,,
both=msp,GKON,MSPp,,
out=out,ttxt,TEXT,text,plain
out=p,ttxt,TEXT,text,plain
both=PAC,GKON,STAD,,
out=pas,ttxt,TEXT,text,plain
both=pbm,GKON,PPGM,,
both=pcs,GKON,PICS,,
both=pct,ttxt,PICT,,
both=pcx,GKON,PCXx,,
both=pgm,GKON,PPGM,,
both=pic,ttxt,PICT,,
both=pit,UPIT,PIT,,
both=plt,GKON,HPGL,,
both=pm,GKON,PMpm,,
both=pm3,ALD3,ALB3,,
both=pm4,ALD4,ALB4,,
both=pm5,ALD5,ALB5,,
both=pntg,SPNT,PNTG,,
both=ppm,GKON,PPGM,,
out=prn,ttxt,TEXT,text,plain
both=psd,8BIM,8BPS,,
both=qxd,XPRS,XDOC,,
both=rif,GKON,RIFF,,
both=rle,GKON,RLE,,
both=shp,GKON,SHPp,,
both=sit,SITx,SIT!,,
both=sit,SITx,SITD,,
both=slk,XCEL,TEXT,,
both=spc,GKON,Spec,,
both=sr,GKON,SUNn,,
both=sun,GKON,SUNn,,
both=sup,GKON,SCRN,,
both=svx,SCPL,8SVX,,
both=tar,TAR,TARF,,
both=tex,OTEX,TEXT,,
both=tga,8BIM,TPIC,,
both=tga,GKON,TARG,,
out=tx8,ttxt,TEXT,text,plain
out=vga,JVWR,BMPp,,
both=wks,L123,WKS,,
both=wmf,GKON,WMF,,
both=wp,WPC2,.WP5,application,wordperfect5.1
both=wp5,WPC2,.WP5,application,wordperfect5.1
both=z,LZIV,ZIVU,,
both=zoo,Booz,Zoo,,
both=qcp,Blad,celp,audio,vnd.qcelp

[]
CompactMailbox%25=10
CompactDisk%25=10

[Labels]
LabelCount=7
Label1=255,128,0,Label 1
Label2=255,0,0,Label 2
Label3=255,0,255,Label 3
Label4=0,128,255,Label 4
Label5=0,0,255,Label 5
Label6=0,128,0,Label 6
Label7=128,64,64,Label 7

[ToolBar-Bar0]
BarID=59393
Style=32768
ExStyle=0
PrevFloating=0
MDIChild=0
PctWidth=1000000
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0

[ToolBar-Bar1]
BarID=318
Visible=0
XPos=0
YPos=0
MRUWidth=192
Docking=1
MRUDockID=59422
MRUDockLeftPos=1
MRUDockTopPos=5
MRUDockRightPos=1025
MRUDockBottomPos=608
MRUFloatStyle=8192
MRUFloatXPos=318
MRUFloatYPos=314
Style=8069
ExStyle=3889
PrevFloating=0
MDIChild=0
PctWidth=1000000
MRUFloatCX=192
MRUFloatCY=591
MRUHorzDockCX=1024
MRUHorzDockCY=603
MRUVertDockCX=228
MRUVertDockCY=643
MRUDockingState=61440
DockingStyle=61440
TypeID=0

[ToolBar-Bar10]
BarID=59423
Horz=0
Floating=1
XPos=4
YPos=64
Bars=3
Style=0
ExStyle=0
PrevFloating=0
MDIChild=1
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=319
Bar#2=0

[ToolBar-Bar2]
BarID=319
Visible=0
XPos=237
YPos=0
MRUWidth=722
Docking=1
MRUDockID=0
MRUDockLeftPos=5
MRUDockTopPos=-2
MRUDockRightPos=185
MRUDockBottomPos=500
MRUFloatStyle=4
MRUFloatXPos=312
MRUFloatYPos=312
Style=8069
ExStyle=3889
PrevFloating=0
MDIChild=0
PctWidth=1000000
MRUFloatCX=722
MRUFloatCY=475
MRUHorzDockCX=300
MRUHorzDockCY=180
MRUVertDockCX=180
MRUVertDockCY=502
MRUDockingState=0
DockingStyle=61440
TypeID=0

[ToolBar-Bar3]
BarID=320
Visible=0
XPos=-2
YPos=-2
MRUWidth=821
Docking=1
MRUDockID=59422
MRUDockLeftPos=1
MRUDockTopPos=5
MRUDockRightPos=1025
MRUDockBottomPos=105
MRUFloatStyle=8192
MRUFloatXPos=107
MRUFloatYPos=234
Style=12165
ExStyle=3889
PrevFloating=0
MDIChild=0
PctWidth=1000000
MRUFloatCX=821
MRUFloatCY=177
MRUHorzDockCX=1024
MRUHorzDockCY=100
MRUVertDockCX=180
MRUVertDockCY=180
MRUDockingState=61440
DockingStyle=0
TypeID=0

[ToolBar-Bar4]
BarID=316
XPos=-2
YPos=-2
Docking=1
MRUDockID=59422
MRUDockLeftPos=752
MRUDockTopPos=-11
MRUDockRightPos=1776
MRUDockBottomPos=164
MRUFloatStyle=8192
MRUFloatXPos=819
MRUFloatYPos=506
Style=12163
ExStyle=769
PrevFloating=0
MDIChild=0
PctWidth=1000000
MRUFloatCX=300
MRUFloatCY=180
MRUHorzDockCX=165
MRUHorzDockCY=156
MRUVertDockCX=165
MRUVertDockCY=643
MRUDockingState=61440
DockingStyle=0
TypeID=0

[ToolBar-Bar5]
BarID=59419
Bars=6
Style=0
ExStyle=0
PrevFloating=0
MDIChild=0
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=59392
Bar#2=59424
Bar#3=0
Bar#4=65854
Bar#5=0

[ToolBar-Bar6]
BarID=59422
Bars=7
Style=0
ExStyle=0
PrevFloating=0
MDIChild=0
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=65854
Bar#2=0
Bar#3=65856
Bar#4=0
Bar#5=65852
Bar#6=0

[ToolBar-Bar7]
BarID=59420
Bars=5
Style=0
ExStyle=0
PrevFloating=0
MDIChild=0
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=65852
Bar#2=0
Bar#3=65854
Bar#4=0

[ToolBar-Bar8]
BarID=59421
Bars=5
Style=0
ExStyle=0
PrevFloating=0
MDIChild=0
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=65852
Bar#2=0
Bar#3=65855
Bar#4=0

[ToolBar-Bar9]
BarID=59392
MRUWidth=734
Docking=1
MRUDockID=59419
MRUDockLeftPos=-1
MRUDockTopPos=-1
MRUDockRightPos=733
MRUDockBottomPos=42
MRUFloatStyle=8196
MRUFloatXPos=-2147483648
MRUFloatYPos=0
Style=12212
ExStyle=780
PrevFloating=0
MDIChild=0
PctWidth=500000
MRUFloatCX=734
MRUFloatCY=43
MRUHorzDockCX=734
MRUHorzDockCY=43
MRUVertDockCX=43
MRUVertDockCY=693
MRUDockingState=0
DockingStyle=61440
TypeID=14946
Title=Toolbar
Buttons=FCAIAAAAAAAAAAAAAAAAIBAIAAAAAAJBAIAAAAAAAAAAAAAAAAEAAIAAAAAAAAAAAAAAAANBAIAAAAAAHFAIAAAAAAIFAIAAAAAAPBAIAAAAAAAAAAAAAAAAFOAIAAAAAAGOAIAAAAAAAAAAAAAAAAECAIAAAAAAAAAAAAAAAAKAAIAAAAAAAAAAAAAAAAMDAIAAAAAAAAAAAAAAAAHABOAAAAAAAAAAAAAAAAFEBOAAAAAAAAAAAAAAAA

[ToolBar-BarID59392]
btn0=32805
btn1=0
btn2=32792
btn3=32793
btn4=0
btn5=32772
btn6=0
btn7=32797
btn8=32855
btn9=32856
btn10=32799
btn11=0
btn12=32997
btn13=32998
btn14=0
btn15=32804
btn16=0
btn17=32778
btn18=0
btn19=32828
btn20=0
btn21=57607
btn22=0
btn23=57669
btn24=0
CustomButtonCount=0

[ToolBar-Summary]
Bars=14
ScreenCX=1024
ScreenCY=768

[ToolBar-ToolBarManager]
ToolTips=1
CoolLook=1
LargeButtons=1

[Window Position]
AdToolbarWindowPosition=927,39,1024,82
MainWindowPosition=306,77,551,717
NicknamesWindowSplitterPosition=247
FindMsgsWindowPosition=22,22,686,374
StatisticsWindowPosition=0,0,670,528
ProgressWindowPosition=252,526,702,631
FiltersWindowSplitterPosition=252
TextFileWindowPosition=0,0,600,27
CheckSpellingWindowPosition=60,84,467,257

[DirectoryServices]
OldKeepOnTopConverted=1
TopPaneY=134
BottomPaneY=187
PanesX=281
LeftPaneX=254
RightPaneX=423
PanesY=420
KeepOnTop=0
Finger:Qualcomm Finger Server=0
LDAP:Big Foot=0
LDAP:Switch Board=0
LDAP:Four11=0
LDAP:InfoSpace=0
LDAP:InfoSpace Business=0
LDAP:Atos LDAP replica - Summary=1
LDAP:SLB LDAP all attributes=1
LDAP:SLB LDAP Europe summary=1
LDAP:SLB LDAP Europe all attributes=1
LDAP:Who Where=0
Ph:SLB Ph interface to LDAP=0
Ph:SLB Ph server=0
Ph:BigFoot=0
Ph:Qualcomm=0
Eudora Address Book:Eudora Nicknames=0

[ToolBar-Bar11]
BarID=59423
Horz=1
Floating=1
XPos=111
YPos=254
Bars=3
Style=0
ExStyle=0
PrevFloating=0
MDIChild=0
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=320
Bar#2=0

[ToolBar-Bar12]
BarID=59423
Horz=0
Floating=1
XPos=10
YPos=66
Bars=3
Style=0
ExStyle=0
PrevFloating=0
MDIChild=1
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=318
Bar#2=0

[ToolBar-Bar13]
BarID=59423
Horz=1
Floating=1
XPos=823
YPos=526
Bars=3
Style=0
ExStyle=0
PrevFloating=0
MDIChild=0
PctWidth=0
MRUFloatCX=0
MRUFloatCY=0
MRUHorzDockCX=0
MRUHorzDockCY=0
MRUVertDockCX=0
MRUVertDockCY=0
MRUDockingState=0
DockingStyle=0
TypeID=0
Bar#0=0
Bar#1=316
Bar#2=0
[Open Windows]
OpenWindow1=2,1,Out.mbx,Out
OpenWindow2=2,3,In.mbx,In
[WazooBars]
WazooBarIds=318,319,320
WazooBar318=16,CMboxWazooWnd,CFileBrowseWazooWnd,CSignatureWazooWnd,CStationeryWazooWnd,CPersonalityWazooWnd
WazooMDI318=6,2,118,29,1,0
WazooBar319=16,CNicknamesWazooWnd,DirectoryServicesWazooWndNew,CFiltersWazooWnd,CFilterReportWazooWnd,CLinkHistoryWazooWnd
WazooMDI319=0,0,112,27,1,0
WazooBar320=64,CTaskStatusWazooWnd,CTaskErrorWazooWnd
[Recent File List]
File1=C:\Program Files\Qualcomm\Eudora\A
File2=D:\Documents\Pfizer\A
File3=D:\Documents\My Pictures\2004-11-12\A
File4=D:\Documents\ChevronTexaco\A

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Mon, 16 Jan 2006 14:26:20 -0500

> the handling of a consumer's personal information.

Well, I wasn't at the meeting, so I cannot comment about what went on. I
can understand why it won't address how an organization handles personal
information. But it *should* address how a consumer can *know* they are
giving their information to whom they believe they giving their
information. Thus my example about differentiating AOL.COM from AO1.COM.

Bottom line: If this doesn't improve consumer confidence, then it is a
worthless exercise. My take on it is that private key protection is not
the problem we have. Phishing is what it is about and phishing doesn't
require stealing the private key of the legitimate site. It requires
fooling the consumer into thinking they are at the legitimate site when
in fact they are not. The goal should be to address (or solve) this
problem. I original message was to point out that this is more about
policy of certificate issuance then private key protection and that the
key piece of technology we need is really working revocation, something
we do not have today (at least in deployed technologies).

			-Jeff

P.S. What was the junk on the end of your message, looks like the dump
of some random Window's settings file!

- --