Subject: Re: The new High Assurance SSL Certificates

From: "Aisenberg, Michael" <[email-masked]>
Date: Tue, 17 Jan 2006 07:59:27 -0500

Jeff
I believe you have described one of the core issues motivating browser publishers--combatting spam and other consumer abuses not presently remedied by some flavors of organizational SSL certs that require only minimum vetting of identity/legitimacy attributes of corporate/business subscribers.  The point is to deny the "AOL1" cert to anyone other than AOL to the extent this can be contributed to by a stronger Organization SSL cert.  It won't eliminate fraudsters getting organization certs, but it cuts it down.  Those of us in the CA community who already require more than an organization name and email address have already set a higher bar in practice.  The browsers are now proposing to serve consumers by differentiating.

 -----Original Message-----
From: 	Jeffrey I. Schiller [mailto:[email-masked]]
Sent:	Mon Jan 16 15:33:53 2006
To:	Joel S. Kazin
Cc:	Anders Rundgren; [email-masked]
Subject:	Re: The new High Assurance SSL Certificates

Joel S. Kazin wrote:
> As discussed at the October 2005 ABA ISC meeting, a HCA does not address
> the handling of a consumer's personal information.

Well, I wasn't at the meeting, so I cannot comment about what went on. I
can understand why it won't address how an organization handles personal
information. But it *should* address how a consumer can *know* they are
giving their information to whom they believe they giving their
information. Thus my example about differentiating AOL.COM from AO1.COM.

Bottom line: If this doesn't improve consumer confidence, then it is a
worthless exercise. My take on it is that private key protection is not
the problem we have. Phishing is what it is about and phishing doesn't
require stealing the private key of the legitimate site. It requires
fooling the consumer into thinking they are at the legitimate site when
in fact they are not. The goal should be to address (or solve) this
problem. I original message was to point out that this is more about
policy of certificate issuance then private key protection and that the
key piece of technology we need is really working revocation, something
we do not have today (at least in deployed technologies).

			-Jeff

P.S. What was the junk on the end of your message, looks like the dump
of some random Window's settings file!

- --
=============================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue  Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email-masked]
============================================================================

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Fri, 20 Jan 2006 00:14:42 -0500

So If I were to incorporate AO1 Computers as my legitimate business name
and obtain the domain name AO1.COM (this is hypothetical, I'm sure its
not available :-) ), A High Assurance CA would deny me a certificate
because it looks too much like an AOL certificate?

Is that really right?

How do you decide which domains are "famous" enough to deserve this
protection? What constitutes a domain name that looks too much like a
famous domain?

On the other hand. If I obtain a high assurance certificate and then use
it to confuse consumers into believing my site is AOL (it looks like
AOL's, it abuses their trademarked logos etc.) I am clearly acting in
bad faith. If a High Assurance CA had previously issued me a
certificate, it would be justified in revoking it. This is why I believe
revocation is a critical technology to making progress.

It is easier to detect bad actors (and deal with them) then assume
someone *might* be a bad actor ahead of time and deny them access to
commerce by denying them a high assurance certificate up front.

			-Jeff
- --

---

From: "Marc Poulaud" <[email-masked]>
Date: Fri, 20 Jan 2006 10:29:58 -0000

My 2 euro cents...

Depends on what the perceived role of the HACA is and what expectation users
might have. Let's face it, users will probably ignore any
guidance/disclaimers/warnings/T&Cs.

In the UK, if you try to incorporate a company with a similar name to
another, your application will be turned down citing the similarity to avoid
a AO1 type of problem.

IMHO, unless there was this type of control by the HACA, acceptance by users
and technology to enforce this on the user PC, it would seem unlikely to get
any real traction.

Marc.
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Jeffrey I. Schiller
Sent: 20 January 2006 05:15
To: Aisenberg, Michael
Cc: Joel S. Kazin; Anders Rundgren; [email-masked]
Subject: Re: The new High Assurance SSL Certificates

Is that really right?

			-Jeff
- --
=