Subject: AW: The new High Assurance SSL Certificates

From: [email-masked]
Date: Wed, 18 Jan 2006 11:51:45 +0100

Well,... okay, this seems clear... but... does my seriousity depend on the
amount of money?

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] 
> [mailto:[email-masked]] Im Auftrag von Beckmann, Thomas
> Gesendet: Mittwoch, 18. Januar 2006 11:42
> An: [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]
> Betreff: AW: The new High Assurance SSL Certificates
> 
> 
> Ooops... the level of assurance depends on the amount of 
> money I am willing to pay for?
> 
> Best regards
> 
> Thomas  
> 
> > -----Ursprüngliche Nachricht-----
> > Von: [email-masked]
> > [mailto:[email-masked]] Im Auftrag von 
> > [email-masked]
> > Gesendet: Mittwoch, 18. Januar 2006 10:23
> > An: [email-masked]; [email-masked]; 
> [email-masked]
> > Betreff: Re: The new High Assurance SSL Certificates
> > 
> > 
> > Paul Hoffman <[email-masked]> writes:
> > 
> > >What is the difference between VeriSign high assurance and
> > VeriSign low
> > >assurance certificates? If a developer can't answer the
> > question, then
> > >the app doesn't need to differentiate.
> > 
> > With the HA certs you have a high level of assurance that the cert 
> > owner paid more for them, thus indicating that they were 
> more serious 
> > about obtaining a cert than a LA cert owner.
> > 
> > Peter.
> > 
> > 
> 
>

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 19 Jan 2006 15:53:48 +1300

[email-masked] writes:

>Ooops... the level of assurance depends on the amount of money I am willing
>to pay for?

Sure.  You know that someone who pays $495 for a cert is more serious about it
than someone who pays $9.95, in the same way that someone who buys a $1995
stereo is more serious than someone who buys a $199 one.

(Well, either that or they don't know that you can get $9.95 certs that behave
 identically to $495 certs.  I got private mail from someone else saying that
 a rule of thumb is that the more you pay, the less you know.  I guess this
 holds for hifi gear as it does for certs).

So we don't really need "high-assurnace policy OIDs" (or whatever), all we
need is an extension indicating how much the owner paid for it, and the
problem is solved.

Peter.