<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
On 05/06/2013 05:42 PM, From Rich Smith:
<blockquote
cite="mid:019801ce4a67$fb249a50$f16dcef0$@smith@comodo.com"
type="cite">
<pre wrap="">What's more, the EV requirement around domain verification is currently LESS
SECURE than OV/DV in this regard as it ONLY requires looking at WHOIS. To
the best of my knowledge there has never been a case of any mis-issuance of
a certificate to an unauthorized domain where a technical mechanism was used
to verify domain authorization.</pre>
</blockquote>
<br>
If anything we should probably require a technical verification <b>and</b>
a human interaction via WHOIS to really improve it.<br>
<br>
I'm not sure... if we'd simply rely on technical verification under
certain circumstances certificates could be issued unintentional and
then in the EV level. I'm not very comfortable with the thought to
solemnly rely on a domain control validation. <br>
<br>
Also EV certificates should probably identify the entity that stands
behind the web site (even though the guidelines allow for
authorization and delegation of sites to a validated entity), it
requires either a lookup at the WHOIS records and/or web sites
involved to confirm that.<br>
<br>
<blockquote
cite="mid:019801ce4a67$fb249a50$f16dcef0$@smith@comodo.com"
type="cite">
<pre wrap="">It is also extremely frustrating for a customer who, for example, gets a
request from us to unmask whois, gets an email sent to a WHOIS contact and
responds to it, then gets another request that they now have go back in and
change the WHOIS info because we have found it to not match now that we can
see it. From their point of view, the email established that they own the
domain so we are now just wasting their time.
</pre>
</blockquote>
<br>
Yes, probably most of us are aware of the difficulties with that, on
the other hand it also relays to the parties involved that an EV
isn't that easy to get. Agreed that your proposal would reduce some
of the hassle with that and make EV more convenient.<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>