<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
On 12/21/2013 12:24 AM, From Rob Stradling:
<blockquote cite="mid:52B4C39D.4090603@comodo.com" type="cite">Indeed.
However, apparently it took 9 days for them to discover the
breach. CT would've hopefully helped them notice quicker (and it
certainly would've made a cover-up impossible!)
<br>
</blockquote>
<br>
Just to be clear - I'm absolutely not against the original idea and
effort to find a solution to this problem if that is possible. And
such a solution could come with different flavors - nobody forced
the software vendors to accept every national/local/regional CA on a
global basis for example.<br>
<br>
But as far as I see it, the CT proposal is that intrusive for us in
so many aspects (infrastructure, business model, personnel and more)
that I'm not sure if we are willing or can pay the price for it.
Specially when we have proven utmost diligence what our operation
concerns - just see
<a class="moz-txt-link-freetext" href="http://www.netcraft.com/internet-data-mining/ssl-survey/">http://www.netcraft.com/internet-data-mining/ssl-survey/</a> as an
example:<br>
<br>
<blockquote>The distribution of key lengths, however, varies
significantly between different CAs. For example, in May 2013,
StartCom had issued no certificates with an RSA public key shorter
than 2048-bits and almost 20% are 4096-bits long, more than any
other major CA.<br>
</blockquote>
<br>
Everything should remain reasonable however and I don't believe
there is 100% security as mistakes can and will happen (not only
with CAs, but the entire ecosystem including software). This is
something we all clearly should keep in mind all the time (if you
are looking for 100% stop using the Internet because it doesn't
exist). There can be however 100% effort which we should expect from
all certificate authorities or otherwise don't run one.<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>