<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 11/07/2014 01:44 AM, Ryan Sleevi
wrote:<br>
</div>
<blockquote
cite="mid:CACvaWvb1aphXsk_3_kfXLT1rsOfPkEgsjNZAjE5rfmLJf9BmEw@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
<div class="gmail_extra">At the risk of being exceptionally
pessimistic, rather than my normal moderately pessimistic,
could it be perhaps because customers find TLS hard precisely
because of these arbitrary distinctions that do nothing for
security of UAs (again, same origin policy), and even LESS for
automated tools (S2S federations and the like?)
<div class="gmail_quote">
<div><br>
</div>
<div>That is, there are plenty of customers who buy EV for
their 'internal' domains for internal servers, judging by
the CAs who have commented against CT. That's another
thing that, from a security sense, makes no sense.
Especially when those EV certificates can cost many
hundreds of dollars more.</div>
</div>
</div>
</div>
</blockquote>
<br>
Of course I can't comment on other CAs, but take into account that
things are very different between what the various CAs offer for
their customers and not everything is obvious just by browsing a few
web sites. <br>
<br>
<blockquote
cite="mid:CACvaWvb1aphXsk_3_kfXLT1rsOfPkEgsjNZAjE5rfmLJf9BmEw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div>Put differently, it's a logical fallacy to assume that
because subscribers buy OV that subscribers want OV, or
that OV exists because subscribers want OV. <br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
No, sometimes it's also a risk assessment where a CA is willing or
not willing to issue a certificate with a domain control validation
only - again also here differences exist. <br>
And many times subscribers know exactly what they are doing and want
their entity to be verified, but not EV (which they could if they
want). <br>
And sometimes I guess you are right, they enroll for something they
think sounds good but might not be necessary. Or the other way
around too (should do OV, but prefer DV).<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>