<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 11/07/2014 11:49 AM, Gervase Markham
wrote:<br>
</div>
<blockquote cite="mid:545C9598.5010709@mozilla.org" type="cite">
<pre wrap="">On 07/11/14 09:44, Eddy Nigg wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Does it reduce risk of intentional abuse? Yes
</pre>
</blockquote>
<pre wrap="">
You need to be more specific on how you think it reduces the risk.</pre>
</blockquote>
<br>
The subscriber knows that the CA has XYZ details about it, probably
entered a formal agreement and the personal or entity details are
displayed in the certificate. Even if he/she wouldn't care, a
relying party could use this data (and together with data the CA
gathered probably some more).<br>
<br>
<blockquote cite="mid:545C9598.5010709@mozilla.org" type="cite">
<blockquote type="cite">
<pre wrap="">Does it provide a trace to a real (legal) entity? Yes
</pre>
</blockquote>
<pre wrap="">
But this is not a binary thing. </pre>
</blockquote>
<br>
Nothing is binary Gerv....<br>
<br>
<blockquote cite="mid:545C9598.5010709@mozilla.org" type="cite">
<pre wrap="">Can an attacker get an OV certificate
with a bogus O field? However hard you think that is, it's certainly
easier to do that for OV than for EV.</pre>
</blockquote>
<br>
It might be harder depending on the CAs policies and practices, it
would and should be harder for EV, but that's it. As you said, it's
not binary and neither total 100%.<br>
<br>
But it reduces the risk - it matters if you have to deal with one
case or with thousands.<br>
<br>
<blockquote cite="mid:545C9598.5010709@mozilla.org" type="cite">
<blockquote type="cite">
<pre wrap="">Or the other way around, why don't we just issue code signing
certificates to anyone able to validate an email address? Ask Tom.
</pre>
</blockquote>
<pre wrap="">
Code signing certificates are an entirely different use case, and I
don't think the comparison is useful.
</pre>
</blockquote>
<br>
No, I think the comparison is not bad at all if you think about it.
I's just that for code signing we understand the risk easier and we
both agree on it. <br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>