<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Forget it since Ryan think it is not a problem that CABF can solve, thanks.<br><br>Regards,<div><br></div><div>Richard</div></div><div><br>On Apr 9, 2015, at 00:13, Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com">Dean_Coclin@symantec.com</a>> wrote:<br><br></div><blockquote type="cite"><div><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--><div class="WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Is this something you still want on the agenda to discuss?<br><br>Dean<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ryan Sleevi [<a href="mailto:sleevi@google.com">mailto:sleevi@google.com</a>] <br><b>Sent:</b> Tuesday, April 07, 2015 9:53 PM<br><b>To:</b> Richard Wang<br><b>Cc:</b> Dean Coclin; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> Re: [cabfpub] Draft Zurich F2F Meeting agenda<o:p></o:p></span></p><p class="MsoNormal"><o:p> </o:p></p><div><p class="MsoNormal"><o:p> </o:p></p><div><p class="MsoNormal"><o:p> </o:p></p><div><p class="MsoNormal">On Tue, Apr 7, 2015 at 6:42 PM, Richard Wang <<a href="mailto:richard@wosign.com" target="_blank">richard@wosign.com</a>> wrote:<o:p></o:p></p><div><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Calibri","sans-serif";color:#1F497D">Thanks for so detail information.</span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Calibri","sans-serif";color:#1F497D">Why I raise this problem is most bank in China install its own root to Windows trusted root while install the USB Key CSP, but the User key certificate don’t have EKU limit that user can use this cert to sign malware that the signature is trusted by Windows. This is a big security problem.</span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Calibri","sans-serif";color:#1F497D">Another problem is the trusted signed malware modify the local host file and install its own root to trusted root, then redirect to the fraud bank site, but the browser don’t have warning.</span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Calibri","sans-serif";color:#1F497D">This is why I suggest browser and Windows should not trust manually installed root.</span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Best Regards,</span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Richard</span><o:p></o:p></p></div><div><p class="MsoNormal"><o:p> </o:p></p></div><div><p class="MsoNormal">Richard,<o:p></o:p></p></div><div><p class="MsoNormal"><o:p> </o:p></p></div><div><p class="MsoNormal">I agree, that is a real problem. I'm aware of a number of similar unfortunate and insecure practices being encouraged by the traditionally trusted organizations (banks, postal services, governments). I think it's very unfortunate for users when their system security is subverted by the people they trust.<o:p></o:p></p></div><div><p class="MsoNormal"><o:p> </o:p></p></div><div><p class="MsoNormal">Just because I don't think there is much that the CA/B Forum can or should do does not mean I don't think this is an important issue or that it should be solved. I just don't think that we here can solve it. In some circles, this is called a "layer 8 issue" - meaning that the solution is not necessarily one of technology, but one of policy, awareness, and activism.<o:p></o:p></p></div></div></div></div></div></div></blockquote></body></html>