<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">From the slides it looks like the presenter was more requesting that browsers use SCVP or support Authorization Validation Lists. This would mean the browser “outsources” validation of certificates to another entity which returns the validation result. The result could possibly include an image to show the user in addition to a boolean valid/not valid.</div><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 1, 2016, at 3:19 PM, Dean_Coclin <<a href="mailto:Dean_Coclin@symantec.com" class="">Dean_Coclin@symantec.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I think what the presenter had in mind were “hooks” into the trust store such that an alternate trust source (i.e. eIDAS Trust List) could be selected by a user. I believe Ryan said this type of “hook” exposes the browser to potential malicious intent. One question I had (and I really don’t know how this works) is that I know Microsoft provides the capabilities for Enterprises to add or push roots out to users in their groups. Perhaps Dr. Poesch had that in mind when he was brainstorming his hook idea.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Dean<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span><a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class="">public-bounces@cabforum.org</a><span class="Apple-converted-space"> </span>[<a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class="">mailto:public-bounces@cabforum.org</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Ryan Sleevi<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Friday, April 01, 2016 2:29 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Gervase Markham <<a href="mailto:gerv@mozilla.org" style="color: purple; text-decoration: underline;" class="">gerv@mozilla.org</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>CABFPub <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] eIDAS meeting presentations<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Fri, Apr 1, 2016 at 2:17 PM, Gervase Markham <<a href="mailto:gerv@mozilla.org" target="_blank" style="color: purple; text-decoration: underline;" class="">gerv@mozilla.org</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On 30/03/16 01:03, Adriano Santoni wrote:<br class="">> Especially, I would like to understand whether browsers are<br class="">> willing/planning to integrate the EU trust lists....<br class=""><br class="">We remain to be convinced of the value of doing so. We see direct<br class="">control of our own trust list as an important factor in our ability to<br class="">drive positive change in the CA industry and the security of the web.<o:p class=""></o:p></div></blockquote><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">And how do you feel about exposing programattic access to modify or affect certificate validation, certificate UI, or certificate trust lists, as proposed during the meeting (and as captured in the Summary and in the slides by Reinhard Posch)<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I will echo on list what I had previously stated during the meeting, as it was not captured in the summary, which is on the balance, we see a far greater incidence of malware abusing such APIs compared to legitimate uses, and have no intent or desire to support such programatic access. We've seen malware campaigns extensively abuse command-line flags intended for debugging and diagnostics, and we've seen malware and malvertising campaigns significantly abuse both sanctioned and unsanctioned APIs, such that the use of such APIs is a strong indicator of Potentially Unwanted Software, and will be blocked through means such as Google SafeBrowsing and the Chrome Cleanup Tool. We believe other vendors have seen similar results.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Further, we remain deeply concerned about proposals that it would be beneficial to have other countries and legal entities provide or require similar Trust Lists, as also captured on Dr. Posch's slides, for many of the same reasons that Gerv spoke of.<o:p class=""></o:p></div></div></div></div></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Public mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Public@cabforum.org" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Public@cabforum.org</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="https://cabforum.org/mailman/listinfo/public" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">https://cabforum.org/mailman/listinfo/public</a></div></blockquote></div><br class=""></body></html>