<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Tim – your argument is “who knows if any certs have been misissued under Method 1” could apply to all other methods. That’s not an argument that there HAVE been misissued certs. We have been using the method for many years at multiple companies for many major enterprises (who would certainly be targets for phishing), and no one has ever reported a single case of misissuance. I think that’s pretty conclusive versus a “who knows” argument.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Your second statement – that Symantec issued lots of certificates using Method 1 that DigiCert would never have issued – seems to imply you have found misissuance by Symantec. If so, you should probably file an Incident Report on the Mozilla list and revoke the certs in question. If you don’t do that, we have to assume the certs were not misissued.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>If you can’t provide any facts showing misissuance of any cert using Method 1, please stop saying that there has been misissuance.<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Tim Hollebeek [mailto:tim.hollebeek@digicert.com] <br><b>Sent:</b> Tuesday, January 30, 2018 9:27 AM<br><b>To:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com>; CA/Browser Forum Public Discussion List <public@cabforum.org>; Bruce Morton <Bruce.Morton@entrustdatacard.com><br><b>Subject:</b> [EXTERNAL]RE: Voting on Ballot 218<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>> There have been no cases of misissuance using Method 1 over roughly 20 years<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>You guys have been told repeatedly that you have no evidence this statement is true. You need to stop saying it.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The truth is it is extremely hard to “misissue“ a certificate using method 1, precisely because it is so weak. Some of the certificates issued using method 1 probably went to people they shouldn’t have gone to. We have no idea how many, because the CAs used method 1, which doesn’t validate much!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Symantec issued lots of certificates in full compliance with method 1 that DigiCert would never have issued. Attempting to spin that into a rosy picture of 20 years of wonderfulness is a huge stretch.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Tim<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>