Frank Hecker: > Nelson Bolyard wrote: > >> Wow! I'd say that a CA that says "You cannot rely on our certs for >> eCommerce" should not be trusted for SSL by default in Mozilla products! >> >> Of course, that's a policy issue. Frank, what do you think? >> > > It is a policy issue, and we've had this discussion before. My point has > always been that SSL certs have multiple valid uses, and enabling online > purchasing and other financial transactions ("ecommerce") was one such > valid use but not the only one. Another valid use is using SSL to > provide extra security for non-financial applications, e.g., to encrypt > authentication information (passwords) and transaction data over the > wire, and to provide a measure of protection against DNS spoofing. IMO > domain-validated certs are adequate for this purpose, and that's the > major reason I argued that they be included under our policy. >
Absolutely, Frank! Domain validated certificates are very useful for the intended purpose, mainly to prevent eavesdropping, protect and encrypt data during exposure when traveling on the network, encryption of email and client authentication. Webmail, password protected sites (blogs, forums, administrative interfaces etc). and more... Your site is a good example for such usage! However the CPS in question stated that a relying party isn't a relying party :-) This sounds funny....But even if Comodo says so, I'm not even sure if it would uphold in court anyway. Lets move on to the next mail... > I think the statement Eddy references is basically a case of Comodo > being honest and admitting that LiteSSL certs are adequate for some > purposes (e.g., securing a low-value personal or small group site like > my own) but not for others (e.g., running an online store). That > statement strikes me as unexceptional -- Regards Signer: Eddy Nigg, StartCom Ltd. <http://www.startcom.org> Jabber: [EMAIL PROTECTED] <xmpp:[EMAIL PROTECTED]> Blog: Join the Revolution! <http://blog.startcom.org> Phone: +1.213.341.0390 _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto