Re: Verisign acquisition of Thawte

[Michael Sierchio]

Dennis Glatting wrote:

> ...Certificate theft is but one very real
> problem that undermines the credibility of certificates in general.

Certificates aren't secret data, and *can't* be stolen.  

> ...Additionally, not one
> web site I have visited in the last year has asked for my client
> certificate, so the value of having a client certificate, seems to me,
> is zero.

Most client certs are of the Class 1 variety ("Persona not verified").
They aren't identity certs in any meaningful sense,  but a binding
of an RFC822 email address to a key pair.  That said,  client certs
are incredibly useful for secure single sign-on,  for access control
based on cert identity, etc. 

-- 
QUI ME AMET, CANEM MEUM ETIAM AMET
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]