Verifying Auditor Qualifications

2020-06-03 Thread Kathleen Wilson via dev-security-policy
All, It recently came to my attention that I need to be more diligent in verifying auditor qualifications. Therefore, we have added a field in the CCADB called “Date Qualifications Verified” (on Auditor Location objects), which will be used to remind root store operators to check each

Re: GoDaddy: Failure to revoke certificate with compromised key within 24 hours

2020-06-03 Thread Cynthia Revström via dev-security-policy
Hi Daniela, Sorry if I am missing something, but what do you mean by "incorrect revocation reason"? The first sentence in the email sent to you by Sandy sounds pretty clear to me "Request you revoke the all certificate associated with this compromised key". Also I don't see how any of what you

Re: DRAFT May 2020 CA Communication/Survey

2020-06-03 Thread Kathleen Wilson via dev-security-policy
Based on the survey results, we (Ben and I) have recommended the following updates to the Browser Alignment Ballot. (currently in draft form here: https://github.com/sleevi/cabforum-docs/pull/10) 1) For the following changes proposed in the ballot, we have recommended that the effective date

RE: GoDaddy: Failure to revoke certificate with compromised key within 24 hours

2020-06-03 Thread Daniela Hood via dev-security-policy
Hello all, We appreciate the concerns and your questions to this thread. GoDaddy takes such issues very seriously and recognize the importance to the industry and health of the ecosystem. ​In the case where the user selected the incorrect revocation reason, we identified the error shortly

Re: Use of information collected from problem reporting addresses for marketing?

2020-06-03 Thread Nick France via dev-security-policy
On Wednesday, June 3, 2020 at 2:38:33 AM UTC+1, Benjamin Seidenberg wrote: > Greetings: > > Today, I received a marketing email from one of the CAs in Mozilla's > program (Sectigo). As far as I know, the only interactions I've ever had > with this CA where they would have gotten my name and email

Re: Use of information collected from problem reporting addresses for marketing?

2020-06-03 Thread Pedro Fuentes via dev-security-policy
As already said, this is purely about personal data processing, so the relevant regulation applies. I don't see need for the Root Programs to deal with this, as compliance with privacy regulations is already a requisite for Webtrust and other audits. In countries affected by GDPR, which is the