<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ben Laurie:
<blockquote
cite="mid:1b587cab0808081241ye4d52cl966740b189ed284d@mail.gmail.com"
type="cite">
<pre wrap=""><!---->
If you have a better forum, bring it on.
However, CAs do not have everything at their disposal to remove the
threat. Browsers,OpenID libraries and RPs must also participate.
</pre>
</blockquote>
<br>
Yes! First of all you've got the dev.tech.crypto mailing list at
Mozilla where this issue has been discussed with the partition of
various CAs including us (StartCom), Verisign, Comodo and some others.
As a result of this discussion, StartCom revoked all affected keys
after notifying the subscribers, Verisign and Comodo scanned and pinged
all affected subscribers and may have revoked subscriber keys (not sure
about the latter, but Comodo reserved the right to do so, not sure if
they actually did). The list is at
<a class="moz-txt-link-freetext" href="https://lists.mozilla.org/listinfo/dev-tech-crypto">https://lists.mozilla.org/listinfo/dev-tech-crypto</a><br>
<br>
Another good forum might be the CA/Browser forum at
<a class="moz-txt-link-freetext" href="http://www.cabforum.org/">http://www.cabforum.org/</a><br>
I'm not aware if this issue was discussed there.<br>
<br>
<blockquote
cite="mid:1b587cab0808081241ye4d52cl966740b189ed284d@mail.gmail.com"
type="cite">
<pre wrap="">
Just as saying "buffer overflows are bad" has not magically caused all
buffer overflows to be fixed, I am confident that the only way to get
this problem fixed is to chase down all the culprits individually.</pre>
</blockquote>
<br>
As I indicated, I believe this to be the wrong approach - specially not
targeting OpenID whose following is still rather smallish compared to
others...You still can find many affected sites and services including
financial institutions (banks), government agencies and more...finding
a few OpenID OPs is certainly not a surprise (I was surprised to learn
about SUN having an affected key however ;-) ) since around 3 % of all
web sites were affected before disclosure.<br>
<br>
<blockquote
cite="mid:1b587cab0808081241ye4d52cl966740b189ed284d@mail.gmail.com"
type="cite">
<pre wrap="">I am sure that OpenID is not the only thing with problems, as you say.
</pre>
</blockquote>
<br>
Nope! I'll be glad to facilitate and help you to advance awareness at
any forum you choose, which hopefully will have a better effect
overall, than to single out specific standards and services. In that
respect I suggest to change the current advisory relating to OpenID.<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>