4 ms·

Cool. One question: what if I'm not a company?

by voidz 11y ago

nailer 11y ago
Woo, rate limit's expired! If you're not a company, or registered organization, or government department, you can't get an EV certificate right now. The cabforum EV guidelines [1] don't currently have provision for individuals. I know that sucks. Especially when there is already capability to use government IDs for individuals in the EV guidelines for checking e.g. company directors in some cases [1]. But here's why: - The certificate subject for an EV cert, i.e. the thing the CA is attesting to by signing your certificate is the unique in the jurisdiction registration ID. Eg, visit https://github.com https://github.com and click the certificate in Chrome - you can see GitHub is Delaware company 5157550. The subject for an individual version of an EV cert would needs to be: - unique in the jurisdiction - publicly revealable You couldn't use the number of the ID checked, since passport numbers, drivers license numbers and other are considered 'High Risk Confidential Information' in much of the world [2] Unfortunately such a document don't exist in much of the world. [1] https://cabforum.org/wp-content/uploads/EV-V1_5_61.pdf https://cabforum.org/wp-content/uploads/EV-V1_5_61.pdf [2] http://security.harvard.edu/book/1-high-risk-confidential-information-hrci http://security.harvard.edu/book/1-high-risk-confidential-in...
- caf 11y ago
  The tuple (Full Name, Date of birth, Place of birth) ought to be a suitable unique subject for an individual.
  - saurik 11y ago
    "Meet my two twin sons, Collision (pronounced cole-eye-zon, we call him Cole for short) and Collision (pronounced call-iss-on, though we like to call him Colin)."
    - caf 11y ago
      Luckily you are such a good parent that your twin sons would never dream of impersonating each other online. And of course the Date Of Birth is really Date/Time of Birth.
      - saurik 11y ago
        The point is that "this is unique enough" is not a good standard when the data is sketchy or even subject to manipulation. The corporate ID numbers otherwise being discussed are unique by fiat.
deleted 11y ago
[deleted]

Cool. One question: what if I'm not a company?

by voidz 11y ago

Cool. One question: what if I'm not a company?

Woo, rate limit's expired! If you're not a company, or registered organization, or government department, you can't get an EV certificate right now. The cabforum EV guidelines [1] don't currently have provision for individuals. I know that sucks. Especially when there is already capability to use government IDs for individuals in the EV guidelines for checking e.g. company directors in some cases [1]. But here's why: - The certificate subject for an EV cert, i.e. the thing the CA is attesting to by signing your certificate is the unique in the jurisdiction registration ID. Eg, visit https://github.com https://github.com and click the certificate in Chrome - you can see GitHub is Delaware company 5157550. The subject for an individual version of an EV cert would needs to be: - unique in the jurisdiction - publicly revealable You couldn't use the number of the ID checked, since passport numbers, drivers license numbers and other are considered 'High Risk Confidential Information' in much of the world [2] Unfortunately such a document don't exist in much of the world. [1] https://cabforum.org/wp-content/uploads/EV-V1_5_61.pdf https://cabforum.org/wp-content/uploads/EV-V1_5_61.pdf [2] http://security.harvard.edu/book/1-high-risk-confidential-information-hrci http://security.harvard.edu/book/1-high-risk-confidential-in...

caf 11y ago
The tuple (Full Name, Date of birth, Place of birth) ought to be a suitable unique subject for an individual.
- saurik 11y ago
  "Meet my two twin sons, Collision (pronounced cole-eye-zon, we call him Cole for short) and Collision (pronounced call-iss-on, though we like to call him Colin)."
  - caf 11y ago
    Luckily you are such a good parent that your twin sons would never dream of impersonating each other online. And of course the Date Of Birth is really Date/Time of Birth.
    - saurik 11y ago
      The point is that "this is unique enough" is not a good standard when the data is sketchy or even subject to manipulation. The corporate ID numbers otherwise being discussed are unique by fiat.

deleted 11y ago

[deleted]