Subject: about certificate?

From: [email-masked]
Date: Tue, 18 Jun 2002 02:18:15 EDT

Hi,
i often get a popup window from my browser telling me that the authenticity 
of the software i'm trying to download or the site i'm trying to access can't 
be verified, and therefore it can't be trusted.
here's an example with some details i got yesterday:
------------------------------------------------------------------------------

-----------------
version   : V3
serialnumber :  8B37 799F BE20 F081 4C0C 3D19 F618 80DD
signature algorithm : md5RSA
Issuer  : CN = Root Agency
valid from : Tuesday, April 23, 2002 9:58:27 AM
valid to    : Saturday, December 31, 2039 4:59:59 PM
subject : CN = Privatenet Corporation
public key      (512 bits) RSA
Authority key id    KeyID=12E4 092D 061D 1D4F 008D 6121 DC16 6463
            Certificate Issuer:     CN=Root Agency
            Certificate SerialNumber=0637 6C00 AA00 648A 11CF B8D4 AA5C 35F4
thumbprint algorithm : sha1
thumbprint  : FB8F C086 B8FC CA23 F240 71D1 AF6E 13BA 33CB 6BF5  
------------------------------------------------------------------------------

-------------------------------
this happens for me even with great companies sites. most of the time the 
browser tells me that the certificate is valid but the root issuer can't be 
trusted or even it doesn't exist and can't be contacted. 
are there any invalid CAs on the net? if yes, how can someone distinguish 
them from trusted CAs?

thanks for your help,

------------------------------------------
Omar Djaiz
Networking students at Ecole Polytechnique of Montreal - CA
[email-masked]

---

From: "Craig S. Williams" <[email-masked]>
Date: Tue, 18 Jun 2002 00:32:52 -0700 (PDT)

Omar--

Take a look at RFC 1422.  May give you some insite on
certificates.  First off, have you taken a look at
your browser settings for certificates?  Take a look
at that.

Craig Williams
ONI Systems

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of
[email-masked]
Sent: Tuesday, June 18, 2002 2:18 AM
To: [email-masked]
Subject: about certificate?

Hi, 
i often get a popup window from my browser telling me
that the authenticity of the software i'm trying to
download or the site i'm trying to access can't be
verified, and therefore it can't be trusted. 
here's an example with some details i got yesterday: 
-----------------------------------------------------------------------------------------------

version   : V3 

signature algorithm : md5RSA 
Issuer : CN = Root Agency 
valid from : Tuesday, April 23, 2002 9:58:27 AM 
valid to : Saturday, December 31, 2039 4:59:59 PM 
subject : CN = Privatenet Corporation 
public key (512 bits) RSA 
Authority key id KeyID=12E4 092D 061D 1D4F 008D 6121
DC16 6463 
Certificate Issuer:     CN=Root Agency 
Certificate SerialNumber=0637 6C00 AA00 648A 11CF B8D4
AA5C 35F4 
thumbprint algorithm : sha1 
thumbprint : FB8F C086 B8FC CA23 F240 71D1 AF6E 13BA
33CB 6BF5   
-------------------------------------------------------------------------------------------------------------

this happens for me even with great companies sites.
most of the time the browser tells me that the
certificate is valid but the root issuer can't be
trusted or even it doesn't exist and can't be
contacted. 
are there any invalid CAs on the net? if yes, how can
someone distinguish them from trusted CAs? 

thanks for your help, 

------------------------------------------ 
Omar Djaiz 
Networking students at Ecole Polytechnique of Montreal
- CA 
[email-masked]

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

---

From: "Sabharwal, Atul" <[email-masked]>
Date: Tue, 18 Jun 2002 13:39:25 -0700

Sure does but if you get three such events every month for a prolonged time,
you are in trouble!!

Keep making phone calls to get your money back which can take a month or
more to come back.  Also, you have to remember to double check if the credit
was posted back to your account.  It's lot of inconvenience to the consumer
for no fault.  Should businesses be liable for 
the inconvenience fee for such billing/accounting errors. As per me,
something small like $3 would do.  Same happens with phone bills. Whenever
you switch a carrier, the first bill is incorrect.  

How do these bugs get fixed if corporations do not have any business benefit
for it. They are bugs/errors and are painful for the consumers.  These
loopholes can be abused.

--
Atul

P.S: This is my personal opinion.

-----Original Message-----
From: Gary E. Miller [mailto:[email-masked]] 
Sent: Tuesday, June 18, 2002 11:50 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: about certificate?

Yo Omar!

You are worrying about the wrong things.  Hackers do not bother to steal
CC#s off the net one at a time.  They break in to Amazon and take 30,000
at a time.  At least in the US your liability for stolen CC info is US$50.

So check your statements carefully and let the folks with the real
risk worry about it.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
	[email-masked]  Tel:+1(541)382-8588 Fax: +1(541)382-8676

On Tue, 18 Jun 2002 [email-masked] wrote:

> i configured my browser to detect such pbs because i do shop on the net
and
> i need to evaluate the credibility of any claimed site identity.