Policy-Discussion

[Ian G <iang AT cacert.org>]

On 24/03/2010 15:06, Mark Lipscombe wrote:
> On 3/24/2010 3:03 PM, Ian G wrote:

> > That's just my call, though. Another possibility is to go back to David
> > Ross and discuss the criteria with him.
>
> Yes, you're right that it does seem like a questionable criteria.
> Perhaps we should discuss it with David, and failing that, documenting
> our "compensating controls" as part of our case for ignoring that criteria.


I would figure out our full system, document it, then discuss with 
David.  Not much point in going there with what we have now...

> What does Webtrust have to say on the subject?

It isn't as detailed, it simply asks for disclosures of these things, 
and doesn't get into passwords.  ETSI might, it is much more detailed, 
as is EV.  But I don't recall them saying anything about this one.

iang

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature