Granted, you are correct that the blame needs to be shifted to the corporate clients and not the PKI vendors, VeriSign contributed to the idea that the human side of security is still the weakest point. VeriSign's change in ownership forms were basic email forms that were submitted as a form letter and were thought to be truthfully submitted. Meanwhile, malicious users were submitting false information to hijack domain names and security certificates. Knowing Rick's work background, (*cough* Network Solutions *cough*) I'd say he knows what he's talking about when he says that VeriSign specifically helped contribute to the problem.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/60/10576#10576