On 10 May 96 at 18:12, you wrote:

At 5:48 PM 5/10/96, Dan Weinstein wrote:

...

On Fri, 10 May 1996 10:22:24 -0700, timd@consensus.com wrote:

...

The only effort they make is that when using the email-based CA, it mails the certificate to the address within, so it's not trivial to get a cert for an address that you don't have access to. (I'm not saying it's impossible, or even hard, just that it requires some skill and effort).

I don't believe this is correct. They send you information after you have created the cert verifying that you set it up, but nothing requires a response and the key is transfered via http.

If you'll examine my message, you'll see I was referring to the email-based S/MIME class 1 CA.

Best, - Tim Dierks

Tim Dierks -- timd@consensus.com -- www.consensus.com Head of Thing-u-ma-jig Engineering, Consensus Development

Oops, sorry about that. Dan Weinstein djw@vplus.com http://www.vplus.com/~djw PGP public key is available from my Home Page. All opinions expressed above are mine. "I understand by 'freedom of Spirit' something quite definite - the unconditional will to say No, where it is dangerous to say No. Friedrich Nietzsche