Re: Gmail and SSL

["Keith Medcalf" <kmedcalf () dessus com>]

While i will agree that the client being able to validate the certificate directly is the best place to be, I do not 
see any advantage of requiring purchased certificates over self-signed certificates.  IMO it provides no realistic 
security benefit at all.

Then again I don't award points for 
certificate verification having anything to do with identity verification of the remote party.

In other words, if I didn't sign it then the certificate posseses no more validity than an ephemeral self-signed 
certificate.

Of course, others are free to delude  themselves with additional "theatrics" and false assumtions if they want to do so.

Sent from Samsung Mobile

-------- Original message --------
From: Christopher Morrow <morrowc.lists () gmail com> 
Date:  
To: kmedcalf <kmedcalf () dessus com> 
Cc: mysidia () gmail com,nanog () nanog org 
Subject: Re: Gmail and SSL