Re: [cti-taxii] Items in scope vs out of scope

[Tony Rutkowski <tony@yaanatech.com>]

Hi Terry,

Your concerns certainly reflect those of many
in the community.  On the other hand, there
are arguably more ubiquitous TAXII use cases
where EVcerts have a value proposition.  Perhaps
this all gets folded into the trust model options.

--tony


On 2015-10-15 7:14 PM, Terry MacDonald wrote:
> I personally don't hold a lot of value in the use of EV Certs. 
> Certificate Authorities have a long history of getting social 
> engineered, hacked, and so forth. I think if people are super 
> concerned with validation of certificates then that will happen either 
> with phone calls to repeat the fingerprints of certs, or for super 
> secret trustgroups people will use their own shared PKI solution (e.g. 
> separate offline trustgroup root cert, with a trustgroup run issuing 
> server for all participants). Vendors will of course issue client 
> certs through their vendor portals, or just accept the user auth as 
> confirmation of the TAXII clients identity.