"Peter J. Holzer" <hjp@xxxxxxxxx> writes: [...] > The best way I can think of is to make it easy for the user to check > information about the Domain. > > For example, the certificate for > www.pÐypal.com is for > > CN = www.xn--pypal-4ve.com > OU = Domain Control Validated - StarterSSL(TM) > OU = See www.freessl.com/cps (c)04 > OU = https://services.choicepoint.net/get.jsp?GT57083512 > O = www.xn--pypal-4ve.com > C = US Maybe I'm naive, but shouldn't a trustworthy root CA not sign certificates for domain names which are obviously meant to be deceptive? Isn't this the entire reason for browsers coming with a small list of CAs which are deemed trustworthy? If the holders of widely-trusted root certificates can't be trusted to avoid even the most rudimentary deceptions, many of the protections of SSL have only very limited value. Perhaps some more care on the part of browser packagers in deciding which CAs have their certificates included by default is the solution. ----ScottG.
