<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Dear Rich,</div><div><br></div><div>On Sep 28, 2014, at 2:52 PM, Salz, Rich <<a href="mailto:rsalz@akamai.com">rsalz@akamai.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Another interesting aspect of CT is that it significantly raises the cost of a CA to agree to an NSL. Imagine someone like Verisign is compelled to issue a bogus certificate, and that it is found out. Verisign is now stuck: either run the risk of violating the NSL and admitting what happened, or run the risk of having their CA removed from the browser's trust store, rendering ALL Verisign sites untrusted. In essence, the cost for compliance could be going out of business, which could be a pretty strong argument to make if appealing the order. If CT does nothing else but make secret orders much**2 more difficult that seems a good thing.</blockquote><div><br></div><div>In this particular example, there is a third option that is more likely to happen than either of the two you've presented: Verisign will say they were hacked, and that their private keys were used without their consent or knowledge.</div><div> </div><div>The damage will have been done to the victims (who get no recourse), and the money and efforts to deploy CT will have been spent (and wasted, IMO).</div><div><br></div><div>Verisign is also but one small slice of the pie of potential malicious actors (see the diagrams in the blog post for a more complete picture).</div><div><br></div><div>Kind regards,</div><div>Greg Slepak<br><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></div></body></html>