said by Mele20 :

I don't get your point. As a user, I want to know if the website I am going to give my personal information to is actually the website I think it is. That is the first thing I need to know and second is that my information is encrypted.

said by jp10558 :

In the real world, your arguement is like saying Colleges, Local Libraries and clubs among others shouldn't be able to have membership/ID cards, because some people don't realise that they're not as good an identifier as a Passport. I'd have said drivers license, but many states drivers license isn't any better or harder to forge than a College ID.

said by Mele20 :

I don't think little guys should be in this game in the first place.

I think you are the one engaging in abuse of this system by wanting to provide encryption to a little site for your friends to visit. That is NOT what this is supposed to be about.

If certs have nothing to do with TRUST then there is no reason whatsoever to have the system in place. It should be torn down and I have to assume that is what you are advocating because anything else makes no sense by virtue of your own statements.

said by Tordurbar
@ asherc4
Massive misquote there.
You quoted Melih's quote of Donna's post of what Verisign said.
[/BQUOTE :

Yep you got me there. Quite a good one :hmm:
But hang-on in what context was the misquote made?Hmm
Should i explain that again...perhaps you missed it.
Here it is again.
"If Melih had just come out and publicly stated the below quote from the beginning (in regards to the cert issues) then gone on to re-establish it's responsibilty in-regards to future direction of cert developement. Then we would have had an informitive insight to the issues at had.
Unfortunatley he continues to treat the issues as a platform for further attacks on those that wish to call for such."

I actually feel you are doing Comodo a dis-service somehow in making further light of these issues. Although in the scheme of things you would probably fit right in in the Comodo PR department :p
I'm not sure it qualifies you to make any assumptions on my behalf though
Quote "whom the fools really are! - Yes, and it becomes clearer with each misguided blog posting." ;)

Quote ....."Why instead do they single out Comodo from all the CA's and try to hold their feet to the fire, for certs that imply no more than encryption/valid domain, the bad guys are the bad guys in this."

O.k. i understand your reasoning for this for this statement.
It seems obvious that Comodo would prefer that everybody finds the notion of what a lesser cert currently represents in their eyes. And to further future-proof their stance they are encouraging a more "trusted" interpretation of a more complex expensive cert.

Quote ....."Bad actors can get DV certs, and drivers licenses and credit cards and cell phones and ISP's and Domain Hosts and whatever else they want, pretty much. Hello real world.

O.k. so who issues Drivers Licenses then. The "wild cowboys" :D of the cert trade. No it's a serious issue and one would expect responsible parties to do such. Certs are no different. The people that issue them should lift there game or face loosing control of there issue. Although the internet is global the country in which the businesses are registered are not and legislateing company's to require a "we trust you to receive our own commerce cert whilst further requiring "Browsers" to apply for their decryption of a particular endorsment could be more lucrative, more trusted and finally more accurately designed both in it's implimentation and function.
This is more of a "Hello real world" view.

"......i sincerly hope they no longer continue to have influence in this respect."
I was not suggesting that Comodo should go out of business. just i see no evidence that they have the intergrity to continue on behaving the way they do presently. The current product fails to meet the potentsial of it's design and is not much more than a glorified cookie or token.

"The better solution is to educate users on the new reality."
Couldn't agree with you more.
--
It's one thing to be sure of yourself. It's another to confuse people. If they weren't related to each other we wouldn't have a problem;~)]]> http://www.dslreports.com/forum/remark,22771272 Mon, 27 Jul 2009 07:51:30 EDT http://www.dslreports.com/forum/remark,22771219 tradnav : Seems to me Tordubar that whilst I admire your guts and (rightly or wrongly) dedication to Comodo (and I'm certainly a proponent of free speech), that you're on a hiding to nothing on this forum.

It may be considerably easier on yourself if you buy a hair shirt and take up self-flagellation! The vast majority (including me) are not convinced by your excuses...(oops!, sorry, explanations).

One word (mentioned by mers2).....integrity.

Regards]]> http://www.dslreports.com/forum/remark,22771219 Mon, 27 Jul 2009 07:22:37 EDT http://www.dslreports.com/forum/remark,22771143 mers2 : Just a side note to add, I read the blog that smokey linked to, giving Mike's reasons for not adding the Ask Toolbar. As long as there is an option not to install the toolbar, I won't condemn those security companies, including Comodo that have it - but I will say I am extremely disappointed at the number of security companies that are going with this model. None of the software I use has thus far sunk to this level and I admire venders like OA, WinPatrol and others that have kept their integrity 100% intact.
--
"The best proof there is intelligent life in outer space is the fact it hasn't come here." Arthur C. Clark 1917-2008
Team Discovery
]]> http://www.dslreports.com/forum/remark,22771143 Mon, 27 Jul 2009 05:57:24 EDT http://www.dslreports.com/forum/remark,22771042 mers2 : Yup, Comodo damaged their own rep without any help from outside sources.

Methinks you doth protest too much. Not to mention that unlike most of the folks in this thread the only "helping" I've ever seen you do is trying to protect Comodo, not it's users. ]]> http://www.dslreports.com/forum/remark,22771042 Mon, 27 Jul 2009 03:57:23 EDT http://www.dslreports.com/forum/remark,22770761 hayc59 : Said by Tordubar
Bloggers Continue To Try To Damage Comodos Rep.
------------
Oh come on they being Melih did that all on his own
no help from anyone...get real sunshine?? LOL]]> http://www.dslreports.com/forum/remark,22770761 Mon, 27 Jul 2009 01:01:43 EDT http://www.dslreports.com/forum/remark,22770723 Tordurbar : Now that we have reached the point of dissecting quotes,
over analyzing off the cuff analogies, and a mildly sinister PM.
(you know who you are) my response -
Careful what you ask for there, sunshine.

It should be fairly obvious to anyone that has actually followed this "educational thread" titled "Comodo Continues To Damage It's Reputation" and plows first through pages on how to remove the evil Comodo from their PC's. That Perhaps a more fitting and newsy title may have been.
Bloggers Continue To Try To Damage Comodos Rep.]]> http://www.dslreports.com/forum/remark,22770723 Mon, 27 Jul 2009 00:47:46 EDT http://www.dslreports.com/forum/remark,22770662 SnowyOne :

said by Tordurbar :

Why take a drunk drivers license or pull a bad guys cert, just seems like it's the right thing to do.

The difference is pulling a drivers license of someone DUI & issuing them one while their drunk.]]> http://www.dslreports.com/forum/remark,22770662 Mon, 27 Jul 2009 00:22:42 EDT http://www.dslreports.com/forum/remark,22770651 Tordurbar : Why take a drunk drivers license or pull a bad guys cert, just seems like it's the right thing to do.

Out of context highlighted quotes, are relative to treating all low level certs with the suspect caution they deserve.

No Contradiction.]]> http://www.dslreports.com/forum/remark,22770651 Mon, 27 Jul 2009 00:19:23 EDT http://www.dslreports.com/forum/remark,22770612 SnowyOne :

said by Tordurbar :

Your kidding right?

No, what do you find amusing about my post?]]> http://www.dslreports.com/forum/remark,22770612 Mon, 27 Jul 2009 00:05:54 EDT http://www.dslreports.com/forum/remark,22770583 Tordurbar : Your kidding right?

Otherwise two words.
Obtuse and Grasping.]]> http://www.dslreports.com/forum/remark,22770583 Sun, 26 Jul 2009 23:57:08 EDT http://www.dslreports.com/forum/remark,22770551 SnowyOne :

said by Tordurbar :

In the face of facts, logic, and the reality on the ground.

I'm all for facts, logic & grounded logic reality.

said by Tordurbar :

1. "I on the other hand believe that everyone has a right to privacy and security through encryption."

2. "DV certs are issued without checks. So again it really doesn't matter who has one, Do Not use it as an indicator of who or Trust."

3. "...and like all the other CA's they will pull bad guys DV certs when properly notified."

It was only a matter of keeping you talkng long enough to get you contradicting yourself.
Why pull a sites cert if your quotes #1 & #2 are true?]]> http://www.dslreports.com/forum/remark,22770551 Sun, 26 Jul 2009 23:47:01 EDT http://www.dslreports.com/forum/remark,22770425 hayc59 : Actually you have tried to turn this from an educational
thread to another joke by Melihs F.B's and I for one do not appreciate it at all!!]]> http://www.dslreports.com/forum/remark,22770425 Sun, 26 Jul 2009 23:13:43 EDT http://www.dslreports.com/forum/remark,22770409 Tordurbar : I am indeed happy that I have given you the gift of joy.

If I had not used the word hater, or made the MVP quip.

Would we not still have ended up here, with you calling me fan boi.

In the face of facts, logic, and the reality on the ground.]]> http://www.dslreports.com/forum/remark,22770409 Sun, 26 Jul 2009 23:08:17 EDT http://www.dslreports.com/forum/remark,22770371 SnowyOne :

said by Tordurbar :

and like all the other CA's they will pull bad guys DV certs when properly notified.

Ole!Ole!Ole!]]> http://www.dslreports.com/forum/remark,22770371 Sun, 26 Jul 2009 22:55:33 EDT http://www.dslreports.com/forum/remark,22770359 hayc59 :
@
Tordurbar
Oh you amuse me to the fullest
@
Tordurbar
Why do all you fan boys go to the hater part?
and after reading your little comment about MVP's
which was brought to my attention, what ever sense I thought you had is now gone!! and I do know your other usernames! thanks for stopping in...you have become reduntent
--
ãrê ¥Øu êxpêriêncêD
Microsoft® MVP Consumer Security 2007-09
"Greater love has no one than this, that he lay down his life for his friends."
9/11/01 Never Forget]]> http://www.dslreports.com/forum/remark,22770359 Sun, 26 Jul 2009 22:51:48 EDT http://www.dslreports.com/forum/remark,22770302 Tordurbar : Ok,

@ hayc59

quote - "Actually we and everyone online really
know who/whom the fools are!"

Define we?
Everyone online? - fairly grandiose delusion.
who/whom the fools really are! - Yes, and it becomes clearer with each misguided blog posting.
At least to those thinking with their rational parts.

I know my stuff too, apparently better.

@ asherc4

Massive misquote there.

You quoted Melih's quote of Donna's post of what Verisign said.
Only moments later to be embarrassed by them replacing the rogue sites cert
that Comodo had just pulled.

Although I agree, in an ideal world with out those who would abuse the system.
The good old pad lock could have somehow been taken differently.
Other CA's, not Comodo introduced DV certs to the marketplace.
There went any credibility the padlock had, other than to verify an encrypted connection.

In my view - The Pros

- Encryption is readily available to the masses, cheap.
- Business wise a good $ move for the CA's. they opened up a huge new market.
- Because this move blew the lid off whatever trust people thought they had in the padlock.
We now have a new level of Trust in the who/encryption/page validity available, in the form of EV certs. Costly in comparison but there are real checks involved.

It could be a win win if some bloggers could accept the new reality.
Our innocence won't be restored no matter how many times we click our heels or how hard we wish.
Why instead do they single out Comodo from all the CA's and try to hold their feet to the fire, for certs that imply no more than encryption/valid domain, the bad guys are the bad guys in this.
The refrain is that Comodo is in the security business and should not endanger users by issuing DV certs to rogue sites.

Newsflash - Comodo is first and foremost a CA and as such DV certs are dispensed in similar fashion to all other CA's.
That's no excuse for rogues, and like all the other CA's they will pull bad guys DV certs when properly notified.
They give away a wide range of free security software, and offer some paid services in support of this.
This is establishing a web presence.
Because their Free software is really quite decent, they have stepped on a lot of toes, loads of hard feelings to go around.
I'm positive there's none of that at play with any of these actors though.

The Cons

- Obviously first and foremost given the new reality. Due to ease of access. Bad actors can get DV certs, and drivers licenses and credit cards and cell phones and ISP's and Domain Hosts and whatever else they want, pretty much. Hello real world.

So the brainwave solution is to attack Comodo, come on price yourself out of the market, unilaterally raise the bar on getting a DV cert, come on bleed money for the good guys, take one for the team and go out of business.
Where as one of, or all of the above taking place would not change the cyber landscape 1 iota.

The better solution is to educate users on the new reality.
Use your Blog-o-powers to teach, rather than to tear down.
Though I guess even fabricated controversy is good for the hit count/fame. Hmmm.

@ danny9

I threw hater's out there as a generality, in reference to the hater's, it is freely anyone's choice to feel included or excluded from this group, based on their own sensibilities.

@ mers2

My time is mine to spend.
My only purpose for being here is that this thread and several like it, as well as a couple of blogs from where this crud stems, have seriously offended my sense of logic, and irked the hell out of my sense of right and wrong.
I do in fact devote a great deal of my time to helping others, and here is where I happen to have chosen to deal with my pain, re: the misguided borderline slanderous crud.

@ Cudni

I know you don't know me by this handle.
Please accept my apology for attitude, I'll work on it if further posts become necessary.]]> http://www.dslreports.com/forum/remark,22770302 Sun, 26 Jul 2009 22:35:05 EDT http://www.dslreports.com/forum/remark,22767260 Cudni :

said by Tordurbar :

So what are the haters real motives?

Here, I said stay tuned. Lukewarm off the presses.

Hater's Epic Fail sooooooooo funny!

Throughout your contribution on this site so far, what do you think you are achieving by the use of confrontational, adversarial and derogatory remarks. Will it bring goodwill to Comodo or further drag it through the mud ? What is the purpose of perpetuating this sense of siege mentality, of them against us? You are not doing Comodo cause any favours but if that is what you set out to do then you have succeeded.

Cudni
--
"what we know we know the same, what we don't know, we don't know it differently."
Help yourself so God can help you.
Microsoft MVP, 2006 - 2009]]> http://www.dslreports.com/forum/remark,22767260 Sun, 26 Jul 2009 05:28:53 EDT http://www.dslreports.com/forum/remark,22767196 mers2 :

said by Smokey Bear :

said by mers2 :

Obviously, many of us disagree with you on Comodo riding both sides of the security fence with the certs. But there are still too many instances of Comodo not being ethical in other matters that I won't be using Comodo until they have a proven track record correcting that. Not to mention, personally I believe OA has a better firewall.

You forgot to mention that Tall Emu/OA have also the better business practise when we look at ethics and moral. »onlinearmorpersonalfirewall.blog···rly.html :)

Actually, I did mention it in one of my posts. It's one of the 2 primary reasons I run OA - it works and it's owner is ethical. Dynamite combo. :)

Edited to add quote "Edited to add quote "I use OA firewall, which works and the maker has shown himself trustworthy and ethical." from »Re: Comodo Continues to Damage It's Reputation
--
"The best proof there is intelligent life in outer space is the fact it hasn't come here." Arthur C. Clark 1917-2008
Team Discovery
]]> http://www.dslreports.com/forum/remark,22767196 Sun, 26 Jul 2009 04:29:08 EDT http://www.dslreports.com/forum/remark,22767192 mers2 : For it being such a trivial matter and simply a bunch of "Comodo haters" putting the software down - you seem to invest an awful lot of time in trying to argue Comodo's case. As far as I can tell, it's your only purpose for being here. Too bad Melih doesn't invest as much time and effort restoring the credibility of his company. ]]> http://www.dslreports.com/forum/remark,22767192 Sun, 26 Jul 2009 04:23:45 EDT http://www.dslreports.com/forum/remark,22767160 danny9 : "I submit for all,
If Comodo alone were to implement a higher standard for DV certs, or just shut down entirely.
The void would be filled in literally minutes and you would see Zero difference from the status quo.

So what are the haters real motives?"

First, "The void would be filled........"
It probably would but not by comodo who's first priority should be only security. Maybe some people would actually start to trust you again.
Or is it really someone else would be making the money?

Second, .."the haters real motives?"
Let me clarify this again as I stated earlier.
I do not hate comodo but find your actions unethical for a security co.
Are you saying I'm a liar?
Or are you a parrot and repeating what you are told to say?

You seem to run in more circles then a dog chasing his tail.
--
"In times of universal deceit, telling the truth becomes a revolutionary act.."
George Orwell]]> http://www.dslreports.com/forum/remark,22767160 Sun, 26 Jul 2009 03:32:52 EDT http://www.dslreports.com/forum/remark,22767155 ashrc4 :

said by Tordurbar :

DV Certs Do Not Imply Trust.
They provide a means of encrypting traffic.
Browsers 101 - What does that Padlock mean?
Answer - You have established an encrypted connection, Period.
It is someones fantasy that it means anything more, Period.

When the padlock came onto the scene it was purpose was to curtail some security issues. One of them was to provide better security by means of encrytion.
It was also pushed in the media to do buisness with those that adopted/used this method than not. The good name of those that supported it's use and fought for it's inclusion also at it's conception had hoped that it might be implimented responsibly.

This implimentation also was a sign of faith that those company's that chose to adopt it's use were infact being responsible in the security of there business. A company that chose to mitigate the potential of a third party to defraud it's customers and the banks was given a higher association of trust or at least that was the intention.

We certainly have come along way since then haven't we.

If Melih had just come out and publicly stated the below quote from the beginning (in regards to the cert issues) then gone on to re-establish it's responsibilty in-regards to future direction of cert developement. Then we would have had an informitive insight to the issues at had.
Unfortunatley he continues to treat the issues as a platform for further attacks on those that wish to call for such.

The CERT business is not just about issuing an encription method for the general public but a means of establishing a more secure method to protect banks web buisnesses the public goverments and all forms of commerce.

After seeing the carry-on from the Comodo camp in regards to future development on this issue a i sincerly hope they no longer continue to have influence in this respect. Or perhaps remove the heretics.

If this is a fantasy of mine thankfully i'm not alone.

Quote from Melih .......""Yes, we can revoke a cert whenever we want. But more importantly we have a high standard of checks & balances to make sure we do not issue certificates to bad sites in the first place."

"The system we have in place automatically rejects obviously fraudulent sites and kicks anything questionable to a manual approval. And if anyone flags a site as malicious, we have a team that investigates these and revokes the certificate if found to be malicious/fraudulent."

"For GeoTrust and RapidSSL we have the ability to revoke a cert issued to a malicious or rogue site instantaneously. The cert will then show up on our CRLs immediately."
--
It's one thing to be sure of yourself. It's another to confuse people. If they weren't related to each other we wouldn't have a problem;~)]]> http://www.dslreports.com/forum/remark,22767155 Sun, 26 Jul 2009 03:24:29 EDT http://www.dslreports.com/forum/remark,22766980 hayc59 : Actually we and everyone online really
know who/whom the fools are! That is hot off the press!
Donna does know her stuff rather well and Melih
is getting very tired of back peddleing]]> http://www.dslreports.com/forum/remark,22766980 Sun, 26 Jul 2009 01:33:54 EDT http://www.dslreports.com/forum/remark,22766810 Tordurbar : @ mvdu,

quote - "Right on; there IS no defense of Comodo IMO. Either have a better system for checking certs in place or get out of the security business."

As has been explained repeatedly, There Is a better system in place, It is EV.
If you require a third party's verification as to the "Who" you are dealing with,
you should look for it.
Use it.
Promote it.
Educate users.
Until it's shown to be broken or subject to abuse, it's the best we've got.

@ Trust me,

quote - "Or go and make cars for Ford"

It seems that no matter who they would build cars for, or how well they were built.
Their detractors would say they were crap because Comodo let them down in their
fantasy role as Universal SSL Cyber Police, Sworn to enforce some level of Trust that
never existed, but for in some misguided minds.

@ mers2

I agree that we disagree on the "riding both sides of the security fence" issue.
I have to respect your choice to not use their software based on your own opinion of
"not being ethical in other matters" where you find offense.
Good choice of firewall, we can all rest assured that both of our firewalls perform well.

@ SmokeyBear,

Yes, even to this day.
Ask and anyone that enters into a business arrangement with them seems to get painted with a scarlet letter in punishment, for an ill conceived distribution deal gone wrong,in their past.
Which for some irreparably damaged their reputation. Apparently forever.
It's just a search engine. With a marketing team trying to get "out there".

Great movie line "while we may not be done with the past, the past is done with us."

@ hayc59,

Stay tuned.

@ rcdailey,

Yea man, The truth is so lame.

@ mele20

Gotta give it up for Ford, the fiscally responsible corporate entity.

I submit for all,
If Comodo alone were to implement a higher standard for DV certs, or just shut down entirely.
The void would be filled in literally minutes and you would see Zero difference from the status quo.

So what are the haters real motives?

Here, I said stay tuned. Lukewarm off the presses.

Hater's Epic Fail sooooooooo funny!
»https://forums.comodo.com/feedbackcommen···sg313321]]> http://www.dslreports.com/forum/remark,22766810 Sun, 26 Jul 2009 00:09:14 EDT http://www.dslreports.com/forum/remark,22765910 rcdailey : So he's saying, in effect, if we don't do it, someone else will. How lame is that?
--
In reality, there is no such thing as a clean human being.]]> http://www.dslreports.com/forum/remark,22765910 Sat, 25 Jul 2009 18:49:20 EDT http://www.dslreports.com/forum/remark,22764859 hayc59 : Melih Responds To Mike Burgess's Blog
on a little bit o' problem..;)
moving in the right direction...maybe maybe not---NOT ;)
»msmvps.com/blogs/hostsnews/archi···234.aspx]]> http://www.dslreports.com/forum/remark,22764859 Sat, 25 Jul 2009 13:20:27 EDT http://www.dslreports.com/forum/remark,22764712 Smokey Bear :

said by mers2 :

Obviously, many of us disagree with you on Comodo riding both sides of the security fence with the certs. But there are still too many instances of Comodo not being ethical in other matters that I won't be using Comodo until they have a proven track record correcting that. Not to mention, personally I believe OA has a better firewall.

You forgot to mention that Tall Emu/OA have also the better business practise when we look at ethics and moral. »onlinearmorpersonalfirewall.blog···rly.html :)
--
Smokey's Security Forums »www.smokey-services.eu/forums/
Smokey's Security Weblog »smokeys.wordpress.com/
Site Member ASAP - Alliance of Security Analysis Professionals]]> http://www.dslreports.com/forum/remark,22764712 Sat, 25 Jul 2009 12:43:21 EDT http://www.dslreports.com/forum/remark,22764280 mers2 : Obviously, many of us disagree with you on Comodo riding both sides of the security fence with the certs. But there are still too many instances of Comodo not being ethical in other matters that I won't be using Comodo until they have a proven track record correcting that. Not to mention, personally I believe OA has a better firewall. ]]> http://www.dslreports.com/forum/remark,22764280 Sat, 25 Jul 2009 10:44:22 EDT http://www.dslreports.com/forum/remark,22764201 anon : Or go and make cars for Ford :p]]> http://www.dslreports.com/forum/remark,22764201 Sat, 25 Jul 2009 10:32:34 EDT http://www.dslreports.com/forum/remark,22764045 mvdu : Right on; there IS no defense of Comodo IMO. Either have a better system for checking certs in place or get out of the security business. ]]> http://www.dslreports.com/forum/remark,22764045 Sat, 25 Jul 2009 09:13:15 EDT http://www.dslreports.com/forum/remark,22763838 Tordurbar : I see any attempt at levity equals epic Fail.

"A company selling/providing security software that also issues certs to known malware companies is just one piece of the ethics puzzle."

DV certs are issued without checks. So again it really doesn't matter who has one, Do Not use it as an indicator of who or Trust.

They are primarily in the cert business and that is a part of the business. For better or worse.

In reality given their understanding of the Trust business and it's flaws, this should translate into better security software.
Not weaker software because you've got a cert Trust issue.
And oh yes indeed they are security experts, protecting the public, for free too.
Don't believe me. Test it.
I believe they are currently doing a fine job of thoroughly protecting over 15 million users.

Personal take, Firewall and D+ kick ass, the AV as a standalone definitely still in the growing pains stages.

So are we both reading the same thread.]]> http://www.dslreports.com/forum/remark,22763838 Sat, 25 Jul 2009 07:20:35 EDT http://www.dslreports.com/forum/remark,22763803 mers2 : Do you even bother to read the posts you are responding to? I kind of doubt it.

I said there were many incidents over the past couple of years that proved a lack of ethics on the part of Comodo. The certs issue is one. A company selling/providing security software that also issues certs to known malware companies is just one piece of the ethics puzzle. The difference between Comodo and other cert companies is that they don't make security software and put themselves out as security experts protecting the public. Somehow that seems to have escaped your attention. Your comments on dislikes being based on the forum colors, etc. is insulting and shows how little you're thinking.
--
"The best proof there is intelligent life in outer space is the fact it hasn't come here." Arthur C. Clark 1917-2008
Team Discovery
]]> http://www.dslreports.com/forum/remark,22763803 Sat, 25 Jul 2009 06:40:29 EDT http://www.dslreports.com/forum/remark,22763796 Tordurbar : It's true you are free to not like a company for any reason you like.
You may not trust them because of the forum colors.
You may choose to use any products you like, and support them.
You can yank their certs from your browser if you like.
If you find some practice or association repulsive, go ahead.

But again,
If you are telling people to yank their certs from their browsers and that Comodo are the bad guys. Because a few rogue sites have been dug up using a DV cert from them, This is truly in-genuine if you don't remove all certs because they all provide DV certs.
or
If you are saying that encryption means you should Trust someone.

Then someone like me will call you on it.
And alas, struggle to set the record straight while trying to not come off as a superior carbon unit.]]> http://www.dslreports.com/forum/remark,22763796 Sat, 25 Jul 2009 06:33:04 EDT http://www.dslreports.com/forum/remark,22763777 mers2 : I should also add, that after the company has shown they are trustworthy, their software has to work. Comodo firewall works, but their AV is still poor at this point. I use OA firewall, which works and the maker has shown himself trustworthy and ethical. ]]> http://www.dslreports.com/forum/remark,22763777 Sat, 25 Jul 2009 06:14:17 EDT http://www.dslreports.com/forum/remark,22763771 mers2 :

said by Tordurbar :

"The rest of us understand the situation perfectly, thank you very much."

Sorry I missed the part where you were voted Spokesparrot.

You apparently missed the majority of us here who share this opinion. The one you declared yourself superior to. With all due respect, you haven't shown yourself to be superior.

I just added that there have been several incidents that reinforce my opinion of Comodo's lack of ethics. I was one of those who gave them a chance when many here had already written them off. I require companies whose software I use for security to have a very high sense of ethics. Once they have repeatedly shown me they lack it, their software is gone from my machine. You'll find most here in this forum choose their security software the same way - you have to be able to trust the company before you can trust their software.
--
"The best proof there is intelligent life in outer space is the fact it hasn't come here." Arthur C. Clark 1917-2008
Team Discovery
]]> http://www.dslreports.com/forum/remark,22763771 Sat, 25 Jul 2009 06:10:52 EDT http://www.dslreports.com/forum/remark,22763763 Tordurbar : "The rest of us understand the situation perfectly, thank you very much."

Sorry I missed the part where you were voted Spokesparrot.]]> http://www.dslreports.com/forum/remark,22763763 Sat, 25 Jul 2009 06:01:58 EDT http://www.dslreports.com/forum/remark,22763759 mers2 : Sounds like you've had it explained to you by one of Comodo's professional apologists. I'd say you're the misguided one here. The rest of us understand the situation perfectly, thank you very much. And we make our decision by not using anything Comodo. For me, the decision is based on multiple things that have happened in the past couple of years that underscore the lack of integrity in the business, not just the certificates.
--
"The best proof there is intelligent life in outer space is the fact it hasn't come here." Arthur C. Clark 1917-2008
Team Discovery
]]> http://www.dslreports.com/forum/remark,22763759 Sat, 25 Jul 2009 05:57:37 EDT http://www.dslreports.com/forum/remark,22763728 Tordurbar : Ooops didn't realize it was on purpose.

No cats here.

So seriously "It is ALL about Trust and Identity"
Agreed.
Here's why

If the browser can't verify the presence of an EV cert which in turn verifies the who, and verify all the content on a page it won't give you the Green bar or provide the equivalent cert info for those that check manually.
This is as close to trustworthy as is currently possible to independently verify by the browser and CA, and is, until abused or compromised in some significant way the new current accepted standard of Trust based on a third party.
Ultimately the user has to decide whether to Trust the who, but at least you're assured of who who is.

If you get a padlock alone or with a blue address bar you are assured of an encrypted connection and are completely on your own as to whether to Trust the who.

Look y'all I don't hate none of ya.
And I'm not here to complain, I've just had enough of the smear campaign based on a misguided premise.
If I didn't know what I know and had the situation explained to me by one of Comodo's professional detractors, I'd probably share in believing their misguided premise on which they have settled to base unfounded criticism.]]> http://www.dslreports.com/forum/remark,22763728 Sat, 25 Jul 2009 05:15:32 EDT http://www.dslreports.com/forum/remark,22763706 Mele20 :

said by Tordurbar :

In your lovely screen cap you have gone to an incorrect URL.

»https://forums.comodo.com/index.php

There ya go. Carry on.

Yes, I did that deliberately to illustrate a point.

You have anything useful to say ...or has the cat got your tongue? :p
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson]]> http://www.dslreports.com/forum/remark,22763706 Sat, 25 Jul 2009 04:42:47 EDT http://www.dslreports.com/forum/remark,22763681 Tordurbar : In your lovely screen cap you have gone to an incorrect URL.

»https://forums.comodo.com/index.php

There ya go. Carry on.]]> http://www.dslreports.com/forum/remark,22763681 Sat, 25 Jul 2009 04:17:11 EDT http://www.dslreports.com/forum/remark,22763677 Mele20 :

said by Tordurbar :

Agreed that the norm should be, give the least amount of Trust across the board.

And that should be understood by all Encryption does not equal Trust.

Whoa the grief that would save!!!

Even in that environment I believe that the more expensive EV certs will have some value to large entities engaged in e-commerce.

Because the theory is that with the cost comes insurance, and all the extra back checking is meant to ensure the bad actors can't get them.
So even though I wouldn't Trust a stranger based solely on a cert
having the high value one is at least something else to check when considering such a decision.
Me Thinks.

"This site attempts to identify itself with invalid information".

"Click confirm security exception if you want to Trust the site."

It is ALL about Trust and Identity as far as the browsers would have you believe. You should be complaining to the developers of the browsers not in a user community where folks are simply doing what the browser developers have instructed. Sure, encryption does not equal trust but that is irrelevant because the browser developers claims it does. Complain to them.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

]]> http://www.dslreports.com/forum/remark,22763677 Sat, 25 Jul 2009 04:10:40 EDT http://www.dslreports.com/forum/remark,22763676 SnowyOne :

said by Tordurbar :

Rather than try to explain the page you reference.

That's a decision we can both agree with.]]> http://www.dslreports.com/forum/remark,22763676 Sat, 25 Jul 2009 04:10:36 EDT http://www.dslreports.com/forum/remark,22763660 Tordurbar : Rather than try to explain the page you reference.

Here free SSL you get the padlock. The only mention of Trust other than trusting your encryption is if you upgrade to an EV type of cert.
»www.instantssl.com/ssl-certifica···ate.html]]> http://www.dslreports.com/forum/remark,22763660 Sat, 25 Jul 2009 03:44:20 EDT http://www.dslreports.com/forum/remark,22763652 SnowyOne : That page is Comodo's "What is SSL" FAQ page which is broken into 3 sections
1. What is SSL?
2. Why do I need SSL on My Site?
3. How Does SSL Work?
Your reference goes to #3 & by itself can be seen as a push for the Comodo EV Cert but my comment went to gist of the entire page, not to a single reference within subsection #3 & a slight, passing reference to the possibility of some users seeing a green cert in subsection #1 when an EV cert is in place.
Here's the entire contents of subsection #2 again:
"Why do I need SSL on My Site?

The Internet has successfully created many new global business opportunities for enterprises conducting online commerce. However, that growth has also attracted fraudsters and cyber criminals.

The increasing awareness of online fraudsters and cyber criminals has presented an opportunity for ecommerce providers to capitalize on consumer fears by displaying trust indicators. Just like the real world, people need to be confident before they proceed down an unknown path.

subsection #2 clearly refers to "trust indicators" with Zero reference to Comodo's EV Cert. It's also the only subsection to make Zero reference to the Comodo EV Cert but Comodo still expects a user to make the connection that trust indicators" is not to be associated with a Comodo site cert? Why not just say that instead of leaving it up to the users imagination/interpretation?
If it's true that this a quality FAQ & the best that Comodo could produce, were screwed, really.]]> http://www.dslreports.com/forum/remark,22763652 Sat, 25 Jul 2009 03:28:57 EDT http://www.dslreports.com/forum/remark,22763596 Tordurbar : Hey SnowyOne,

I meant that, in context, this reference to "displaying trust indicators"
Is meant in reference to green bar of EV SSL certs.
Just below your quoted paragraph. In images. ]]> http://www.dslreports.com/forum/remark,22763596 Sat, 25 Jul 2009 02:33:29 EDT http://www.dslreports.com/forum/remark,22763580 SnowyOne :

said by Tordurbar :

You realize they are pushing EV certs there ... right?

By "there" I presume you refer to the link I provided?
»www.instantssl.com/ssl-certifica···ssl.html
My browser brings me a page that's about SSL & Comodo's 'instantSSLcert@$69.95yr & not about Comodo's EV cert@$359.00yr
Directory transversal brings my browser to the instantSSL cert home page, not the EV cert page.
Original link:
»www.instantssl.com/ssl-certifica···ssl.html
Further up original link:
»www.instantssl.com/
I can understand Comodo using it's instantSSL product as a way of pushing it's more profitable EV Cert product, but the link I provided is relevant to Comodo's instantSSL Cert.]]> http://www.dslreports.com/forum/remark,22763580 Sat, 25 Jul 2009 02:25:11 EDT http://www.dslreports.com/forum/remark,22763553 Tordurbar : Agreed that the norm should be, give the least amount of Trust across the board.

And that should be understood by all Encryption does not equal Trust.

Whoa the grief that would save!!!

Even in that environment I believe that the more expensive EV certs will have some value to large entities engaged in e-commerce.

Because the theory is that with the cost comes insurance, and all the extra back checking is meant to ensure the bad actors can't get them.
So even though I wouldn't Trust a stranger based solely on a cert
having the high value one is at least something else to check when considering such a decision.
Me Thinks.]]> http://www.dslreports.com/forum/remark,22763553 Sat, 25 Jul 2009 02:07:45 EDT http://www.dslreports.com/forum/remark,22763520 SnowyOne :

said by EGeezer :

However, the existence of the certificate, even if issued by Verisign's highest level, provides me no reason to believe that sending my credit card and billing information to AhmedTheNigerianBarrister.com over SSL is a good business decision.

That's the salzan approach to certificate trust. :)
Treat all levels of certs as being equal.
That should prevent user grief provided that the cert with the least amount (or zero amount) of trust is used as the model across the board.
That approach, if widely adopted by users would make the EV cert no more or less valuable than a free cert.
Certificate issuers would have a shit if this truly became the norm. How long would it take ecommerce sites to figure out that it didn't matter whether they had an expensive cert or a fly by night cert?]]> http://www.dslreports.com/forum/remark,22763520 Sat, 25 Jul 2009 01:48:58 EDT http://www.dslreports.com/forum/remark,22763503 Tordurbar : "The increasing awareness of online fraudsters and cyber criminals has presented an opportunity for ecommerce providers to capitalize on consumer fears by displaying trust indicators.
Just like the real world, people need to be confident before they proceed down an unknown path."

You realize they are pushing EV certs there ... right?]]> http://www.dslreports.com/forum/remark,22763503 Sat, 25 Jul 2009 01:40:05 EDT http://www.dslreports.com/forum/remark,22763483 EGeezer : This whole Cert thing looks like a reincarnation of earlier discussions where the veracity of a connection using an SSL certificate is being extrapolated to legitimacy and honesty of the business to whom it's issued.

I may consider a Verisign/GoDaddy/Comodo or other certificate for AhmedInNigeria.com to mean that I'm actually connecting to AhmedTheNigerianBarrister.com over an encrypted connection.

However, the existence of the certificate, even if issued by Verisign's highest level, provides me no reason to believe that sending my credit card and billing information to AhmedTheNigerianBarrister.com over SSL is a good business decision.

Certificate issuers need to get real and stop trying to equate their certificates to Dun& Bradstreet rating or BBB approval. Contrary to what they'd have you believe, the certificates don't guarantee a darned thing about the honesty, financial condition or business practices of the certificate purchaser/owner(apart from the fact that they somehow came up with enough money to buy the cert) ;) .

The user community also needs to be more skeptical of such marketing ploys and research their online entities carefully rather than relying on an SSL cert as proof of integrity.
--
The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis]]> http://www.dslreports.com/forum/remark,22763483 Sat, 25 Jul 2009 01:31:23 EDT http://www.dslreports.com/forum/remark,22763463 Tordurbar : Elitist because.
"I don't want anything to do with those "millions and millions" of little operators who are unable to financially bear a reasonable burden of establishing trust. This is why I have all Comodo and GoDaddy certs disabled. Those "little operators" are going to have to find a way to establish trust if they want to have a business online."

Even if they established Trust by other means, You would take away the rights of millions to have cheap encryption.

And by Group I meant whoever you referred to...
"Are you publicly claiming that Mozilla is an idiot to entertain these concerns to such a SERIOUS extent?"

Yes indeed, if it's due to the misguided notion that enabling for an encrypted connection means that I should Trust and should send a stranger my banking info.

This is sage advice -
"You need to check the cert not rely on a color on a bar"

Just like don't base Trust on an encrypted connection.]]> http://www.dslreports.com/forum/remark,22763463 Sat, 25 Jul 2009 01:23:10 EDT http://www.dslreports.com/forum/remark,22763430 SnowyOne :

said by Tordurbar :

That group you mention is indeed a group of humans and among them I know are a few who share the misguided views about the implication of Trust in relation to DV certs.

»www.instantssl.com/ssl-certifica···ssl.html

Why do I need SSL on My Site

The Internet has successfully created many new global business opportunities for enterprises conducting online commerce. However, that growth has also attracted fraudsters and cyber criminals.

The increasing awareness of online fraudsters and cyber criminals has presented an opportunity for ecommerce providers to capitalize on consumer fears by displaying trust indicators.
Just like the real world, people need to be confident before they proceed down an unknown path.

Trust indicators??
I cannot think of a definition of 'trust indicators' that does not involve trust.
Educate me.]]> http://www.dslreports.com/forum/remark,22763430 Sat, 25 Jul 2009 01:08:00 EDT http://www.dslreports.com/forum/remark,22763390 Mele20 : They don't turn my address bar green nor do "lesser" ones turn my address bar yellow or green and I am not referring to Fx 1.5 that I use on my host computer but Fx3 (that I am on now and IE8 which I have on three virtual machines). I turned the colors off as GREEN is my theme color so the address bar is green ALL the time anyway. That coloring the address bar was a stupid idea. You need to check the cert not rely on a color on a bar.

I have no idea what you are referring to by saying I have an "elitist" view of what? Of my defense of real mom and pop stores over internet ones? How is that elitist? You just don't like my view is that it? You said I mentioned a group but I don't know what that means either. I mentioned real mom and pop stores, that is a group. I mentioned Mozilla developers, Mozilla Foundation, and a newsgroup. Those are all groups but they are all concerned with Mozilla products so is the "group" that you are referring to Mozilla and its developers? Or is the "group" the members of the newsgroup? There are members that are not really Mozilla developers but people like Eddy Nigg (and some Comodo folks for that matter). He's misguided also I suppose or he is just trying to make trouble for Comodo so his rival cert issuing business somehow benefits...is that it?

What significance am I supposed to take from your odd statement that "That group you mention is indeed a group of humans"? Did you think I was referring to a group of animals or plants? They are all "misguided"? Frank Hecker among them. How interesting. :p Somehow, I think you are speaking tongue in cheek as surely you do not think you know more about Mozilla's use of certs than Mozilla does!
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson]]> http://www.dslreports.com/forum/remark,22763390 Sat, 25 Jul 2009 00:52:59 EDT http://www.dslreports.com/forum/remark,22763242 salzan : I've been making purchases from small operations for years. I never use the padlock as a symbol of anything other than a secure connection.

I use other means of deciding with whom I'm going to place my trust and the cert really has nothing to do with it unless it's completely missing.]]> http://www.dslreports.com/forum/remark,22763242 Sat, 25 Jul 2009 00:04:00 EDT http://www.dslreports.com/forum/remark,22763241 Tordurbar : Again with the Elitist view.

That group you mention is indeed a group of humans and among them I know are a few who share the misguided views about the implication of Trust in relation to DV certs.
And you'd have me believe that among them there are those misguided souls that would place more Trust in one vendors DV cert over an others.
So be it then. (shakes head)

Just an FYI for readers -
In FF 3.5 and IE 8 High value Trusted, vetted EV certs turn your browser address bar green.]]> http://www.dslreports.com/forum/remark,22763241 Sat, 25 Jul 2009 00:03:31 EDT http://www.dslreports.com/forum/remark,22763158 Mele20 :

said by Tordurbar :

I'm sure there are millions and millions of little operators that don't want to bear the massively increased costs associated with the implementation of a system of veracity (that already exists with the pricey certs) that would accommodate "Your" perception of a trust that never existed.

I have never seen it stated any where that you should Trust the authenticity or legitimacy of a site because they have a free/trial automated process plain encryption certificate because it is from any particular vendor.

I don't want anything to do with those "millions and millions" of little operators who are unable to financially bear a reasonable burden of establishing trust. This is why I have all Comodo and GoDaddy certs disabled. Those "little operators" are going to have to find a way to establish trust if they want to have a business online. Currently, the way trust is established is through certs. If they feel that they are discriminated against because they cannot afford a pricey cert well, gee, that is no different than the mom and pop real store that lost its business due to people deciding to shop on line because they couldn't get their lazy butts out of their chair to go to the mom and pop store. That mom and pop store had to charge more for the item too because they have overhead that the online store doesn't. They go out of business as people shop online and then you try and tell me that the online stores cannot afford to make their certs TRUSTWORTHY? Hmpf. The mom and pop stores on line deserve what they get and they won't get the business of knowledgeable users unless they do provide a level of trust (not that any level of trust on the internet can likely come near to the trust of the physical mom and pop in your hometown).

You need look nowhere further than the Mozilla Foundation and the mozilla.dev.tech.crypto newsgroup to see an example of how wrong your statement is about never seeing it stated anywhere about trusting the "authenticity or legitimacy of a site" because they have a cert from a root certifier for Mozilla browsers. Mozilla is considering REMOVING ALL COMODO CERTS FROM MOZILLA BASED BROWSERS BECAUSE COMODO HAS VIOLATED TRUST. Are you publicly claiming that Mozilla is an idiot to entertain these concerns to such a SERIOUS extent? That what it looks like to me.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson]]> http://www.dslreports.com/forum/remark,22763158 Fri, 24 Jul 2009 23:42:09 EDT http://www.dslreports.com/forum/remark,22763150 sded : Actually you can just use Opera to look at the trust of a site easily. The security icon under "browser view" both shows the level of the certificate (3 is good, blank is not) but also comes up with the related security and fraud check information for that site if you click on it. However most of the Opera users don't understand any of that, and rely on the good(?) name of the vendor. And Opera is only a 1% or so browser. So some vendors will continue to try to pass the blame on to the victim instead of helping with the problem, even when they have the tools in house. Creating distrust online that way.]]> http://www.dslreports.com/forum/remark,22763150 Fri, 24 Jul 2009 23:39:52 EDT http://www.dslreports.com/forum/remark,22763103 ashrc4 : user=SnowyOne
..........."while researching the differences between an EV cert & a DV cert because I wasn't aware of the extent of differences between them prior to seeing this thread."

The solution to all this seems simple. Just use a bigger more trust-worthy looking padlock for the "secure" cert. You could could even get some "trusted" MVP's to endorse the padlock. :D
Or you could change the padlock to a warning that say's "This cert was issued to anyone, probably someone you shouldn't trust but you can feel more secure knowing that it's encrypted." :o
--
It's one thing to be sure of yourself. It's another to confuse people. If they weren't related to each other we wouldn't have a problem;~)]]> http://www.dslreports.com/forum/remark,22763103 Fri, 24 Jul 2009 23:25:01 EDT http://www.dslreports.com/forum/remark,22763042 Tordurbar : "Creating trust online"? Not bloody likely.
Have you broken their encryption, bypassed their security products, or infiltrated a Comodo protected Corporate Environment?

They have been quite vocal about the misguided Trust people have come to associate with the padlock.
Which is the root of the "problem".
I'm sure there are millions and millions of little operators that don't want to bear the massively increased costs associated with the implementation of a system of veracity (that already exists with the pricey certs) that would accommodate "Your" perception of a trust that never existed.

They promote Verification Engine, they promote better industry standards, they promote user education.
Learn how to properly ID who to Trust and this is such a non issue.
I have never seen it stated any where that you should Trust the authenticity or legitimacy of a site because they have a free/trial automated process plain encryption certificate because it is from any particular vendor.]]> http://www.dslreports.com/forum/remark,22763042 Fri, 24 Jul 2009 23:06:15 EDT http://www.dslreports.com/forum/remark,22763013 SnowyOne :

said by Tordurbar :

Please re read the text you've quoted from the perspective of someone looking to Buy a cert.
Then the trust thing makes sense.
By 90+ % of browsers.

I'll trim my post to make my point clearer

from »www.instantssl.com/ssl-certifica···ssl.html

"- making our Web Server Certificates as trusted as the more expensive security from Verisign & Thawte.."

If your site cert does not imply trust then do not imply that it does.
I came across that link while researching the differences between an EV cert & a DV cert because I wasn't aware of the extent of differences between them prior to seeing this thread.
I believe a reasonable person could come away from that quote with the misconception that a Comodo site cert involves trust.
There were other instances of Comodo carelessly using the word "trust" in promotional material but thought one example would get my point across which is
"stop using the word trust in the context of a site cert"
it does nothing for user education.]]> http://www.dslreports.com/forum/remark,22763013 Fri, 24 Jul 2009 22:56:56 EDT http://www.dslreports.com/forum/remark,22762930 sded : "Creating trust online"? Not bloody likely. What one would expect from a company selling trust is a dialog like, "Some of our community says we have a problem, and are taking advantage of the less informed. Maybe we should look into it, maybe use our tools to triage the requests for certs and try to make sure we don't mislead and take advantage of the trust our users have in us." Instead we get the fabled lawyers response: "It is not really illegal/unethical. If it is illegal/unethical, everyone else is doing it too." And semantic excuses for the objections of users, former users, and certainly never-to-be-users. If Comodo can't lead by example, maybe they should at least tone down the rhetoric a bit.]]> http://www.dslreports.com/forum/remark,22762930 Fri, 24 Jul 2009 22:33:57 EDT http://www.dslreports.com/forum/remark,22762915 Tordurbar : Security that they aren't being eves dropped, due to the end to end SSL connection.
You know this stuff don't you.

PS. - It doesn't matter where they got the cert.
I don't care as I won't Trust strangers based on the padlock alone.]]> http://www.dslreports.com/forum/remark,22762915 Fri, 24 Jul 2009 22:30:46 EDT http://www.dslreports.com/forum/remark,22762906 Mele20 :

said by Tordurbar :

I on the other hand believe that everyone has a right to privacy and security through encryption.

But where is this "security" you feel "everyone" has a right to if you can't trust the issuer of the cert?
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson]]> http://www.dslreports.com/forum/remark,22762906 Fri, 24 Jul 2009 22:28:08 EDT http://www.dslreports.com/forum/remark,22762892 Tordurbar : Thanks hayc59,

And in retrospect I could have refrained myself, rather better.]]> http://www.dslreports.com/forum/remark,22762892 Fri, 24 Jul 2009 22:23:23 EDT http://www.dslreports.com/forum/remark,22762877 Tordurbar : Please re read the text you've quoted from the perspective of someone looking to Buy a cert.
Then the trust thing makes sense.
By 90+ % of browsers.]]> http://www.dslreports.com/forum/remark,22762877 Fri, 24 Jul 2009 22:19:43 EDT http://www.dslreports.com/forum/remark,22762863 Tordurbar : "Then there is no point to encryption so lets just do away with it entirely and then the "little" guy is on the same playing field as the big guy. As it is currently, I do not accept certs from GoDaddy because they provide certs to little guys and they cannot be trusted. I don't think little guys should be in this game in the first place. Certs imply trust and should be issued to banking sites and large merchant sites. I think you are the one engaging in abuse of this system by wanting to provide encryption to a little site for your friends to visit. That is NOT what this is supposed to be about."

I on the other hand believe that everyone has a right to privacy and security through encryption.
You need more "street smarts" than to decide to trust based on the padlock alone, and feel hurt or let down, based on a wrong from the start premise.

To the second paragraph,
Every business, government, organization that ever existed and involved humans has made a mistake.
Which they fixed and dealt with.
And it's good of them to pull the certs of bad actors (timely or otherwise) but if you used a proper means to ID who to Trust it wouldn't matter if they never pulled those certs would it.]]> http://www.dslreports.com/forum/remark,22762863 Fri, 24 Jul 2009 22:17:26 EDT http://www.dslreports.com/forum/remark,22762861 salzan :

said by Mele20 :

As it is currently, I do not accept certs from GoDaddy because they provide certs to little guys and they cannot be trusted. I don't think little guys should be in this game in the first place. Certs imply trust and should be issued to banking sites and large merchant sites.

So all the honest Mom amd Pop sites out there should just find new ways to make a living?]]> http://www.dslreports.com/forum/remark,22762861 Fri, 24 Jul 2009 22:16:47 EDT http://www.dslreports.com/forum/remark,22762682 mvdu : Mele understands completely and is right here.]]> http://www.dslreports.com/forum/remark,22762682 Fri, 24 Jul 2009 21:41:25 EDT http://www.dslreports.com/forum/remark,22762532 Tordurbar : Why is it so hard for you too understand.

DV Certs Do Not Imply Trust.
They provide a means of encrypting traffic.

Browsers 101 - What does that Padlock mean?
Answer - You have established an encrypted connection, Period.

It is someones fantasy that it means anything more, Period.

There are however higher levels of Certs wherein there is some veracity towards the site owners legitimacy.

It is you who insists to confuse the issue, by not recognizing the difference between Trust and Encryption.
And fails to recognize there is a visible difference in these levels of certification in the new browsers.
And insist on transposing the properties of High Assurance certs with those of Low Assurance certs, apparently overlooking the facts to further your argument.]]> http://www.dslreports.com/forum/remark,22762532 Fri, 24 Jul 2009 21:08:13 EDT http://www.dslreports.com/forum/remark,22762515 hayc59 : Tordurbar, Hello
As much as I would like to respond to some of your
statements I will refrain!
If this debate and MVP's opinions and quality of all
the knowledge put forth things like this would run a muck
since these issues have been brought up and put on front street...things at the Melih camp may really change??
I for one am very happy if it would ;)
--
ãrê ¥Øu êxpêriêncêD
Microsoft® MVP Consumer Security 2007-09
"Greater love has no one than this, that he lay down his life for his friends."
9/11/01 Never Forget]]> http://www.dslreports.com/forum/remark,22762515 Fri, 24 Jul 2009 21:04:03 EDT http://www.dslreports.com/forum/remark,22762511 SnowyOne :

said by Tordurbar :

I don't want to lose the ability for a little guy to provide encryption.
So I don't see a need for change other than to get people to STOP thinking encryption means trust.

I'd strongly suggest a change in how the word "trust" is associated with something that is to be untrusted, for starters.

from »www.instantssl.com/ssl-certifica···ssl.html

" InstantSSL enables web sites with SSL Certificates. SSL (Secure Sockets Layer) / TLS (Transport Layer Security) - the easily implemented standard protocol for transaction security - is an encrypted link between your Server and your Customer's browser. Once the link is established all communication between your Server and your Customer's browser will remain confidential.

InstantSSL Certificates deliver you Industry standard security and are trusted by 99.3% of the current browsers (see SSL Certificate browser compatibility details) - making our Web Server Certificates as trusted as the more expensive security from Verisign & Thawte (see SSL Certificate price comparison table).

If the site cert is not a measure of trust I suggest this edit: "...as UN-trusted as the more expensive security from Verisign & Thawte,..."]]> http://www.dslreports.com/forum/remark,22762511 Fri, 24 Jul 2009 21:03:32 EDT http://www.dslreports.com/forum/remark,22762413 Mele20 :

said by Tordurbar :

When properly notified they quickly pull bad actors certs.

I don't want to lose the ability for a little guy to provide encryption.
So I don't see a need for change other than to get people to STOP thinking encryption means trust.

Then there is no point to encryption so lets just do away with it entirely and then the "little" guy is on the same playing field as the big guy. As it is currently, I do not accept certs from GoDaddy because they provide certs to little guys and they cannot be trusted. I don't think little guys should be in this game in the first place. Certs imply trust and should be issued to banking sites and large merchant sites. I think you are the one engaging in abuse of this system by wanting to provide encryption to a little site for your friends to visit. That is NOT what this is supposed to be about.

Further, we have had proof posted here that Comodo does NOT act quickly to remove bad certs. Plus, even if they did they then go and sell another one to a known malware vendor. Only an idiot, or someone with something to hide, would defend Comodo's selling a cert to Eddy Nigg for Mozilla.com. If certs have nothing to do with TRUST then there is no reason whatsoever to have the system in place. It should be torn down and I have to assume that is what you are advocating because anything else makes no sense by virtue of your own statements.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson]]> http://www.dslreports.com/forum/remark,22762413 Fri, 24 Jul 2009 20:49:30 EDT http://www.dslreports.com/forum/remark,22761935 Tordurbar : They know the current system is susceptible to abuse.
They are one of the vendors actually trying to fix it.

Do you think they could fix the system by getting out of the Game.

When properly notified they quickly pull bad actors certs.

I don't want to lose the ability for a little guy to provide encryption.
So I don't see a need for change other than to get people to STOP thinking encryption means trust.]]> http://www.dslreports.com/forum/remark,22761935 Fri, 24 Jul 2009 19:12:02 EDT http://www.dslreports.com/forum/remark,22761916 Smokey Bear :

said by Tordurbar :

Some of your behaviors are making quite a joke out of being an MVP.

You can like it or not, but even MVPs have a right on having an opinion and to produce them in a way they desire. Like you produce your opinion also. :)
--
Smokey's Security Forums »www.smokey-services.eu/forums/
Smokey's Security Weblog »smokeys.wordpress.com/
Site Member ASAP - Alliance of Security Analysis Professionals]]> http://www.dslreports.com/forum/remark,22761916 Fri, 24 Jul 2009 19:05:41 EDT http://www.dslreports.com/forum/remark,22761904 Cudni : Just users need to learn, no need for Comodo to do the same?

Cudni]]> http://www.dslreports.com/forum/remark,22761904 Fri, 24 Jul 2009 19:00:59 EDT http://www.dslreports.com/forum/remark,22761827 Tordurbar : Let's get over join dates and post counts.

I remember many of you actors from my years at CastleCops.

I find it bothersome that some of you.
I felt, I somewhat knew are being sucked into this, completely wrong perception.

Comodo is a relatively small player in a huge Cert market.

The security suite is Top Notch.

The damn padlock means the connection is encrypted, nothing more.
Anyone in the world any day of the week can get a free/trial or even pay a small fee to get a cert that will enable encryption.
From any of the Cert Vendors.
For a DV there is no process in the industry to check anything other than that it is a valid domain and I have a means of payment.

Suppose I want to provide encryption for my friends on a little page I want to share.
Why should I, or Comodo, or any other cert provider have to go through an expensive bunch of background, criminal etc. checks
for a free or low cost cert that simply allows for encryption to take place.

Criminals abuse systems, that's how it is in the real world.

The padlock means you have an encrypted connection PERIOD.

It has never been stated or implied that there is any level of trust to be gleaned from an encrypted connection.
Again, Educate users.

Here is a short but interesting list.

»https://secureoem.com/shop/order/ Equifax
»https://secure.signupsecurity.com/p05/(S···in2.aspx GoDaddy.com, Inc.
»https://secure.yclinks.com/p05/(S(r02vzt···s&lng=en GoDaddy.com, Inc.
»https://secure-plus-payments.com/cgi-bin···advert=1 Thawte Consulting cc
»https://secure.cc-process24.com/ Equifax
»https://secure.mpsjoin.com/join/index.php Equifax Secure Inc.
»https://secure.payment-cc24.com/payment/···a0e4b772 Equifax secure.payment-cc24.com.p7c Session-based link. Redirected from: »pcsecurity09.com/buy.html
»https://1-vscodec-pro.com Thawte Consulting cc
»https://secure.onlineinternetpayments.com/billpav/? Thawte Consulting cc
»https://secure.innovagest2000.com/ GoDaddy.com, Inc.
»https://secure.paysecorder.com/order?agr···.0&butt= Equifax Secure Inc.

So in your perfect world, you should remove all CA's from your browsers, as they are all in the same business, and susceptible to the same abuse by bad actors.

In the same way Fords military weapons division is separate from their auto manufacturing division.
Comodo being in the cert business, has really no bearing on the fact that they provide a free top notch security suite, also they do provide a means through Verification Engine (also a freebie) for anyone to be able to tell a simple encryption DV cert from a high assurance EV cert.

You can report rogue sites abusing the system here.
»www.ccssforum.org/report.php

You can educate users about the colored address bars in the new browsers.
You can educate users about what the padlock really means and implies.

But please get a grip and give up this misguided and asinine holier than thou crusade.
Some of your behaviors are making quite a joke out of being an MVP.

In closing. Hate the Game not the Player.
Hate the system, work to change it.
Singling out Comodo and bashing away like some insist on doing just makes me embarrassed for you.
And to wonder what your real issue is.

M'kay Bye

]]> http://www.dslreports.com/forum/remark,22761827 Fri, 24 Jul 2009 18:37:07 EDT http://www.dslreports.com/forum/remark,22752879 fphall :

said by mers2 :

Why do I get the feeling they've been talking about us in the Comodo forums?

Who cares? Let 'em talk. ;-)]]> http://www.dslreports.com/forum/remark,22752879 Thu, 23 Jul 2009 09:00:44 EDT http://www.dslreports.com/forum/remark,22752526 Mele20 : Here's a FAKE Avira site just reported to Avira. The main page is not SSL but the joinup page is and guess who issued the cert? Comodo. :mad:

»avira2009.free4ail.info/index.php
»https://secure.ordersarea.com/?siteid=23···g&tid=no

Both pages trace to vanmembers.com which is registered to someone in Fuzhou, Fujian, China.

I didn't follow all the way through because I don't have a bunch of email addresses to waste.

The 24 hour live support that you get (only antivirus site on the net with 24 hour live support!!! so claims the site) when you join turns out to be a website that hasn't been updated in 377 days, is worth an estimated $149 and traces to a United Kingdom address.

This sort of thing really stinks. I'd like to see Avira (who seems to be the butt of a lot of this crap because they have a popular free antivirus program) join with concerned parties to get Comodo's certs yanked.


--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson]]> http://www.dslreports.com/forum/remark,22752526 Thu, 23 Jul 2009 05:22:30 EDT http://www.dslreports.com/forum/remark,22741224 Cudni :

said by danny9 :

said by mers2 :

Why do I get the feeling they've been talking about us in the Comodo forums?

Birds do have an acute sense of their surroundings so you are probably right! :)

with all the cats around birds have to be right

Cudni]]> http://www.dslreports.com/forum/remark,22741224 Tue, 21 Jul 2009 06:25:10 EDT http://www.dslreports.com/forum/remark,22741207 danny9 :

said by mers2 :

Why do I get the feeling they've been talking about us in the Comodo forums?

Birds do have an acute sense of their surroundings so you are probably right! :)]]> http://www.dslreports.com/forum/remark,22741207 Tue, 21 Jul 2009 06:05:07 EDT http://www.dslreports.com/forum/remark,22741152 mers2 : Why do I get the feeling they've been talking about us in the Comodo forums? ]]> http://www.dslreports.com/forum/remark,22741152 Tue, 21 Jul 2009 05:15:52 EDT http://www.dslreports.com/forum/remark,22740910 GuruGuy :

said by danny9 :

said by Tordurbar :

Why are they doing nothing? Why don't Mozilla and Microsoft get together on this and act jointly?

Because half a dozen misguided FUDsters repeating and spreading the same lame "problem", hardly constitutes a groundswell of opposition.

If people truly understood the values, implications, inherent weaknesses, of the various types of certs, and of the certification system itself. And gave up on the holier than thou bunk.
They may find that until EV certs are no more, user education is the key.

Oh well, at least the passion with which the haters bash away at Comodo is inspiring.
Perhaps put some of that energy into lernin n such.

This is kinda funny.
You join on the 12th of July and make only 2 posts and they're both here.
Then to top it off you bash us-"misguided FUDsters" without even knowing who we are.
Many here are very knowledgeable and intelligent.
They are just reporting the facts to what Comodo is doing and which Melih admits too.

"haters bash away at Comodo"
Sorry to burst your bubble but we don't hate Comodo.
I did use CIS for awhile and thought it did a good job.
But liking a product is not enough.
I think you have to trust them also. That they are doing the best possible job to protect your system.
Comodo took that away.

I think it's pretty obvious why you are here and I do apologise if I am wrong.

At the same time I have to thank you.
Your post put us back at the top of page 1! :)

Well said!
--
GuruGuy]]> http://www.dslreports.com/forum/remark,22740910 Tue, 21 Jul 2009 01:56:57 EDT http://www.dslreports.com/forum/remark,22739993 danny9 :

said by Tordurbar :

Why are they doing nothing? Why don't Mozilla and Microsoft get together on this and act jointly?

Because half a dozen misguided FUDsters repeating and spreading the same lame "problem", hardly constitutes a groundswell of opposition.

If people truly understood the values, implications, inherent weaknesses, of the various types of certs, and of the certification system itself. And gave up on the holier than thou bunk.
They may find that until EV certs are no more, user education is the key.

Oh well, at least the passion with which the haters bash away at Comodo is inspiring.
Perhaps put some of that energy into lernin n such.

This is kinda funny.
You join on the 12th of July and make only 2 posts and they're both here.
Then to top it off you bash us-"misguided FUDsters" without even knowing who we are.
Many here are very knowledgeable and intelligent.
They are just reporting the facts to what Comodo is doing and which Melih admits too.

"haters bash away at Comodo"
Sorry to burst your bubble but we don't hate Comodo.
I did use CIS for awhile and thought it did a good job.
But liking a product is not enough.
I think you have to trust them also. That they are doing the best possible job to protect your system.
Comodo took that away.

I think it's pretty obvious why you are here and I do apologise if I am wrong.

At the same time I have to thank you.
Your post put us back at the top of page 1! :)
--
"In times of universal deceit, telling the truth becomes a revolutionary act.."
George Orwell]]> http://www.dslreports.com/forum/remark,22739993 Mon, 20 Jul 2009 21:56:09 EDT http://www.dslreports.com/forum/remark,22739619 Tordurbar : Was an edit - found button. So Blah.]]> http://www.dslreports.com/forum/remark,22739619 Mon, 20 Jul 2009 20:45:29 EDT http://www.dslreports.com/forum/remark,22739582 Tordurbar : Why are they doing nothing? Why don't Mozilla and Microsoft get together on this and act jointly?

Because half a dozen misguided FUDsters repeating and spreading the same lame "problem", hardly constitutes a groundswell of opposition.

If people truly understood the values, implications, inherent weaknesses, of the various types of certs, and of the certification system itself. And gave up on the holier than thou bunk.
They may find that until DV certs are no more, user education is the key.

Oh well, at least the passion with which the haters bash away at Comodo is inspiring.
Perhaps put some of that energy into lernin n such.]]> http://www.dslreports.com/forum/remark,22739582 Mon, 20 Jul 2009 20:37:10 EDT http://www.dslreports.com/forum/remark,22728466 hayc59 : Thanks Mele20!! :D]]> http://www.dslreports.com/forum/remark,22728466 Sat, 18 Jul 2009 09:43:35 EDT http://www.dslreports.com/forum/remark,22728441 Mele20 : This is why users have to block ALL Comodo certs in all their browsers. I did this from the blog and click where it says and "here":

"You can see the Comodo certificate for freemjlitho.com both in the screenshot top left, and here."

You can see from my screenshots what happened. There is no way I would go to that site and fall for a phishing scheme after Fx warned me. But if I had not blocked all Comodo and GoDaddy certs last year ....well, if I was a big Michael Jackson fan, I might have fallen for it.

Mozilla really needs to yank the Comodo certs. I don't think any other solution will be satisfactory. Mozilla needs to step up to the plate and bite the bullet. I single out Mozilla and their browsers because it was Mozilla that was made to look the fool last December when Eddy Nigg of StartCom was able to buy a Mozilla.com cert from a Comodo reseller and he has nothing to do with Mozilla organization. Mozilla should be the leader here and do the right thing.

I don't know if it is allowable to quote an entire news group message in a forum like this or not but "Facts about Comodo Resellers and RAs" by Eddy Nigg on December 24, 2008 in the mozilla.dev.tech.crypto News Group is educational. One thing he states in this message is that not only has Mozilla, before the incident in December regarding him buying the mozilla cert, expressed considerable concern regarding Comodo certs in Mozilla browsers but MICROSOFT has received MANY complaints about Comodo being allowed as a root cert authority in Internet Explorer. Microsoft has even more clout and ability to yank certs. Why are they doing nothing? Why don't Mozilla and Microsoft get together on this and act jointly?
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason

]]> http://www.dslreports.com/forum/remark,22728441 Sat, 18 Jul 2009 09:33:35 EDT http://www.dslreports.com/forum/remark,22728255 hayc59 : It just keeps on rollin!! ;)
»hphosts.blogspot.com/2009/07/mic···ing.html]]> http://www.dslreports.com/forum/remark,22728255 Sat, 18 Jul 2009 07:58:42 EDT http://www.dslreports.com/forum/remark,22704083 maximusqb : I still use and like Comodo firewall with D+. I am not concerned that they have an option to install the toolbar during install as it is easy enough to uncheck it. I have multiple home computers and Comodo Firewall is what I use on the majority of them b/c it seems to work best with whatever other software I use. I have a lifetime 3 user license of Outpost firewall pro too, but I am not even using all licenses b/c I find I prefer Comodo and use that instead. As far as the Certs issue goes, I guess it doesn't bother me too much as I still use their product. ]]> http://www.dslreports.com/forum/remark,22704083 Tue, 14 Jul 2009 03:32:04 EDT http://www.dslreports.com/forum/remark,22703347 Surfinusa :

said by poppster :

said by Surfinusa :

said by jp10558 :

I know this isn't a popular view here, but I still recommend CIS, and have yet to see a better free app for layered security.

Agreed I still use and like Comodo.

Use it on my wife's machine and it's great!
Light on resources, tons of options, and no nag screen!

Light on resource is one of the main draws for me, that and a very configurable firewall.

Uninstalling is also a snap, try uninstalling NIS or KAV takes a while and tons of junk left in registry.

While the anti-virus in CIS might not be ground breaking it doesn't hurt to use common sense when looking around on the net and downloading files.

CIS updates frequently also.]]> http://www.dslreports.com/forum/remark,22703347 Mon, 13 Jul 2009 22:52:25 EDT http://www.dslreports.com/forum/remark,22703237 therube :

said by "Cudni" :

---

You don't invite site hacking even with a wink especially not as a moderator...

---

Of course you don't. But as he pointed out, he's a moderator, nothing more, nothing less. And he's entitled (just as I am, as I am a moderator too, elsewhere) to make any silly comments (but hopefully not) and just as the rest of us can post silly comments too.

BTW, Mozilla still is unresolved on the issue of "Comodo". (I believe this to be the Bug 470897 - Investigate incident with CA that allegedly issued bogus cert for www.mozilla.com.)

quote:

---

Gee, I can't go there and read any of Melih's ridiculous statements....I wonder why?

---

@Mele20, actually you can, if you wanted to. Now you post that in jest (I suppose), but by not going there, are you limiting or biasing your understanding? Or by going, would it be further clarified - even if your opinion remains the same? Or do you know enough about the situation not to even be bothered? (I'm not really looking for an answer.)]]> http://www.dslreports.com/forum/remark,22703237 Mon, 13 Jul 2009 22:32:45 EDT http://www.dslreports.com/forum/remark,22702542 poppster :

said by Surfinusa :

said by jp10558 :

I know this isn't a popular view here, but I still recommend CIS, and have yet to see a better free app for layered security.

Agreed I still use and like Comodo.

Use it on my wife's machine and it's great!
Light on resources, tons of options, and no nag screen!
--
What else would you do?
--
There is hope!]]> http://www.dslreports.com/forum/remark,22702542 Mon, 13 Jul 2009 20:16:40 EDT http://www.dslreports.com/forum/remark,22702294 Nanoprobe :

said by jp10558 :

I know this isn't a popular view here, but I still recommend Comodo Internet Security, and have yet to see a better free app for layered security.

And therein lies part of the problem IMHO. Using one company or suite for your layered protection usually means there are issues and what has happened to Comodo is a prime example. Symantec is another. What started out as good companies with good products went south as they acquired other vendors and tried to be the all in one solution.
--
The circumstances of life, the events of life, and the people around me in life, do not make me the way I am, but reveal the way I am. Dr. Sam Peeples.
]]> http://www.dslreports.com/forum/remark,22702294 Mon, 13 Jul 2009 19:22:54 EDT http://www.dslreports.com/forum/remark,22702137 Grail Knight :

quote:

---

Not all CEOs act unprofessional and not grown up like Melih does, though.

---

Did I say all CEOs were like this? That answer would be no.

Edit* If you were not replying to me disregard.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22702137 Mon, 13 Jul 2009 18:54:30 EDT http://www.dslreports.com/forum/remark,22701570 mvdu : Not all CEOs act unprofessional and not grown up like Melih does, though.

I'll never be convinced to use Comodo unless changes are made. That's my prerogative. There are plenty of good reasons why Comodo isn't upholding "trust online." There's no smear campaign.]]> http://www.dslreports.com/forum/remark,22701570 Mon, 13 Jul 2009 17:12:22 EDT http://www.dslreports.com/forum/remark,22700639 Grail Knight : Still does not mean to much to me other then someone made an off color remake.
Wow! The end of the world is near now because of that.

Note my sarcasm because it appears some people have evidently never seen a president of a company get pissed or make rude comments and customers that overheard it then either move on or stay out of because they do not know the whole story.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22700639 Mon, 13 Jul 2009 15:00:13 EDT http://www.dslreports.com/forum/remark,22700116 Surfinusa :

said by jp10558 :

I know this isn't a popular view here, but I still recommend CIS, and have yet to see a better free app for layered security.

Agreed I still use and like Comodo.]]> http://www.dslreports.com/forum/remark,22700116 Mon, 13 Jul 2009 13:50:49 EDT http://www.dslreports.com/forum/remark,22700107 MarkAW :

said by Grail Knight :

So Comodo has one person in the entire company and only one department?

No Comodo does not have one person in the company, but the company was started by Melih and the problem is how Melih has been handling all this. Like Cudni says and quote "and that is the potential issue if the some of the public equates his personality negatively to the whole company. It damages their good work and sullies their reputation."
--
The greatest mistake you can make in life is to be continuously fearing you will make one.

Next to knowing when to seize an opportunity, the most important thing in life is knowing when to forego an advantage.]]> http://www.dslreports.com/forum/remark,22700107 Mon, 13 Jul 2009 13:49:29 EDT http://www.dslreports.com/forum/remark,22700095 jp10558 : Maybe it's just me, but the sudden and continued attacks on Comodo (and not other cert vendors, or other toolbar bundlers) smell like some sort of smear campaign to me. Heck, Java is now trying to install a McAffee trial.

And so far, most of the so called trust violations seem to me to be
a) normal business practice in the industry they are related to
and
b) simple enough to deal with

I know this isn't a popular view here, but I still recommend Comodo Internet Security, and have yet to see a better free app for layered security.
--
Opera 9.62(Build 10467); Windows XP Pro SP3;Intel C2Q6600; 3GB DDR2 1066; 1M/128k DSL; Antivir Personal; Comodo Firewall Pro 3;Proxomitron 4.5j Sidki 2008beta,GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,22700095 Mon, 13 Jul 2009 13:47:55 EDT http://www.dslreports.com/forum/remark,22699528 Grail Knight : I saw those yesterday.

Remember they were posted later in the day EST.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22699528 Mon, 13 Jul 2009 12:15:32 EDT http://www.dslreports.com/forum/remark,22699505 Grail Knight : So Comodo has one person in the entire company and only one department?
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22699505 Mon, 13 Jul 2009 12:12:08 EDT http://www.dslreports.com/forum/remark,22699207 Cudni :

said by hayc59 :

Melih is the company!!!

and that is the potential issue if the some of the public equates his personality negatively to the whole company. It damages their good work and sullies their reputation.

cudni
--
"what we know we know the same, what we don't know, we don't know it differently."
Help yourself so God can help you.
Microsoft MVP, 2006 - 2009]]> http://www.dslreports.com/forum/remark,22699207 Mon, 13 Jul 2009 11:31:25 EDT http://www.dslreports.com/forum/remark,22699173 hayc59 : LOL
Melih is the company!!!]]> http://www.dslreports.com/forum/remark,22699173 Mon, 13 Jul 2009 11:26:48 EDT http://www.dslreports.com/forum/remark,22699168 Grail Knight : Do tell what it stands for....again and again.

One part of a company screws up and the other turns out good software. I though we established that yesterday.

It was also agreed that one does not judge a whole company based on a screw up of on part of it.

Yawn...
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22699168 Mon, 13 Jul 2009 11:26:11 EDT http://www.dslreports.com/forum/remark,22699158 hayc59 :

said by Grail Knight :

Well if you read what is being said at Comodo and what this Donna is saying there are two opposing stories of which you get to believe one side or the other or both.

Grail you need to start doing some reading...please :)

»www.calendarofupdates.com/update···try84205

»hphosts.blogspot.com/2009/07/com···and.html
--
ãrê ¥Øu êxpêriêncêD
Microsoft® MVP Consumer Security 2007-09
"Greater love has no one than this, that he lay down his life for his friends."
9/11/01 Never Forget]]> http://www.dslreports.com/forum/remark,22699158 Mon, 13 Jul 2009 11:24:16 EDT http://www.dslreports.com/forum/remark,22699145 hayc59 :

said by Grail Knight :

I have seen both sides of the coin.

If I was Melih and someone was not reporting the whole story I would make some off color comment also.

The whole story is being published, just some folks cant or wont except it for what it stands for!!!
--
ãrê ¥Øu êxpêriêncêD
Microsoft® MVP Consumer Security 2007-09
"Greater love has no one than this, that he lay down his life for his friends."
9/11/01 Never Forget]]> http://www.dslreports.com/forum/remark,22699145 Mon, 13 Jul 2009 11:22:20 EDT http://www.dslreports.com/forum/remark,22699141 Grail Knight : Well if you read what is being said at Comodo and what this Donna is saying there are two opposing stories of which you get to believe one side or the other or both.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22699141 Mon, 13 Jul 2009 11:21:58 EDT http://www.dslreports.com/forum/remark,22698952 MarkAW :

said by Grail Knight :

I have seen both sides of the coin.

If I was Melih and someone was not reporting the whole story I would make some off color comment also.

Ok then what is the whole story, is Comodo doing what is being spread all over the net or are people wrong in saying what is be spread over the net? Inquiring minds would love to know.
--
The greatest mistake you can make in life is to be continuously fearing you will make one.

Next to knowing when to seize an opportunity, the most important thing in life is knowing when to forego an advantage.]]> http://www.dslreports.com/forum/remark,22698952 Mon, 13 Jul 2009 10:54:22 EDT http://www.dslreports.com/forum/remark,22698900 Grail Knight : I have seen both sides of the coin.

If I was Melih and someone was not reporting the whole story I would make some off color comment also.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22698900 Mon, 13 Jul 2009 10:49:54 EDT http://www.dslreports.com/forum/remark,22698247 cork1958 : Personally,
Most av's AND firewalls have been going downhill for a long time. They are so bloated trying to protect you against everything under the sun, they have made themselves second rate!
--
The Firefox alternative.
»www.mozilla.org/projects/seamonkey/]]> http://www.dslreports.com/forum/remark,22698247 Mon, 13 Jul 2009 09:28:39 EDT http://www.dslreports.com/forum/remark,22697976 mers2 : I've worked for a few pompous jerks - but they knew how to behave when around customers. ]]> http://www.dslreports.com/forum/remark,22697976 Mon, 13 Jul 2009 08:24:07 EDT http://www.dslreports.com/forum/remark,22697923 Nanoprobe : Comodo has more issues than just certs. What used to be a good product has become bloatware IMHO.

I'm done with Comodo FW
--
The circumstances of life, the events of life, and the people around me in life, do not make me the way I am, but reveal the way I am. Dr. Sam Peeples.
]]> http://www.dslreports.com/forum/remark,22697923 Mon, 13 Jul 2009 08:04:57 EDT http://www.dslreports.com/forum/remark,22697795 Grail Knight : Funny I have worked at companies that presidents and owners act the same way but they were serious about their products and their companies profits showed that.

I take it you have never worked for or met people like that?
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22697795 Mon, 13 Jul 2009 06:48:01 EDT http://www.dslreports.com/forum/remark,22697674 Khaine :

said by VikingBob :

Comodo really needs to smarten up... :uhh:

I think its too late. Security is all about trust, and how can we trust them now?]]> http://www.dslreports.com/forum/remark,22697674 Mon, 13 Jul 2009 04:25:53 EDT http://www.dslreports.com/forum/remark,22697640 mers2 :

said by Grail Knight :

quote:

---

Donna is not involved.

---

Based on what?

Actually it does not matter that is between them.
As long as Comodo firewall is running fine it is a keeper for me.

I have yet to see a company where managers, VPs, or Presidents do not get in shouting matches. It is called business.

Edit* Strike.

Melih takes bad behavior at other people's forums to a new level. AFAIK, he's been banned at a couple for his rants. That's not good business practice. But most folks use his products because they're free, so he doesn't have to worry about lost sales from security customers - and that attitude shows.
--
"The best proof there is intelligent life in outer space is the fact it hasn't come here." Arthur C. Clark 1917-2008
Team Discovery
]]> http://www.dslreports.com/forum/remark,22697640 Mon, 13 Jul 2009 03:44:49 EDT http://www.dslreports.com/forum/remark,22697604 Mele20 : Gee, I can't go there and read any of Melih's ridiculous statements....I wonder why? :o :p ;)

]]> http://www.dslreports.com/forum/remark,22697604 Mon, 13 Jul 2009 03:16:23 EDT http://www.dslreports.com/forum/remark,22697036 hayc59 :

said by ColdinCbus :

Donna is not involved. He is confusing two other people with Donna. I think he may be confused as to where he is posting stuff too.

He is very confused and getting more and more every month]]> http://www.dslreports.com/forum/remark,22697036 Sun, 12 Jul 2009 23:02:45 EDT http://www.dslreports.com/forum/remark,22696957 Grail Knight :

quote:

---

Donna is not involved.

---

Based on what?

Actually it does not matter that is between them.
As long as Comodo firewall is running fine it is a keeper for me.

I have yet to see a company where managers, VPs, or Presidents do not get in shouting matches. It is called business.

Edit* Strike.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22696957 Sun, 12 Jul 2009 22:41:19 EDT http://www.dslreports.com/forum/remark,22696943 ColdinCbus : Donna is not involved. He is confusing two other people with Donna. I think he may be confused as to where he is posting stuff too.
--
Team Discovery Project Hope]]> http://www.dslreports.com/forum/remark,22696943 Sun, 12 Jul 2009 22:37:00 EDT http://www.dslreports.com/forum/remark,22696528 Grail Knight : Which is exactly how I see Melih's comment.]]> http://www.dslreports.com/forum/remark,22696528 Sun, 12 Jul 2009 20:44:44 EDT http://www.dslreports.com/forum/remark,22696442 Cudni :

said by Grail Knight :

Ronald Reagan said at a news conference, "The bombing of Russia begins in 5 minutes" and an open mike caught it. Do you think he meant to follow though? Hardly.

the Russians pissed him off being red so can I can't blame him either. The old President had good advisers though, some being in charge of public relations, clever people those.

Cudni
--
"what we know we know the same, what we don't know, we don't know it differently."
Help yourself so God can help you.
Microsoft MVP, 2006 - 2009]]> http://www.dslreports.com/forum/remark,22696442 Sun, 12 Jul 2009 20:19:53 EDT http://www.dslreports.com/forum/remark,22696428 ashrc4 : »forums.comodo.com/general_discus···3.0.html

"Endymion
Comodo's Hero
*****
Reality is subordinate to perception"

Good to see all the different parties over a comodo can get together and resolve their issues.
Perhaps they could help those wishing to persue what they see as a company not taking their responsibilty in the public arena seriusly enough and lead by example.
The thread mentioned above is aptly titled "HERE WE GO AGAIN"
Some might prefer that this threads title becomes "Comodo CONTINUES to damage peoples reputation" :)
--
It's one thing to be sure of yourself. It's another to confuse people. If they weren't related to each other we wouldn't have a problem;~)]]> http://www.dslreports.com/forum/remark,22696428 Sun, 12 Jul 2009 20:15:07 EDT http://www.dslreports.com/forum/remark,22696366 Grail Knight : Ronald Reagan said at a news conference, "The bombing of Russia begins in 5 minutes" and an open mike caught it. Do you think he meant to follow though? Hardly.

I am curious though if Donna is indeed not telling the full story to perpetuate some odd dislike of Comodo or Melih and if so I do not blame Melih for being pissed.

Edit* changed anyone to user name.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22696366 Sun, 12 Jul 2009 19:55:32 EDT http://www.dslreports.com/forum/remark,22695992 hayc59 :

said by Cudni :

You don't invite site hacking even with a wink especially not as a moderator of a security software forum nor do you accuse somebody of being paid for posting their opinion certainly not if being a CEO. He could have said mea culpa and promise such oversights, with certs, will not happen again but instead he opts for a fight and insults?

Cudni

»hphosts.blogspot.com/2009/07/com···and.html
--
ãrê ¥Øu êxpêriêncêD
Microsoft® MVP Consumer Security 2007-09
"Greater love has no one than this, that he lay down his life for his friends."
9/11/01 Never Forget]]> http://www.dslreports.com/forum/remark,22695992 Sun, 12 Jul 2009 18:09:28 EDT http://www.dslreports.com/forum/remark,22695900 Cudni : You don't invite site hacking even with a wink especially not as a moderator of a security software forum nor do you accuse somebody of being paid for posting their opinion certainly not if being a CEO. He could have said mea culpa and promise such oversights, with certs, will not happen again but instead he opts for a fight and insults?

Cudni
--
"what we know we know the same, what we don't know, we don't know it differently."
Help yourself so God can help you.
Microsoft MVP, 2006 - 2009]]> http://www.dslreports.com/forum/remark,22695900 Sun, 12 Jul 2009 17:49:23 EDT http://www.dslreports.com/forum/remark,22695859 therube : And I was just going to post, "doesn't anyone bother to read the Comments". I'm glad you did.

Anyhow, I don't know enough about this stuff to have a good enough understanding to know what is right & what is wrong, but doesn't that comodo forum thread make the msmvps blog report just a little bit suspect?

As far as "threats", do note the smilies (which likely are not going to show up here):

quote:

---

We should hack her site and post the truth :Cool:

Just joking :Angel:

---

]]> http://www.dslreports.com/forum/remark,22695859 Sun, 12 Jul 2009 17:36:54 EDT http://www.dslreports.com/forum/remark,22695840 hayc59 : »forums.comodo.com/general_discus···3.0.html
Now nice threats at Donna eh....great Mods and Melih your stand-up dude!! NOT]]> http://www.dslreports.com/forum/remark,22695840 Sun, 12 Jul 2009 17:30:40 EDT http://www.dslreports.com/forum/remark,22695783 Cudni : and some other things toolbars and stuff ;)
»www.wilderssecurity.com/showthre···t=247725

Cudni]]> http://www.dslreports.com/forum/remark,22695783 Sun, 12 Jul 2009 17:14:31 EDT http://www.dslreports.com/forum/remark,22693707 ashrc4 : Ok let me understand this.
Comodo is a security company and an issuer of certs.
A compeditor (cough) Malware destructor 2009 asks for a cert.
Am i missing something here!!
How long have they been in business and how stupid do they take (us)
--
It's one thing to be sure of yourself. It's another to confuse people. If they weren't related to each other we wouldn't have a problem;~)]]> http://www.dslreports.com/forum/remark,22693707 Sun, 12 Jul 2009 02:15:32 EDT http://www.dslreports.com/forum/remark,22693412 Grail Knight : That is true of course but I have to separate Comodo into departments w/ one side being the developers turning out a solid firewall and the other selling certs to unsavory types which I have seen firsthand happen before. I will not judge the company as a whole to be bad based on that. I would run out of companies to do business with.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22693412 Sun, 12 Jul 2009 00:02:19 EDT http://www.dslreports.com/forum/remark,22693137 hayc59 :

said by Grail Knight :

I do not know anyone personally so I have to go on judgment although I know I have never had any issues with Comodo software yet had problems with so called "recommended products" by some members.

It is a giant crap shoot. :D

Grail Knight...you are correct for sure, but atleast
you want Honesty and Integrety from a company
even if they give it away ;)
--
ãrê ¥Øu êxpêriêncêD
Microsoft® MVP Consumer Security 2007-09
"Greater love has no one than this, that he lay down his life for his friends."
9/11/01 Never Forget]]> http://www.dslreports.com/forum/remark,22693137 Sat, 11 Jul 2009 22:37:09 EDT http://www.dslreports.com/forum/remark,22693102 Grail Knight : I do not know anyone personally so I have to go on judgment although I know I have never had any issues with Comodo software yet had problems with so called "recommended products" by some members.

It is a giant crap shoot. :D
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22693102 Sat, 11 Jul 2009 22:29:21 EDT http://www.dslreports.com/forum/remark,22692826 Its a Secret : Always a pleasure.

All a certificate issuer does is verify that a person or organisation is who they say they are. Most have strict rules around that including lawyers, Notary Publics etc. and when, and only when, they are verified is a cert issued. Commercial certs are not cheap and for good reason.

There is a multitude of trust placed in these companies, and we can only hope the trust is not misplaced.
--
"In the future, that which is not mandatory will be illegal"
"Nobody knows the age of the human race, but everybody agrees that it is old enough to know better" - Anonymous]]> http://www.dslreports.com/forum/remark,22692826 Sat, 11 Jul 2009 21:10:32 EDT http://www.dslreports.com/forum/remark,22692809 onDvine :

said by Its a Secret :

... Try this for an explaination: »translate.google.ca/translate?hl···26sa%3DG ...

Thank you. :) It looks like a very good explanation, if only I understood it. Am not among DSLR's more tech-savvy members.

... however, you never know, do you? ...

Some others here might; I don't. I see so many unfamiliar names that are tempting to disable if checked, but experience has taught me not to check or uncheck stuff without knowing WTF I'm doing. ;)

... You can always view the certificate though, if you have any doubts.

I did and as with the linked explanation, don't understand it. :uhh: Maybe one of these days I'll ask about certificates in the Mozilla section. Thanks again for your time and attention.]]> http://www.dslreports.com/forum/remark,22692809 Sat, 11 Jul 2009 21:06:04 EDT http://www.dslreports.com/forum/remark,22692726 Its a Secret :

said by onDvine :

I don't speak Spanish or go to Spanish language sites but hesitated to uncheck them because I don't understand what the heck any of the certificates are about/for. :huh: Does anybody know if they're needed?

Try this for an explaination: »translate.google.ca/translate?hl···26sa%3DG

It looks like this cert issuer can verify ONLY web sites and email (i.e. encrypted or signed email), not software.

I tend to think this may be getting a bit overblown as an issue, however, you never know, do you?

You can always view the certificate though, if you have any doubts.
--
"In the future, that which is not mandatory will be illegal"
"Nobody knows the age of the human race, but everybody agrees that it is old enough to know better" - Anonymous]]> http://www.dslreports.com/forum/remark,22692726 Sat, 11 Jul 2009 20:39:15 EDT http://www.dslreports.com/forum/remark,22692674 onDvine :

said by Pentangle :

... What about the very large number of certificate authorities that are built into Firefox? Are they all considered to be safe?

I wondered that, too. Never looked there before and don't recognize most of the names. I have no dealings with America Online Inc. and unchecked boxes for their certificates shown in the screen snapshot above. The three two for AOL Time Warner Inc. had no boxes checked.

Below that is one in Spanish with two boxes out of three checked (detail shown in the screen snapshot above). I don't speak Spanish or go to Spanish language sites but hesitated to uncheck them because I don't understand what the heck any of the certificates are about/for. :huh: Does anybody know if they're needed?

Sorry the above veers slightly off-topic: not about the Comodo certificates.

]]> http://www.dslreports.com/forum/remark,22692674 Sat, 11 Jul 2009 20:22:32 EDT http://www.dslreports.com/forum/remark,22692617 danny9 :

said by Grail Knight :

Thanks.

I had followed some of the threads at Wilders but I will still use Comodo Firewall. It works and as I know other software security vendors and OS developers have taken time to fix issues I will give Comodo the benefit of the doubt for a little while longer.

You're welcome!

Yes, the firewall does work and very well, especially for a free one.

I could be totally wrong here but after reading Melih's comments in his forums, he just does not seem like the type of guy who can ever admit he was wrong. :)
--
"In times of universal deceit, telling the truth becomes a revolutionary act.."
George Orwell]]> http://www.dslreports.com/forum/remark,22692617 Sat, 11 Jul 2009 20:03:41 EDT http://www.dslreports.com/forum/remark,22692403 Grail Knight : Thanks.

I had followed some of the threads at Wilders but I will still use Comodo Firewall. It works and as I know other software security vendors and OS developers have taken time to fix issues I will give Comodo the benefit of the doubt for a little while longer.
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22692403 Sat, 11 Jul 2009 18:57:01 EDT http://www.dslreports.com/forum/remark,22692394 Its a Secret : That's a good question. I guess we'll find out if the worm turns to bite us.]]> http://www.dslreports.com/forum/remark,22692394 Sat, 11 Jul 2009 18:53:49 EDT http://www.dslreports.com/forum/remark,22692383 Pentangle :

said by Its a Secret :

In FF, it's under Tools|Options|Advanced|Encryption and then view certificates. Find Comodo, and click edit for each of them and uncheck the boxes.

What about the very large number of certificate authorities that are built into Firefox? Are they all considered to be safe?
--
Knowledge is learning something new every day. Wisdom is letting go of something every day.
]]> http://www.dslreports.com/forum/remark,22692383 Sat, 11 Jul 2009 18:51:06 EDT http://www.dslreports.com/forum/remark,22692370 danny9 :

said by Grail Knight :

quote:

---

Can you honestly say you would trust Comodo to protect you when at the same time they are issuing certificates to malware sit

---

Why yes I will. I doubt developers at Comodo sell certs any more then a non-music devision at Sony had anything to do with rootkits on CDs not that long ago or MS waiting seven years to fix a critical security issue (Update, MS08-068).

quote:

---

They have been told about this but continue to ignore it hoping it will go away. It won't.

---

Do you know for a fact Comodo is doing what you said or just assuming this to be the case?

You must have missed all the threads regarding this here and at Wilders and COU.
Melih himself has admitted doing this and was discussed in the Comodo forums.
Here's a thread running at COU:

»www.calendarofupdates.com/update···ic=19279

Hope that gives you more insight into this issue. :)
--
"In times of universal deceit, telling the truth becomes a revolutionary act.."
George Orwell]]> http://www.dslreports.com/forum/remark,22692370 Sat, 11 Jul 2009 18:48:19 EDT http://www.dslreports.com/forum/remark,22692237 Grail Knight :

quote:

---

Can you honestly say you would trust Comodo to protect you when at the same time they are issuing certificates to malware sit

---

Why yes I will. I doubt developers at Comodo sell certs any more then a non-music devision at Sony had anything to do with rootkits on CDs not that long ago or MS waiting seven years to fix a critical security issue (Update, MS08-068).

quote:

---

They have been told about this but continue to ignore it hoping it will go away. It won't.

---

Do you know for a fact Comodo is doing what you said or just assuming this to be the case?
--
One good conspiracy theory deserves another.]]> http://www.dslreports.com/forum/remark,22692237 Sat, 11 Jul 2009 18:06:07 EDT http://www.dslreports.com/forum/remark,22692010 mvdu : See CalendarOfUpdates. Other providers are taking better steps:

»www.calendarofupdates.com/update···9&st=200

I do not trust it and that is my personal decision.]]> http://www.dslreports.com/forum/remark,22692010 Sat, 11 Jul 2009 17:08:16 EDT http://www.dslreports.com/forum/remark,22691277 CylonRed :

said by danny9 :

said by Trel :

Isn't EVERY issuer doing this, and the only reason Comodo's come under fire for it because they also have a line of security products?

Can you honestly say you would trust Comodo to protect you when at the same time they are issuing certificates to malware sites?

Sounds like they're trying to have their cake and eat it too which is philosophically impossible.

They have been told about this but continue to ignore it hoping it will go away. It won't.

I am one of those users, I was running CIS, that will no longer use any Comodo product on my computers.

They may have started out with the right idea but money became the name of the game.

I have had zero issues with malware for the years I have run Comodo - somehow I doubt they are ant different than any other provider as Trel points out.
--
Brian

"It drops into your stomach like a Abrams's tank.... driven by Rosanne Barr..." A. Bourdain]]> http://www.dslreports.com/forum/remark,22691277 Sat, 11 Jul 2009 13:27:06 EDT http://www.dslreports.com/forum/remark,22691232 onDvine : Thank you, siljaline . :) I'm still using IE 6, and no sites in the Restricted zone are allowed to do anything.

2nd edit: Should've said IE 6 is what's installed. I don't actually use it, and only use Avant Browser (IE-based) to go to one site.]]> http://www.dslreports.com/forum/remark,22691232 Sat, 11 Jul 2009 13:15:45 EDT http://www.dslreports.com/forum/remark,22691220 onDvine : Thanks, Its a Secret . :)]]> http://www.dslreports.com/forum/remark,22691220 Sat, 11 Jul 2009 13:13:53 EDT http://www.dslreports.com/forum/remark,22691183 siljaline : onDvine :) have a look here for Certs in IE >
»www.mvps.org/winhelp2002/restric···#Setting]]> http://www.dslreports.com/forum/remark,22691183 Sat, 11 Jul 2009 13:03:40 EDT http://www.dslreports.com/forum/remark,22691173 Its a Secret :

said by onDvine :

Is it possible that since they're already unchecked, they have no ability to authorize anything? "Authorities" is the only tab that has anything in it at all.

Yes, as confirmed by Mele20 , unchecking seems to be the only way. And yes, they won't be used to verify a site.

The other tabs should be empty unless you've added a cert to them.
--
"In the future, that which is not mandatory will be illegal"
"Nobody knows the age of the human race, but everybody agrees that it is old enough to know better" - Anonymous]]> http://www.dslreports.com/forum/remark,22691173 Sat, 11 Jul 2009 13:01:22 EDT http://www.dslreports.com/forum/remark,22691154 onDvine :

said by Its a Secret :

... Find Comodo, and click edit for each of them and uncheck the boxes.

I did as suggested and found none of the boxes checked for any of 'em (see screen snapshot). Deleted all, but they were there again immediately when I reopened the section without doing anything else. Is it possible that since they're already unchecked, they have no ability to authorize anything? "Authorities" is the only tab that has anything in it at all.

]]> http://www.dslreports.com/forum/remark,22691154 Sat, 11 Jul 2009 12:56:21 EDT http://www.dslreports.com/forum/remark,22690933 MarkAW :

said by danny9 :

Many cert issuers are in that business. That's what they do.
Comodo is in the security business, the others are not.
They are supposed to be protecting us from the very sites they are selling certificates too.
That's the difference.
Instead of trying to control malware they are adding to it.

I have to wonder how many users have been infected by these sites certified by Comodo.

Well said danny9 and i totally agree with what you say, and have unchecked removed everything and anything that deals with Comodo in the three Browsers i mentioned earlier in this thread.
Edit: i have never used Comodo products and never will, i never trusted that company for some reason.
--
The greatest mistake you can make in life is to be continuously fearing you will make one.

Next to knowing when to seize an opportunity, the most important thing in life is knowing when to forego an advantage.]]> http://www.dslreports.com/forum/remark,22690933 Sat, 11 Jul 2009 11:49:24 EDT http://www.dslreports.com/forum/remark,22690908 hayc59 :

said by danny9 :

Many cert issuers are in that business. That's what they do.
Comodo is in the security business, the others are not.
They are supposed to be protecting us from the very sites they are selling certificates too.
That's the difference.
Instead of trying to contol malware they are adding to it.

I have to wonder how many users have been infected by these sites certified by Comodo.

This is exactly the point no matter what company or programmers, its what they allow to be included in their software and being in the security sector is just not cool!
--
ãrê ¥Øu êxpêriêncêD
Microsoft® MVP Consumer Security 2007-09
"Greater love has no one than this, that he lay down his life for his friends."
9/11/01 Never Forget]]> http://www.dslreports.com/forum/remark,22690908 Sat, 11 Jul 2009 11:41:40 EDT http://www.dslreports.com/forum/remark,22690234 mers2 : Comodo is going to discover that they either have to be in the cert business or in the security business, you can't do both. Well, you can, but those who know better won't deal with them. I've been really disappointed with how Comodo has handled a number of situations and I won't be using any of their products simply because I don't trust them. ]]> http://www.dslreports.com/forum/remark,22690234 Sat, 11 Jul 2009 06:05:58 EDT http://www.dslreports.com/forum/remark,22690197 danny9 : Many cert issuers are in that business. That's what they do.
Comodo is in the security business, the others are not.
They are supposed to be protecting us from the very sites they are selling certificates too.
That's the difference.
Instead of trying to contol malware they are adding to it.

I have to wonder how many users have been infected by these sites certified by Comodo.
--
"In times of universal deceit, telling the truth becomes a revolutionary act.."
George Orwell]]> http://www.dslreports.com/forum/remark,22690197 Sat, 11 Jul 2009 05:04:32 EDT http://www.dslreports.com/forum/remark,22690190 Mele20 : Simply unchecking Comodo certs is not enough. You must also uncheck for Add Trusted, Be Trusted and User Trust Network. They are all owned by Comodo. In Fx you cannot delete them. Well, you can but Fx will replace them next time you open the browser. Instead, disabling them as you have described is the correct and only effective way to do it in Fx.

In IE, UTN is User Trust Network. Click on Advanced tab and uncheck everything on each of them. Uncheck the Comodo one. Uncheck all A-Trust ones also.

In Opera, they are Add Trust, Comodo and UTN. You can uncheck both boxes or you can check both boxes. If you check both boxes then Opera will warn you before using the cert.

Fx3 is a mess for dealing with certs compared to earlier versions. In 1.5 if you have unchecked a cert, and you encounter a web site that uses a cert from that root issuer, Fx gives you a straightforward warning and asks if you want examine the cert, choose to never accept that cert, choose to accept it one time or always accept it. Fx3 is a great deal more complicated and you have to navigate through a bunch of windows designed to terrify the average user before Fx3 will allow you to examine the cert which is the first thing it should do like it does in 1.5. You need to examine the cert but Fx 3 thinks users are too dumb to do that (and a lot are).

Fx3 also is extremely misleading and lies to the user as it tells you that something is wrong with the web site. That is not true if you have unchecked all Root certs from Comodo! There is nothing necessarily wrong with the website. The user chose to uncheck those certs and unchecking them is the "problem". There could be something nasty at the website that uses one of those certs but not always. I keep GoDaddy unchecked because a lot of sites that are sleazy use GoDaddy because it is the cheapest. I want to know before I go to a secure site secured by GoDaddy. Fx 1.5 handles this correctly. Fx3 goes nuts. I just need to look at the cert (partly because I need to see who the issuer is) which Fx 1.5 understands and shows it to me immediately. Fx3 freaks out and makes it a hassle for me to examine the cert.

Mozilla is still seriously discussing yanking Comodo certs but the stumbling block appears to be that since that has never been done before they don't know how best to do it while causing the least disruption to users. At this point, I think they just need to yank them even if it causes some initial problems. I get chills every time I think about how Eddy Nigg was able to buy a cert for mozilla.com from a Comodo reseller with no attempt to check his identity. I think they should have yanked them back in January instead of the immense amount of discussion in the news group and the filing of bugs, etc. which is still ongoing.
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason]]> http://www.dslreports.com/forum/remark,22690190 Sat, 11 Jul 2009 04:48:11 EDT http://www.dslreports.com/forum/remark,22690165 Trel :

said by danny9 :

said by Trel :

Isn't EVERY issuer doing this, and the only reason Comodo's come under fire for it because they also have a line of security products?

Can you honestly say you would trust Comodo to protect you when at the same time they are issuing certificates to malware sites?

Sounds like they're trying to have their cake and eat it too which is philosophically impossible.

They have been told about this but continue to ignore it hoping it will go away. It won't.

I am one of those users, I was running CIS, that will no longer use any Comodo product on my computers.

They may have started out with the right idea but money became the name of the game.

Well to be completely honest, I couldn't care less about that link, as I highly doubt the programmers are the same that issue the certs. I use Comodo 2.4 (never liked 3), but either way, it irks me to see JUST Comodo being bitched at for this when all cert issuers do it.

Don't get me wrong, I don't approve of this, but to me the problem isn't that Comodo is doing this. The problem is that ANY cert issuer does this. And they all do. Singling out Comodo seems to just confuse the issue.
--
/chown -R us:us /yourbase]]> http://www.dslreports.com/forum/remark,22690165 Sat, 11 Jul 2009 04:10:39 EDT http://www.dslreports.com/forum/remark,22690103 danny9 :

said by Trel :

Isn't EVERY issuer doing this, and the only reason Comodo's come under fire for it because they also have a line of security products?

Can you honestly say you would trust Comodo to protect you when at the same time they are issuing certificates to malware sites?

Sounds like they're trying to have their cake and eat it too which is philosophically impossible.

They have been told about this but continue to ignore it hoping it will go away. It won't.

I am one of those users, I was running CIS, that will no longer use any Comodo product on my computers.

They may have started out with the right idea but money became the name of the game.
--
"In times of universal deceit, telling the truth becomes a revolutionary act.."
George Orwell]]> http://www.dslreports.com/forum/remark,22690103 Sat, 11 Jul 2009 02:56:41 EDT http://www.dslreports.com/forum/remark,22690085 KoRnGtL15 : Thanks for the tip! I need to do the same with IE8. But not sure how to?

said by Its a Secret :

In FF, it's under Tools|Options|Advanced|Encryption and then view certificates. Find Comodo, and click edit for each of them and uncheck the boxes.

]]> http://www.dslreports.com/forum/remark,22690085 Sat, 11 Jul 2009 02:44:57 EDT http://www.dslreports.com/forum/remark,22690081 Trel : Isn't EVERY issuer doing this, and the only reason Comodo's come under fire for it because they also have a line of security products?
--
/chown -R us:us /yourbase]]> http://www.dslreports.com/forum/remark,22690081 Sat, 11 Jul 2009 02:39:57 EDT http://www.dslreports.com/forum/remark,22689931 MarkAW : I unchecked and deleted all Comodo certificates in Opera, Seamonkey and IE7 and haven't had any problems.]]> http://www.dslreports.com/forum/remark,22689931 Sat, 11 Jul 2009 01:10:55 EDT http://www.dslreports.com/forum/remark,22689891 Its a Secret : In FF, it's under Tools|Options|Advanced|Encryption and then view certificates. Find Comodo, and click edit for each of them and uncheck the boxes.]]> http://www.dslreports.com/forum/remark,22689891 Sat, 11 Jul 2009 00:50:17 EDT http://www.dslreports.com/forum/remark,22689853 SUMware :

said by siljaline :

"layered" malware

:D layered security insecurity]]> http://www.dslreports.com/forum/remark,22689853 Sat, 11 Jul 2009 00:38:03 EDT http://www.dslreports.com/forum/remark,22689727 onDvine : I'm still using Comodo version 2.4.18.184. Should I disable anything in Firefox? If so, where do I find the certs you referred to?

Don't use IE, but access one PhotoBucket account using Avant Browser (which is IE-based) to keep its cookies separate from another PhotoBucket account.
--
Be content with your lot; one cannot be first in everything. ▪Aesop]]> http://www.dslreports.com/forum/remark,22689727 Sat, 11 Jul 2009 00:04:28 EDT http://www.dslreports.com/forum/remark,22689538 siljaline : Perhaps "layered" malware :uhh: SUMware ]]> http://www.dslreports.com/forum/remark,22689538 Fri, 10 Jul 2009 23:08:01 EDT http://www.dslreports.com/forum/remark,22689518 SUMware : Another thank you!

said by VikingBob :

Comodo really needs to smarten up... :uhh:

It's called 'producing profits' instead of 'providing protection'.]]> http://www.dslreports.com/forum/remark,22689518 Fri, 10 Jul 2009 23:03:14 EDT http://www.dslreports.com/forum/remark,22689514 shearer : Disabled Comodo certs on IE and Firefox. thanks for heads up]]> http://www.dslreports.com/forum/remark,22689514 Fri, 10 Jul 2009 23:02:08 EDT http://www.dslreports.com/forum/remark,22689501 VikingBob : Comodo really needs to smarten up... :uhh:]]> http://www.dslreports.com/forum/remark,22689501 Fri, 10 Jul 2009 22:58:37 EDT http://www.dslreports.com/forum/remark,22689442 siljaline : Thanks for this, hayc59 :hmm:]]> http://www.dslreports.com/forum/remark,22689442 Fri, 10 Jul 2009 22:47:33 EDT http://www.dslreports.com/forum/remark,22689347 hayc59 : »msmvps.com/blogs/hostsnews/archi···205.aspx

this is a follow up on certificate issue that seems to be an
on going item!!]]> http://www.dslreports.com/forum/remark,22689347 Fri, 10 Jul 2009 22:27:29 EDT