Web Hosting Talk







View Full Version : Geocert and Comodo: SSL wars


bshost
06-10-2004, 08:56 AM
Has anyone else noticed this going on? Are my assessments with regards to ubiquity claims correct?

cb
--


To: whichssl@comodogroup.com
Subject: SSL wars
Cc: XxxxxX@FreeSSL.com, press@google.com

Dear persons,

As an existing InstantSSL (i.e. Comodo) customer I'm very disappointed to read the comments you have posted on YOUR (see http://whichssl.com/about-which-ssl.html) whichssl.com site regarding the certification provider GeoCert / FreeSSL (http://whichssl.com/unethical_practice.html).

You've used statistics from Google's Zeitgeist to claim that GeoCert's SSL technology does not support 20% of Internet users, yet you've based this on a figure referring to IE 5.x browsers. This claim is totally misleading for the following reasons:

- GeoCert supports every MS browser from IE 5.1 and beyond;
- IE 5.0 is a small fraction of IE 5.x browsers currently in use (according to the Google graph, about 50%, but presumably that includes IE 5.1); and,
- IE 5.0 is so dysfunctional and insecure that I wouldn't want those users ordering through my secure site anyway. I would rather they use Netscape 4.
- I might also point out that the graph has no indices.
- There is also no discussion of Macintosh variations.
- Other statistical sources clearly give IE 5.x as a whole 20% of browser share.

On top of that you're accusing them of spamming Comodo customers with predatory offers to steal their business away from you. This would (almost by definition) imply that they obtained some sort of list of Comodo customer email addresses (is there an SSL whois database to be exploited, I wonder?), otherwise they could not have sent "bulk mail" to a list of those target customers. Where would they have got this from?

I would suggest that that list doesn't even exist outside the offices of Comodo. I was contacted via email by FreeSSL, initially indirectly I might add (i.e. a forwarded email from one of my colleagues), then they followed the email up with an actual phone call - from the U.K., to Australia, at the correct time of MY morning. They stayed up until midnight to call me, whereas normally it would be me up at 3am trying to resolve issues regarding REAL spammers in the U.S.

Some of the allegations you've made are clearly unsubstantiated, and after my experience with GeoCert salespeople over the phone, my careful research of this particular slanging match, the very competitive package they're offering me and the unusually long 24+ hours it took you to issue my last SSL certificate, I'm seriously leaning to the other side. Until now I've been very happy with InstantSSL - the free one month trial cert is a very useful sales tool - but after all, wasn't it not so long ago that whichssl.com popped up to argue about many of these same issues with regards to Thawte and Verisign?

If I were either Google or GeoCert I would be considering legal action with regards to some of your claims.

Correct me if I'm wrong.

Chris Bell
Blue Sky Host.com
--

P.S. And at the end of the day, why am I paying you guys anyway? All you're doing is signing my certificate with yours!

bshost
06-10-2004, 09:11 AM
Obviously it's the right time of day (in Europe) to be initiating this discussion cos I just got one helluva quick (and useless) reply:

To: "Xxxxx" <xxxxx@comodogroup.com>
Subject: RE: SSL wars

That doesn't answer a single one of my points.

Maybe I'll just pass you both off.

cb
--


At 10:56 PM 10/06/2004, you wrote:

Chris,

Perhaps if you take a good look at www.sslreview.com also operated and
maintained by Geotrust you might also take legal action.

Xxxxx

Xxxxx Xxxxxxx
Senior Business Development Manager
Comodo Group www.comodogroup.com
Tel + (44) 161 8747084 EXT:XXX
xxxxx@comodogroup.com

bshost
06-10-2004, 09:30 AM
I must say,

whichssl.com clearly states its "relationship" with Comodo (as posted above), whereas on the other hand the whois data for sslreview.com shows no connection to Geocert, and there's no clear statement as to a relationship between the two on the site that I can find - although www.freessl.com and www.sslreview.com have conveniently proximate IP addresses.

SSLreview.com seems to always put Verisign first and target Comodo and XRamp in particular... but this all seems terribly unprofessional to me. Maybe I should call the GeoCert people and ask them directly whether they operate SSLreview.com?

cb
--

bshost
06-10-2004, 10:01 AM
Oh well, as long as it's stil relevant to my solo thread... Incidentally Comodo have promised to address my points.


To: info@sslreview.com
Subject: SSL wars
Cc: xxxxx@comodogroup.com, XxxxX@FreeSSL.com, press@google.com


Hmmm ok,


this is regarding some of your claims regarding Comodo on your sslreview.com web site. I've been an InstantSSL customer for a while.


On this page: http://www.sslreview.com/content/table/index.html:


- In the "Price" column, you have a link to http://www.sslreview.com/content/table/comodo3year.html where you point out that their chaining certificate expires in 2006, however you claim that "IE 5.01 and above will display error messages when making SSL connections after February 2006". Should this not say "MAY display error messages"? You're assuming that the certificate won't be renewed. God knows I have to renew mine! Surely they will too.


- In the "Suitable For" column you have only awarded them "SMB" instead of "Enterprise and SMB" (meaning "small to medium business", I assume). What are your criteria? Is a 128bit certificate not a... 128 bit certificate (as long as it works)?


- In the "Issuance Speed" column you give them "2-4 working days" yet despite the fact that the last one took 24 hours they've only ever taken under an hour in the past - at any time of day. On top of that FreeSSL (as opposed to Comodo) claim to take the actual certification work out of your hands, but that's what always caused delays with Thawte and the like in the first place



Chris Bell
BlueSkyHost.com
--

Sheps
06-10-2004, 10:43 AM
Read:

http://www.sslreview.com/ssl-certificate-content/ssl-compare-table/comodo3year.html

http://www.sslreview.com/ssl-certificate-content/ssl-compare-table/root_comodo.html



I think those two explain everything perfectly.

gilbert
06-10-2004, 10:45 AM
whoa, now here are some ponnies that need some slowin down

bshost
06-10-2004, 10:52 AM
Originally posted by Sheps
Read:

http://www.sslreview.com/ssl-certificate-content/ssl-compare-table/comodo3year.html

http://www.sslreview.com/ssl-certificate-content/ssl-compare-table/root_comodo.html



I think those two explain everything perfectly.

Yeh both of those URLS (the first one which I quote myself, above) seem fairly straightforward to me and also somewhat inconsequential.

What is there to suggest that Comodo's chaining certificate won't be renewed?

Besides, I tend to only ever buy anything for a year at the most.

cb
--

bshost
06-10-2004, 10:54 AM
Originally posted by gilbert
... some ponnies [sic] that need some slowin down

considering your sig, that's ironic at the very least!

cb
--

Dynanet
06-10-2004, 01:38 PM
I'm not sure what to do with these two companies, I was offered a very, very sweet deal from FreeSSL to switch ... both outfits seem to work just fine, the FreeSSL certs are easier to handle however since there are now chained parts to install.

As long as the little padlock appears in the browser most end users don't care who supplies the SSL cert, and in all honesty I don't really care if an IE version from 1998 might not work right.

boeki
06-10-2004, 02:09 PM
my site uses geotrust certs and it irritates the hell out of some of my clients to have to click on those warning messages just because they're using ie50

cqrity
06-15-2004, 11:16 AM
IMHO,
You want to receive a certificate that actually certifies YOUR identity, and not just the ownership of the domain name.

All FreeSSL and some QuickSSL on the low end are speeding through the process of issuance of the certificate, thus again, IMHO, are prone to issuing unwarranted certificates.

Dynanet
06-15-2004, 04:07 PM
Originally posted by cqrity
IMHO,
You want to receive a certificate that actually certifies YOUR identity, and not just the ownership of the domain name.

All FreeSSL and some QuickSSL on the low end are speeding through the process of issuance of the certificate, thus again, IMHO, are prone to issuing unwarranted certificates.

For those looking for a trust relationship then yes you should steer them towards the higher end certs. For the rest just looking for the padlock on the status bar and https in the URL without a warning popping up then the low end certs work fine. Keep in mind that a good percentage of the users online aren't going to be checking the cert anyway (I have never checked my banks certs for example and I'm there daily).

Heck, I'm not so sure I trust Verisign anyway :)

cqrity
06-15-2004, 05:34 PM
and you're absolutely correct about not trusting Verisign - a few years back (if they's let me post a link *HERE*) they issued SSL certs to a person who CLAIMED to be Microsoft employee. More over, not that long ago Thawte - a Verisign Company issued certs with the same serial numbers.(if they'd let me post a link *HERE*)

So, when I did my searches, I looked for a higher end cert that actually doesn't cost an arm and a leg and arrived at InstantSSL Pro. Actually, looking at Comodo's pricing stucture - a 3 year PremiumSSL for $199 with site seal and a $10K warranty is an incredible deal.