This is a subsidiary policy under Assurance Policy (COD13). It documents the acceptance of Thawte-issued certificates and disclosers as inputs into the assurance process.
The CAs listed in Appendix A are approved to "this system".
If a certificate is examined by an Assurer (e.g., signed email) and determined to provide evidence of a Name and email address that matches the Name stored in the CAcert system, the Assurer may allocate 25 (???) Assurance Points (or as determined in the Appendix A).
This is only available to Assurers who are:
Full Assurer with 50 Experience Points
Assigned the Tverify role by support.
This may be only awarded once per Member.
This may be done automatically by the existing Tverify system.
Webs of Trust listed in Appendix B are approved for this system.
If evidence of full "assurer status" in the other Web of Trust is provided to an Assurer, then the Assurer may award 25 Assurance Points, in addition to the above 25 points from the certificate.
The Assurer must go to the other system and verify the Name. And DoB??? But the user has to enable each Assurer to check the DoB by means of the permitting an assurance in the other system.
Assurers enabled for this system must be:
Full Assurer with 50 Experience Points
Assigned the Tverify role by support.
Full "assurer status" in the other system.
This may be only awarded once per Member.
What about voting system....
optional : the user provides the web link in the directory of Thawte notaries. The user must display his name and CAcert account email address in the directory assurer message. The user can get 40 extra points after manual checking,
This proves that the person is a "Thawte Notary"
A TN has "100 Thawte trust points" which means that the Name, DoB, email address (by connecting into the system) have been checked by 3 people at least.
Thawte Notary: There is no "test".
Thawte Notary: There are some rules, what needs to be done, what not. Find the rules.
http://www.thawte.com/secure-email/web-of-trust-wot/wot_notary.html
http://www.thawte.com/secure-email/web-of-trust-wot/wot_rules.html
http://www.thawte.com/secure-email/web-of-trust-wot/wot_validation.html
http://www.thawte.com/secure-email/web-of-trust-wot/wot_points.html
http://www.thawte.com/cps/ => section 3.1.9 Authentication of Individual Identity
Thawte Notary: complaints are reported to Thawte support, and support then requests all forms and documentation and copies of IDs, and support may do something ... but this was before the change of liability, they may not care anymore
Probably this should be 25 points?
optional: The user provides a scan of a government photo id. The user can get an extra 60 points after manual checking.
May need to make this mandatory so we can check the DoB.
Probably this should be 40 points?
Agreed that experience as TN is not useful for CAcert Experience Points. So Maximum is 100.
If the user completes only step 1, the users get 50 points if the Thawte name matches the CAcert name : The process is fully automated and the user still can do later the optional steps.
In case the user completes steps 2 or 3, a Tverify-authorised Assurer does the following manual checks :
check if the link to the Thawte WoT directory matches the name and email address of the CAcert account, and
check if the photo id macthes the name and date of birth of the CAcert account.
the CAcert Tverify community member votes Aye or Nay on the request (faithfullness) and optionally adds a comment on the reason why they reject the request.
If the requests gets 4 Naye, the requests is rejected, the user has to restart the process.
if the request gets 4 Aye, the requests is completed and the appropriate amount of Assurance points are added to the account, logged as an Tverify assurance. BY WHOM?
Each user step can granted points only once. The maximum is 150 points. BLECH
To be a Tverify Assurer, an Assurer must have:
full Thawte "Notary" status.
Authorisation is done by .... the Support Officer (and confirmed by ??? Assurance Officer).
Currently there are 7+ Assurers who are authorised to conduct the Tverify additional procedure.
An online system is run to accept the certificate. This is located at https://tverify.cacert.org/ This is a critical / non-critical system ????
WHat do the Thawte docs say about reliance, etc. Is there a possibility to do this? What is the liability position? Chances are, there is no liability and no reliance permitted. Which means ... there is no reliance on the Name in the cert.
OLD:
mandatory : the users provides a Thawte assured certificate including the user name. If the name and email address in the certificate matches the name and email address recorded by CAcert exactly, the user is given 50 Assurance Points automatically by the online system.
no checking of date of birth,
no alignment of these 50 points with AP (statement, checking of date of birth, there may be some rules about middle names and extracting the name fields out of FirstName and LastName... this is in the system. should check Thwarte doco to make a judgement call on what it is worth.
Probably this should be 25 points?