Umm... Perhaps, but probably not in quite the way you suggest. The current implementation doesn't allow the user to distinguish between certs issued by CAs with smart, rigorous CPS's (you do know what that is right), and certs issued by CAs that only check e-mail to admin@ postmaster@,...

Yeah. Which is why the major browsers require that the CAs be audited (and if they delegate to resellers the resellers too) to verify that they actually comply with what they say they'll do (their CPS), and that their CPS meets a minimal set of standards.

It seems your argument really boils down to: there has been a race to the bottom on the documented signing policies in order to minimize costs because higher cost, more rigorous validation mechanisms can't be used to differentiate a cert in the marketplace. (Except EV, but that's a whole other story)

And they can't do anything to stop the best from handing a phisher a cert. However, the browser producers require an audit (which serves as a detective and preventive control) to verify that appropriate and sufficient processes are in place to ensure that a) the CPS is followed and b) the CPS meets a (minimal) set of rules.

Now, all this means that when (as a user) you're presented with a cert [that is not EV], you can be strongly assured that at some point, that cert was issued to someone who could read and respond to mail at an administrative email account for that domain. Is this sufficient for the user? Maybe. If it's a forum site, or a blog site, then probably. If it's an eCommerce or online banking site, probably not.

The browser makers need to allow:
a) Certs with differing validation methods to be differentiated (on a finer granularity than EV / not EV)
b) Client-side policy to be implemented on the basis of that differentiation

In order to arrest this race for the bottom and competition solely on price by the CAs.

Incidentally, both of these can be achieved within the current CA infrastructure...

"Unless your going to pay the auditors to run a compliance check after every change you make"

Not relevant to the case at hand, but:

1.1.1 A formal process for approving and testing all network connections and changes to the firewall and router configurations ...

6.3.1 Testing of all security patches, and system and software configuration changes before deployment, including but not limited to the following:
6.3.1.1 Validation of all input (to prevent cross-site scripting, injection flaws, malicious file execution, etc.)
6.3.1.2 Validation of proper error handling
6.3.1.3 Validation of secure cryptographic storage
6.3.1.4 Validation of secure communications
6.3.1.5 Validation of proper rolebased access control (RBAC) ...
6.4 Follow change control
procedures for all changes to system
components. The procedures must
include the following:
6.4.1 Documentation of impact
6.4.2 Management sign-off by appropriate parties
6.4.3 Testing of operational functionality
6.4.4 Back-out procedures ...
6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by either of the following methods:
- Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes
- Installing a web-application firewall in front of public-facing web applications ...
11.2 Run internal and external network vulnerability scans at least quarterly and after any significant change in the network (such as new system component installations, changes in network topology, firewall rule modifications, product upgrades).
Note: Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV) qualified by Payment Card Industry Security Standards Council (PCI SSC). Scans conducted after network changes may be performed by the companyâ(TM)s internal staff.
11.3 Perform external and internal penetration testing at least once a year and after any significant infrastructure or application upgrade or modification (such as an operating system upgrade, a subnetwork added to the environment, or a web server added to the environment). These penetration tests must include the
following:
11.3.1 Network-layer penetration tests
11.3.2 Application-layer penetration tests

"If the banks [sic] implementation followed PCI-DSS and the auditor did its job with a generally accepted level of precision"

It did not and they did not. Unencrypted storage of PANs, for which a previous audit had failed.

And they failed to do that.

They knew the processor had previously failed an audit because of storage of unencrypted PANs and non-compliant firewalls.

They provided an audit report that said "fully compliant" with CISP.

In the aftermath of the breach, it was discovered that the processor still had non-compliant firewalls and was still storing unencrypted PANs.

It appears that Savvis did not do their job. This will not be the big question at the trial, though.

Merrick was not in contractual privity with Savvis. Savvis was contracted by CardSystems, not Merrick. The issue at trial will likely be whether Savvis owed a duty of care to others that relied on their report (rather than just their client).

I would suggest that if an audit scheme is to have any benefit at all, it must accrue to those that rely on the audit findings. If 3rd parties cannot rely on the audit findings, then there is no reason to conduct the audit in the first place.

Your question of morality is interesting and I'll get to that in a moment, but I'd first like to share the experience in Australia where such a "First Home Buyers" scheme has been operating for some time. At one point it was AUD$21.000 if you were a first home buyer who built a home, I think at the moment it's "only" AUD$14.000. It started a few years ago at AUD$7.000.

From where I'm standing at the side-lines - I'm renting - it distorted the housing market in many unpredictable ways.

In essence it increased the price of all houses because the new builders would build a house with extras "for free", that incorporated the extra funding. Those first home buyers who didn't build got half the funding and that meant that existing home owners increased the value of their home by that amount so they could get the funding too.

Those same houses that were artificially increased in value caused a bubble in the price of housing, because the next owner saw the percentage increase in their area - as a result of the grant - and then they too wanted to see the same return on their investment, causing a self-feedback loop that made house prices increase like mad when really there was nothing to back that up. The result today is that the return on housing has in fact declined for the first time in decades - completely unheard of in most urban areas in the country.

The grant caused cases where the first home buyer was a child and many cases where people with extreme wealth found ways of getting the grant - for example, if the husband always bought their house as a company, then they could qualify for it as a private purchase etc.

By the examples I'm showing you might surmise that the grant brings out the worst in people. It goes directly to morality because it shows that when there is an opportunity to do wrong, a percentage of the population will in fact do so.

I don't think it's a good or sustainable means of stimulation, nor do I think it's appropriate to use aid that is not required. I think that shining the light on those who abuse the system will ultimately cause a return to common sense.

Those around me think it's appropriate to cheat on your taxes - for me, its the same thing. Ultimately you're cheating yourself and the society you are part of. Unemployment benefits, healthcare, education and infrastructure need to be paid for - even if I don't agree with all that is spent, that's the system I choose to be part of. Paying taxes is part of the responsibility that comes with being part of society - otherwise we'd be still living in caves, hunting and dying at age 22.

For me it's summarised in the following quote:

The ultimate result of shielding men from the effects of folly, is to fill the world with fools. --Herbert Spencer