New Points Counting (Thawte Patch) - Members and users FAQ

Project timeline

2009-09-12	Board motion m20090912.1 Assurance under Assurance Policy only (this stops the tverify program)	{g}
2009-09-14	Board motion m20090914.2 Confirm Motion m20090912.1	{g}
2009-09-28	Board motion m20090928.1 Run Tverify as-is until End Of Life 20091116	{g}
2009-10-15	Blog post: Thawte Web of Trust Shutting Down	{g}
2009-11-13	Blog post: Last chance: End of thawte points transfer on 16th november 2009	{g}
2009-11-16	Thawte server shutdown	{g}
2010-03-08	Blog post: Thawte Points Transfer and Removal of Points at Nov 16th 2010	{g}
2010-07-24	Added bug #827 to the Software-Assessment project agenda	{g}
2010-10-19	First proposed patch 15.php (bug #827) added to testserver	{g}
2010-11-16	Proposed: Thawte Points to be revoked	{0}
2011-07-13	New bug #959 found in the system that needs to be fixed first	{g}
2011-08-01	Patch bug #959 deployed to production	{g}
2011-09-07	First proposed patch 15.php (bug #827) added to production	{g}
2011-09-20	proposed fixes for new points counting (15.php) by Software-Assessment project applied to testserver	{g}
2011-10-23	Newsletter to send to the members: PR/News/NewPointsCalculation, accepted by board motion m20111023.2	{g}
2011-10-24	request for Newsletter translations to community, see header links PR/News/NewPointsCalculation	{g}
2011-11-27	newsletter PR/News/NewPointsCalculation send to members	{g}
running	0 Points corrections of missing points before 2006-09-01 (a20111001.1)	{0}
	prepare fixes for Thawte points removal to set active (deploy software, test software, deploy to production)	{0}

Press Release

Here is a first draft for a newsletter.

Q 1: Am I affected ?

Q: The question most users asks - Am I affected by the Thawte points revocation ?
A: All users who received assurance points by transfering their Thawte account over to CAcert may be effected.
Members who received several face-2-face assurances after this Thawte points transfer may have collected enough assurance points (upto 100 and more). They get the upto 150 points revoked but aren't affected by this revocation as they've collected more countable assurance points to keep their accounts in a safe state.

Q 2: Are my Experience points affected ?

A: If your Thawte points gets revoked and you are falling below the 100 points level, but you gave a couple of face-2-face assurances in the past, these Experience points aren't lost. They may be listed as "on hold" until you correct your points count with face-2-face assurances and fullfilling the Is-Assurers requirements (100 Assurance points + CATS test passed).
Q: What happens if I falling below the 100 points level, have the "Points on hold" listed, and now have received the assurance points. Do I have to contact someone to get the Experience points back?
A: You have to do nothing. The Assurance and Experience points level will be corrected automaticly everytime an Assurer transfers assurance points to your account or for Experience points if you enter assurances into the system.

Q 3: Assurer State

Q: One day the Thawte points gets revoked, how does affect this my assurer state ?
A: Well, if your assurance points level falls below 100 points your Assurer state switches "On hold".
You first have to find other assurers to assure you and to get them the points transfered to your account so your assurance points level reaches again the 100 points level requirement.
Then you get your Assurer state back.

Q 4: 150 Thawte points and Experience points

Q: I've received 50 Experience points thru the Tverify program. Are these Experience points affected by the Thawte points revocation ?
A: Yes, these points are also affected by the Thawte points revocation
Q: I was able to allow up to 35 points for each assurance I made, will I start back with the minimum 10 points ? Or continue with the ability to allow 35 points ??
A: All points earned from Tverify are struck off, so any experience benefit is also lost. So, you'll be back to however many your experience points are from Assurances done within CAcert's WoT, these will not be lost. If you've not done any assurances, then yes, you will be able to allocate 10 assurance points only. If you have done 25 assurances, then full 35 assurance points available.
Q: Why are my experience points being taken away also?
A: Tverify programme is caused to be shutdown by the reasons the Thawte hosting CA shuts down their web of trust at Nov 16th, 2009 and makes the information unavailable by server control, verification or revocation of certificates. This causes also the assurers state verification faded away. Experience points are only awarded for doing (CAcert) Assurances!

Q 5: What can I do? - What do I have to do?

A: You have a couple of potential options. One of these choices needs to be started
1. Search for assurers who assure you, Assure others by individual face-2-face meetings
2. Plan a local assurance event. Invite other assurers in your area. Make as much mutual assurances you can.
3. Plan an ATE. Contact the co-auditors team to make such an event happen.
4. Plan a Nucleus event. Despite the fact a subpolicy is not yet voted, the procedures outlined under the Nucleus proposal works also with 3 experienced assurers. Try to get 10 assurers and assurer candidates invited to an one-day-event and get them attending.
5. Help to deploy the new TTP program for your country
  - help to get the software updated, that the New TTP program can be entered into the online system, first proposal starts with the CAP form printout deployment -> bug #988

Q 6: Replacement Assurance Programs

A: There exist at least 2 alternate replacement programs that needs to be deployed
1. Old TTP program - frozen
  - New TTP program - Policy is DRAFT - needs deployment
2. Old Tverify program - frozen, to shutdown
  - There is no direct related alternate program available
3. Super-Assurance - frozen
  - New Nucleus program - Policy is WIP - needs to be prepared and pushed to Policy Group
  - Program works also with 3 experienced assurers, so this is the most valuable program currently available

Q 7: What does the yellow lines means ?

A: The yellow/italic lines under 15.php means, these are 0 points assurances.
- The 0 points assurances are a very special case with several requirements regarding the running issue.
Cause:
- At the time, the assurance was added into the system (before September 2006), there doesn't exist a column awarded in the assurances table, so the points an assurer gave for an assurance wasn't recorded. This results in a 0 points assurance (points rounded down to 0). Only the assurer knows how many assurance points he had awarded.
Proposed solution:
- send an email to support@c.o to request the removal of the 0 points assurance. Support can check if this assurance falls under the given filter (assurance was entered before September 2006), assurance was entered after a couple of other assurance points received (eg Thawte points transfer). Currently a dispute has been filed to rule a precedent for such cases, that support can revoke the assurance, that support can contact the affected assurer to reapply the assurance into the online system (as long the assurer has the CAP form present)
- Also a dedicated mailing has been prepared, that needs to go thru arbitration, that affected assurees and assurers receives an email, that they are affected and how they can solve this problem.
- To identify these special cases, therefor these records are marked
  - yellow/italic
- to signal to the affected assurees and assurers, that they have such records, that the users can report the issue to support and support can verify these issues to trigger the assurer, to reapply the assurance, now with counting points
Action by assuree:
- Write an email to support and report, that you have one or more of such marked records, that these assurance records probably can be repaired
Action by assurer:
- Write an email to support and report, that you have one or more of such marked records, that you are in the possesson of the CAP forms and that you can reapply these assurances.
Support action:
- Support has to revoke the spotted assurance, so that the assurer can reapply the assurance
Exceptions
- One exception may occur: if an assurer gave 0 points to an assuree caused by lack of confidence.
Background information
- The yellow/italic marked records may effect the points counting that way, that an assuree has received enough assurance points to fullfil the assurer requirements, to fullfil the assured requirements to issue certificates with the users name in it, but after the Thawte points removal process comes in effect the count of assurance points does no longer fullfil these requirements caused by the missing information how many assurance points an assurer awarded in an assurance dated before September 2006. The assurers obligation is to keep the CAP forms for 7 years, so probably assurances that happened and had been entered into the online system dated between 2004 and 2006 can be recovered the given procedure.
More questions and answers
- Q: Who may be affected ?
  - A: users who created their account before 2007 may be potentialy affected
- Q: Are all users who created their account before 2007 are affected ?
  - A: No.
    - Only a few users are affected who received assurance points thru a special assurance program that is frozen now (eg Thawte transfer points) and the points gets revoked in the near future and that users received additional regular face-2-face assurances before 2007 and no further assurances after August 2006 so that in essence their points count shrinks below a certain level (eg 100 assurance points, 50 assurance points)

A more detailed discription can be found here Support/Handbook/NewPointsCalculation

Q 8: Sometimes I read Thawte points, sometimes I read Tverify program. Is this the same ?

A: In general, yes. Thawte points transfer was one of the programs falling under the Tverify points transfer program. The Tverify program also includes a C'T magazine transfer. But this wasn't used in production. Also a program was under development for transfering points from the Austrian "Buergerkarte". But these programs are also halted. Tverify is the name of the transfer script for the transfer of assurance and experience points from a foreign system. With Assurance Policy in effect this program is stopped.

Q 9: Thawte transfer points, Tverify program, Trusted Third Party program. Is this the same ?

A: Thawte transfer, Tverify program and Trusted Third Party has only the "Special Assurance program" and the starting character "T" in common:
- The special assurance programs
  1. The Thawte or Tverify program:
    - These old "special assurance programs" are frozen since mid of 2009 and probably will never come back.
    - The reason for these programs were similiar authorities, from which some confidence in the identity of a user could be received. As these programs are not auditable, these programs has been set disabled.
  2. The Trusted Third Party program (short TTP):
    - ... is a special assurance program, with assistance by a third party (eg notary public) and a CAcert Assurer.
    - The "old" TTP program was effectivly stopped Dec 2009 with the request to write a TTP-assisted-assurance policy
    - The "new" TTP-assisted-assurance policy is now DRAFT since p20100913, but needs deployment, that is currently still WIP. See also TTP in the wiki
- The Thawte or Tverify program relates to the "Thawte points removal" project. The new points counting schema is CAcert's answer, to fix the changes that are caused by the "Thawte points removal" process so every time a dynamic points counting schema can give the current points state over an account. The "old" points counting schema was a fixed static system that needs manual fixing of affected accounts by the "Thawte points removal" process.
- The "old" TTP program and the new TTP program is neither affected by the "Thawte points removal" process.
- There are plans to either limit the points on old TTP and Super-Assurance special assurance programs as AP limits assurance points to 50 pts max. But this needs a policy first, the "Legacy Points Policy", that needs to be written first. So current "Thawte points removal" project doesn't effect the "old" TTP program nor the new TTP program.

Add your questions here ...

Your Question here