Here's what one of them looks like inside Netscape. The other ones can be found here.
This is of course potentially dangerous. On most UNIX machines, these email addresses are associated with privileged users or system administrators. If you received email from root@localhost telling you to call a certain phone number to receive your new password, you might be tempted to do so.
The major flaw stems from the fact that these email addresses are not unique. One claim made by VeriSign regarding digital IDs is:
A Class 1 Digital ID provides you with an unambiguous name and e-mail address.BZZZT. Wrong answer. I could understand this claim if they made some effort to establish identity or use confirmation via email like the New York Times. Even then they would be vulnerable to other impersonation attacks, which raises a question about the value of such IDs. Note that the higher level IDs have mechanisms to more strongly identify individuals.
What makes this a matter of concern is that these email addresses carry a connotation of authority from their common usage, which may lead people to be tricked into doing something that compromises their security or privacy. If such certificates are misused, then they may actually erode security rather than enhance it. Luckily, DigiCrime has no evil intent.
While Andreessen may have the first digital ID from VeriSign, we may now have the first revoked certificate. As of May 5, some of them were not showing up in the data, which conflicted with the stated policy about not currently supporting revocation of Class 1 IDs. This would still not solve the original problem.
Now that they have been revoked, perhaps others with a less benign intent can recapture the ambiguous and potentially dangerous IDs. Moreover, there is apparently no mechanism for distributing certificate revocation lists to applications that might use them. Some of the IDs issued to us are still in the database, and we are not advertising these at this time. If you have Netscape 3.0 you can find them at the VeriSign query service, and also download these certificates.
