7

Has anyone heard of any cases where SSL Certificate insurance - sometimes called "warranty" or "liability protection" has actually been paid out? Or is that just a marketing scam?

Godaddy (under "All certificates include"):

Up to USD 1 million liability protection

ssls.com (last blue square):

Q: What does warranty mean?

A: If data transmitted via a secure connection is stolen, Comodo will pay a lump warranty sum to the victim of such fraud. But really, cracking a 128- or 256-bit cert is absolutely impossible.

Improve this question
3
  • 1
    I'm new to using this site - not sure how the yellow Q/A thing got up there (if AI, that's impressive) but it does not answer the question. I'm thinking it would even be hard to prove that it was an issue with the cert, or that it was cracked without attaining the PK. Therefore I think the bar is so unrealistic that the claim of insurance is itself really a scam. Likely never paid out - ever.
    – DP07
    Feb 8, 2018 at 22:19
  • Question as it stands is off-topic as noted in discussion below. It would be more on-topic if you focused on the more technical aspects of whether data via a secure connection can be stolen (paraphrased from Q/A above), but even that is pretty broad.. see security.stackexchange.com/questions/53596/how-safe-is-ssl. Your question does not relate to information security, but more on legal questions such as how do you prove that it was stolen, and do you know anyone who has claimed such a warranty.
    – HTKLee
    Feb 9, 2018 at 3:35
  • 1
    Related blog post: Scott Helme, 2018-02-28, Do SSL warranties protect you? As much as rocks keep tigers away... (Archived here.)
    – StackzOfZtuff
    Mar 2, 2018 at 11:45

1 Answer 1

Reset to default
6

The problem with your question is that such a pay out would require that there be a fundamental flaw in the implementation of TLS and that the paid warranty would be under a strict NDA. If it has been paid out, no one would know. And, it is unlikely to ever need paying out (given the nature of TLS certificates).

But I'm concerned about your concerns either/or this being a "scam". It's an easy "bonus" for the vendor to add because the risk is low of ever needing to pay out. That does not mean that it is a scam. If someone could prove harm, and the vendor did not pay out, then there would be press about that fact. I could offer you protection, free of charge, against dragon attacks, and that does not make it a scam.

Improve this answer
9
  • 4
    I think you owe some folks a payout then: en.wikipedia.org/wiki/Komodo_dragon#Danger_to_humans
    – Mike Ounsworth
    Feb 8, 2018 at 22:44
  • 1
    So you are claiming that selling protection from dragon attacks is something the FTC would not have a problem with?
    – DP07
    Feb 8, 2018 at 22:45
  • 1
    @DP07 1) where is it being sold? 2) Why does the FTC come into it? 3) Why would they have a problem?
    – schroeder ♦
    Feb 8, 2018 at 22:47
  • If you know it would never need to be paid out, or that nobody can ever know it was paid out, then I fail to see how this is not a form of extortion - because a $1 million protection IMPLIES there are REAL alternative scenarios where you can be forced to pay $1 million - though you know it's really not true.
    – DP07
    Feb 8, 2018 at 22:49
  • 2
    @DP07 none of this is a security question but a question about the fundamentals of insurance. I have worked for an insurance company, but this is not the place to sort this out. There is nothing wrong with the bonus protection. You also have a flawed understanding about the nature and requirements of "extortion".
    – schroeder ♦
    Feb 8, 2018 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .