* The Business of Software

A former community discussing the business of software, from the smallest shareware operation to Microsoft. A part of Joel on Software.

We're closed, folks!


» Business of Software FAQ
» The Business of Software Conference (held every fall, usually in Boston)
» Forum guidelines (Please read before posting!)


Andy Brice
Successful Software

Doug Nebeker ("Doug")

Jonathan Matthews
Creator of DeepTrawl, CloudTrawl, and LeapDoc

Nicholas Hebb
BreezeTree Software

Bob Walsh
host, Startup Success Podcast author of The Web Startup Success Guide and Micro-ISV: From Vision To Reality

Patrick McKenzie
Bingo Card Creator

Signing certificate renewal

So I'm renewing my signing certificate, and have had to update company and address details since moving, which is all fair enough.

Now this signing company want me to post my business to an online directory such as googleplace, jigsaw, 192.com, yell - and a few other choices. Apparently this is to verify my phone number.

Firstly, I don't want my company phone number listed - like a lot of mISV's I guess, I am a one man band and handle support issues over email (anyway - if you really wanted to call me, it would be extremely easy to find my number via companies house/director name/directory enquiries).

Secondly, how is my registering on one of these websites any for of "verification" for them? How much paperwork do yell or 192 required before listing my number? I don't know the answer but I suspect not much.

so thirdly - why on earth can't this certificate company just call me directly to verify? They have my number - in fact, I think this is what they did when I first bought the cert. Surely that would be the most authoritative form of phone number verification, and also the simplest. After all, this company is getting about $400 from me for doing little more than making a key and checking my ID.

Am I missing something here?

I also started looking around at other certificate companies and see I can get a Comodo cert from ksoftware at less than half what I am about to drop on this renewal - perhaps I should go there? Any reasons not to that I should know about?

Matthew Fender Send private email
Thursday, September 05, 2013
> I don't want my company phone number listed - like a lot of mISV's I guess, I am a one man band and handle support issues over email

Do what I do: use a mobile (cell) number, but set it to go to a company voicemail after X rings.  The voicemail message says that calls can't be taken right now and to email instead.  Then leave a long blank silence so they hang up before the beep.

I read this tip on these very forums, I think.  It's great!  It means people think you've got a number if they need, but they never seem to get through when they call.

Remember, just because a phone rings, doesn't mean you have to answer it.
PSB136 Send private email
Thursday, September 05, 2013
That could work for support - although I think I'd rather not list the number at all.
It won't help with this "verification" issue though.. I jsut re-read their email and it actually says at the end "we can use .. any other third party phone or business directory that we can access online". This just seems bizarre to me - that verification is dependent on listing with "any" business directory service - most of which will require no ID from me at all, I'm sure.
Is this really what $400 worth of ID checking boils down to with these companies? That's the bit that really irritates me.
Matthew Fender Send private email
Thursday, September 05, 2013
You're right, it's stupid.

All you need to do is register with 192.com, get the certificate, then use 192.com's "Hide Business" feature to hide yourself again.

And assuming you weren't already registered with these directories, there's nothing to stop anyone else from doing the same thing, with any phone number they choose.
Richie Hindle Send private email
Thursday, September 05, 2013
Seems like it would be cheaper and less error prone for them to SMS a code to your number, then get you to enter the code into their website when you are signed in.
Scorpio Send private email
Thursday, September 05, 2013
I assume they need a landline number - at least, that is what I have given them. But surely they can just call it - maybe ask me to read a code that they had emailed or something. Bizarre and irritating.

I'm sorely tempted to use this as an excuse to cancel the renewal, and get a Comodo certificate for $80 - at least I won't feel as aggreived by their lazy authentication. I'm just a bit scared of the whole "change certificate" thing, with a ClickOnce deployment. Mind you, renewing a certificate might be effectively the same thing.
Matthew Fender Send private email
Thursday, September 05, 2013
Ran into the same issue with Comodo last year.

"For Callback verification we need to verify the phone number in online phone directory. So kindly update your company name "...", address and phone number in any of the online business directory [...]"

I replied:

"Regarding online phone directories, we don't really use those here in Russia... my company is not registered there at all, therefore I cannot update the listing. But if you want to make a call, feel free to do it: [phone number]."

They understood, called me the next day and I got my cert :)
Kuzmitskiy Dmitry Send private email
Thursday, September 05, 2013
Even for a landline, they could use an automated system, or depending on your telecoms provider, it may convert SMS to speech automagically. I discovered that when I accidentally sent a text some a friend's landline and they got a voicemail with the text read out.
Scorpio Send private email
Thursday, September 05, 2013
Well I cancelled that order and I've signed up with Comodo. I guess I'll just have to do whatever they ask to get the cert, but at least this one is less than half the price. I originally went with a renewal of my existing one because I thought it would be less hassle, but after about 5 back-and-forths, and then the last email where they said they could still use my old Australian number (I am in the UK now), I gave up.

How signing up for Yell or 192.com gives them any sort of verification over and above simply giving me a call is beyond me but I guess someone came up with the rules, and that's what they are..
Matthew Fender Send private email
Thursday, September 05, 2013
Ha! Run into exact same issue with Comodo as Dmitry Kuzmitskiy earlier this year. They would not accept any of the phone directories in which we were (semi-)voluntarily listed, and insisted that we use one of the few they found on some obscure web site I've never heard of before. Let me quote from my response:

"The page at the link you have provided points to a resource that is not working (*URL withheld* - returns HTTP error 403), and, more importantly, to a resource (*name withheld*) that illegally hosts stolen vehicle registration databases:

*URL withheld*
*URL withheld*
*URL withheld*

and databases with private addresses, also stolen from some government agency:

*URL withheld*

I have found myself in that database and I am furious!

Are you saying you trust criminal resources?"

I ended up registering in the only directory that looked legit and working. I have to renew another certificate soon, will see if they still use those other directories.
Dmitry Leskov Send private email
Friday, September 06, 2013

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics
Powered by FogBugz