Re: [Add] Browser Administrative Authority

[Melinda Shore <[e-mail]>]

To be honest I think the framing is perhaps not particularly
correct.  Right now browser vendors are mediating trust, anyway,
through their root programs and other security policy enforcement
mechanisms that are not being explicitly chosen by the user or
the ISP.  I'm really not sure what to make of

    "The problem is that some of the browser makers proposals are now
    changing this administrative authority hierarchy, but they haven’t
    done the extra work of establishing administrative trust"

given the current state of the web PKI.  (Allowing, of course,
that the current state of the web PKI may be the strongest
argument against allowing browser vendors to own trust for
name resolution.)

I think the notion that they may be choosing a DNS resolver for web
applications is not that much of a change from current practice.  I
don't really love this but it's where we are at the moment.

I do, however, think that application authors understand their
own security requirements better than ISPs do, and in that sense
may be closer to the user's intentions than ISPs are (and indeed,
user needs and ISP desires are often in conflict).  In the
absence of some standard way of allowing applications to discover
their security environment I'm pretty good (with reservations) with
them choosing their own DNS resolver and DNS transport.

Melinda

-- 
Melinda Shore
[e-mail]

Software longa, hardware brevis