Re: [Asrg] Consent Proposal

If  certs were to ever become a widespread reality I would rather have 
them come from my bank - I have a relationship with them - and not from 
some other 3rd party.

Chuck Wegrzyn

Markus Stumpf wrote:

>On Tue, Jul 01, 2003 at 08:12:17PM -0400, Yakov Shafranovich wrote:
>  
>
>>What about a central CA issuing certificates to other CAs, controlled by 
>>IANA or ICANN-type of organization?
>>    
>>
>
>You mean to set the cat among the pigeons ;-)
>What you would need is a mechanism that creates and equal level of trust.
>As soon as I get a cert from CA-1 for 5 bucks and all that is needed is
>a working email address and CA-2 requires payment of 100 bucks and you
>have to send in legal papers and stuff you will create different levels
>of trust. That's what we have now. We have DNSBLs: some use them some
>not (no trust). Some block dialin IPs some not (diffferent levels of
>trust). What if in a country some of the legal documents required by
>CA-2 simply don't exist? In the US (I believe) there is something
>called social insurance number (or the like). Maybe in Dubai (I don't
>know) such a thing does not exist and nothing similar. But this would be
>required by a CA to identify e.g. a person. Would it mean people from Dubai
>can't get signed keys?
>
>And there is a social/commercial problem:
>What if in our country the two biggest emails providers with a share of
>say 30% don't stick to that system? What would I tell my customers?
>While private customers might understand it corporate customers will
>not understand why they can't talk to business partners any longer.
>
>And: you can't add pressure, as some of the smaller ISPs will say: "as
>our customer you can still receive mail from them. Leave your current
>ISP and join us". Big deal :(
>
>  
>
>>There are mechanisms in place to check 
>>verifications of certificates in real-time, and that can be implemented as 
>>well.
>>    
>>
>
>Hmmm ... take e.g. Verisign. I'd guess they have issued the most certs.
>What do you think would be needed as infrastructure so that every
>browser accessing a SSL site can verify the cert (e.g. if revoked) in
>real-time?
>certs work, because the producer of the browser added the CA keys
>of CAs to the browser and users depend on the producers of the browser
>and these depend on the CA to "do the right thing". If a key is signed
>by a "trusted" CA it's also trusted "per definitionem". We don't have
>working revocation mechanisms.
>
>To make it clear:
>I'd be more than glad if those methods would exist. There are patches
>for nearly all Mailservers to support SSL connections (STARTTLS) but I'd
>guess the percentage of mailservers using it has a lot of 0s after the
>decimal point and in front of the 1.
>
>	\Maex
>
>  
>

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg