Re: [cnit] [stir] draft-peterson-stir-threats-00.txt

[Stephen Kent <[e-mail]>]

Henning,

> As a thought experiment, Kumiko Ono and I had published a draft
>
> http://tools.ietf.org/html/draft-ono-dispatch-attribute-validation-00
>
> to allow third parties to validate property information. If the 
> validating party (e.g., a bank regulator) is willing to sign a 
> certificate, similar in spirit to the framed gold-leaf diplomas in 
> your dentist's office or, more lowly, to the health departments rating 
> in a restaurant window, and it can be tied to a phone number, this 
> shouldn't be too hard.
>
> It's a bit harder if the certifying authority (regulator, Realtor 
> board, local bar association, ...) is not involved.
>
The tricky part is ensuring that a certificate (using the term broadly) 
issued by some
organization is not interpreted by relying parties as meaning more than 
it should.

It is not clear to me that most entities are good choices for the 
binding of a name
to a phone number. In part this is because these entities do not 
consider the phone
number to be a critical aspect of the attributes for which they vouch.

My dentist's diploma is valid irrespective of the location (much less 
the phone number)
for his office. BTW, as the geographic boundaries for area code change, 
phone numbers
change. My home didn't move and it took a while for many of the records 
held by other
parties to be updated. So, no, I would not rely on many parties of the 
sort you seem to suggest,
to issue a credential binding my name to a phone nmber

Steve