Re: [perpass] tcpcrypt applicability (Was: Re: Violating end-to-end principle: I-D Action: draft-farrelll-mpls-opportunistic-encrypt-00.txt)

[Phillip Hallam-Baker <[e-mail]>]

I find it rather interesting that someone who takes great offense when it
is pointed out that he works under contract to the NSA goes after people
for having a 'hidden' agenda.

If you want to start questioning people's ulterior or bought motives you
are sawing off a mighty fine branch there and its the one you are standing
on.

Is the reason that you are arguing against Omnibroker so hard because
someone in Fort Meade is getting nervous? Maybe they should, they had three
people come to see my first public talk on PRISM-PROOF email. Or is it
impolite for me to ask such questions because you are the only person
allowed to call people's motives into question?


I have made absolutely no secret of the fact that Omnibroker provides a
business model for CA like companies. In fact that is the basis on which I
have presented it to Symantec and McAfee and other anti-virus companies
precisely to solicit support. As far as I am aware, they are not
communists. Neither is my employer.

Changing the Internet is hard. You can't change it unless your scheme is
actually free or backed by a business model that covers the costs. I can't
remember at this stage whether I talk about the business model in part 1 or
2, I haven't got round to editing part 2 yet:

http://www.youtube.com/watch?v=PTKrt471vTU

I talk about business models because I understand that I can't change the
infrastructure alone. I need the help of Microsoft and Google and Apple and
Mozilla. And they are not likely to be interested in a business model that
only fits one provider.

What we need to get away from is the clueless business models of the past.
CAs add real value in the WebPKI but not very much to the MailPKI currently
which is why there isn't one, or rather isn't very much of one. A model
that makes CAs toll booth collectors before the road is built does not work.

But CAs can certainly add value to a MailPKI infrastructure once it reaches
critical mass. Today maybe 0.01% of Internet users know enough about crypto
to configure their systems securely themselves. That may rise to 5% or so
with training etc. That leaves a huge market for CAs. If a billion people
want to use crypto to protect themselves against the panicking generals
that run the NSA, we will find ways to make money.

The Open Source model works fine for many software products. Red Hat does
pretty well.

But we are taking a risk here. Comodo group has 155,000 paid, non expired
S/MIME certs right now. So changing the model could backfire on us. But
thats a risk we have decided to take.


On Wed, Jan 22, 2014 at 9:47 AM, Stephen Kent <[e-mail]> wrote:

> PHB,
>
> I'd respond to your comments if they were directly tied to specific
> statements
> I made. But, for the most part, they are so vague ...
>
> WRT Omnibroker, my comment was not based on key agreement being part of
> Omnibroker;
> it was an observation that your recent proposals all tend to focus on
> technologies that
> fit nicely into a model where you current employer could generate a
> revenue stream,
> as an extension of its current Web PKI CA model. I have not tracked the
> evolution
> of Omnibroker, as it is an individual submission. Since such submissions
> are
> not vetted, it's not generally worth my time to track them.
>
> Steve
>



-- 
Website: http://hallambaker.com/