Re: [pkng] More thoughts: Privacy

[Massimiliano Pala <[e-mail]>]

Hi Peter,

I understand that is a matter of Policy. Unfortunately the user has no
control over what the provider of the OCSP service does with the data
that might track one's activities (and potentially location) throughout
the day.

Some organizations like government agencies might overlook this problem
and leak data that is supposed to be kept secure. The OCSP is an example,
but my point was that if we can manage to introduce a user-machine-enforceable
(not relying only on policies decided by someone else once and for all)
we could have better coverage of the USER's need. And, also, we would
simplify policy writing and agreements for 3rd parties provided services.
The same simplification would occur in managing federated identities and
access to external resources - whenever possible, of course!

Just my 2-cents.

Later,
Max


On 11/17/2009 04:10 PM, Peter Saint-Andre wrote:
> I think this is a policy issue for providers of PK* services (just as it
> is for providers of email services, IM services, microblogging services,
> and all the rest). Now, I agree that better disclosure of policies will
> help humans make more informed decisions (if they care to be informed).

-- 

Best Regards,

	Massimiliano Pala

--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]                   [e-mail]
                                                  [e-mail]

Dartmouth Computer Science Dept               Home Phone: [phone]
PKI/Trust Laboratory                          Work Phone: [phone]
--o------------------------------------------------------------------------
People who think they know everything are a great annoyance to those of us
who do.
							   -- Isaac Asimov