Re: [pkng] More thoughts: Privacy

[Peter Saint-Andre <[e-mail]>]

On 11/17/09 2:04 PM, Massimiliano Pala wrote:
> Hi PK-NGers,
> 
> I would like to add one aspect that I think could be an important addition
> to current PKIs. Indeed, what we have today is a complete disclosure of
> one's
> identity. PKI protocols have been designed without taking into any account
> privacy concerns.
> 
> As many of the ideas I read on the list are related to easily extend trust
> by somehow linking together different infrastructures, I think that we
> shall
> keep in mind that privacy is very important when linking together different
> organizations/authorities.
> 
> I tried to make the point on the PKIX list (I guess most of the people here
> are also subscribed to that list) about the OCSP - currently the answer in
> traditional PKI is using SSL/TLS for communication between peers - but that
> would not solve the problem on the OCSP server, its logs and how policies
> should take care of how to handle that data. If the data on the server's
> log
> is sufficiently anonymized, then it is easier to federate identities and
> outsource services or relying on 3rd party servers.

I think this is a policy issue for providers of PK* services (just as it
is for providers of email services, IM services, microblogging services,
and all the rest). Now, I agree that better disclosure of policies will
help humans make more informed decisions (if they care to be informed).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/