Re: [saag] Channel binding is great but not a silver bullet

[Stephen Kent <[e-mail]>]

At 12:08 PM -0500 3/2/09, Jeffrey Hutzelman wrote:
>--On Monday, March 02, 2009 10:00:36 AM -0600 Nicolas Williams 
><[e-mail]> wrote:
>
>>Yes, but if we solve the mutual authentication case then for the cases
>>where we don't need mutual authentication we can probably live with a
>>weak PKI.
>
>No, that is not true.  These days, people routinely establish new, 
>real business relationships online.  Companies like Amazon and 
>PayPal depend on this model, and so do smaller merchants who 
>probably number in the millions.  In many cases, consumers engage in 
>a single transaction with such a merchant and there is _never_ any 
>enrollment.
>
>Mutual authentication plus channel binding is a great model for some 
>things, but expecting to use off-line enrollment for everything 
>forever is a non-starter.
>
>-- Jeff

Jeff,

i think it is important to note the role of credit card companies in 
making these business relationships viable.  I am willing to do 
business with an unknown, online, merchant based in large part on my 
ability to decline payment if the merchant misbehaves.

Steve