Re: [saag] post-X509 cryptographic identities

[Nico Williams <[e-mail]>]

On Tue, Feb 11, 2020 at 07:05:01PM +0100, Henry Story wrote:

[Quoting out of order]

> You can’t do anything in the User interface of interest with the
> information provided in certificates currently. That is just because
> the information is so poor, and it is so poor because no private
> entity wants to risk certifying more information than the minimal
> amount. 

This is one thing we can improve: the binding of HTTPS URL authority to
an actual owner.  The certificate is useless, indeed, and cannot bring
any more metadata into the picture than the hostname -- the binding of
that to authorization by a proper owner is essential, and the WebPKI
cannot provide this well enough.

Providing _more_ metadata likely won't help human users: they can barely
cope with the concept of a domainname, let alone more stuff.

> > On 11 Feb 2020, at 18:45, Nico Williams <[e-mail]> wrote:
> > DNSSEC has name constraints fully built-in to the system.
> 
> I am not arguing against DNS-SEC Dane nor X509, but to
> enlarge one’s view of how names get meaning. Those
> two systems only allow one to tie a name to a referent.

I don't think I implied that you were.

> [...]

You're headed right for the identity problem, and thorny problems in
philosophy like the Ship of Theseus problem.

You will not find an answer to these problems in cryptography.

All of our naming schemes have a layer of indirection where the tie to a
physical entity is weak (a physical entity whose own "identity" is
weak).

> >> I explain what is is good and what the limitations are in
> >> "Stopping (https) phishing"
> >> https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9
> > 
> > Phishing is a whole different and separable issue.  The fundamental
> > problem with phishing is that humans too-easily fall for scams, and no
> > authentication technology can stop this.
> 
> How can you ever improve your system if you start with such a
> flawed psychological theory? 

Oh?

> Humans are not stupid. They have limited time to dedicate to
> the task of understanding where an web site is located. This
> could be improved by making the information

Humans are _often_ quite stupid.  Not always, but also not never.

>  1) enriching the information provided to be interesting and relvant
>  2) by making the information dynamic
>  3) and making it visible to the users.

You quickly run into issues.  UIs that are too busy.  Different people
having different attention spans, different likes and dislikes for UIs.

There is no one-size-fits-all UI.

Browser developers have been struggling for decades with this problem.

"Look to epistemology" is a platitude.

Nico
--