Re: [saag] Direct trust between users

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Apr 25, 2019 at 5:28 PM Nico Williams <[e-mail]> wrote:

> On Thu, Apr 25, 2019 at 04:44:15PM -0400, Phillip Hallam-Baker wrote:
> > On Thu, Apr 25, 2019 at 11:48 AM Michael Richardson <
> [e-mail]>
> > wrote:
> > > Nico Williams <[e-mail]> wrote:
> > >  > Long long ago I used to imagine the U.S. postal service selling
> > >  > what you might call EV user certificates: after all, there are
> > >  > post offices everywhere and their staff are trained in validating
> > >  > government-issued IDs, often they're even notaries public!  I
> > >  > supposed one might even be able to get attribute certs attesting
> > >  > that the holder of the key is, e.g., a citizen, or over 18 years
> > >  > of age.
> > >
> > > Canada Post had a key in the browser list for a decade or so, and
> > > there was some project with Entrust to do something, but I don't
> > > think it ever happened.
> >
> > The US Post office had a series of proposed schemes as well. None of
> > them ever got anywhere because we poached their staff as fast as they
> > could train them.
> >
> > Every 18 months some political appointee would attempt to start some
> > information superhighway effort. A team would be staffed up in the
> > USPO and learn about PKI. About twelve months in, they would be all
> > nicely trained up and we would show up and offer double their salary
> > plus stock.
>
> Oh.  That's the reason?  This is the sort of thing that should be setup
> via a contract with an external party, then this sort of "sabotage" (no
> offense intended) is much less likely (the external party won't want to
> be in breach).
>

It wasn't on purpose.

It was only after going into the account for the third time that I suddenly
realized it was very unlikely we would make the sale as long as our
headhunters were head hunting.

Yes, a different structure was needed.