Re: [saag] Direct trust between users

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Apr 25, 2019 at 11:48 AM Michael Richardson <[e-mail]>
wrote:

>
> Nico Williams <[e-mail]> wrote:
>     > Long long ago I used to imagine the U.S. postal service selling what
>     > you might call EV user certificates: after all, there are post
> offices
>     > everywhere and their staff are trained in validating
> government-issued
>     > IDs, often they're even notaries public!  I supposed one might even
> be
>     > able to get attribute certs attesting that the holder of the key is,
>     > e.g., a citizen, or over 18 years of age.
>
> Canada Post had a key in the browser list for a decade or so, and there was
> some project with Entrust to do something, but I don't think it ever
> happened.
>

The US Post office had a series of proposed schemes as well. None of them
ever got anywhere because we poached their staff as fast as they could
train them.

Every 18 months some political appointee would attempt to start some
information superhighway effort. A team would be staffed up in the USPO and
learn about PKI. About twelve months in, they would be all nicely trained
up and we would show up and offer double their salary plus stock.

I also don't understand why I have a scanned PDF from ic.gc.ca as a
> corporate
> identity, and not a PKIX certificate. They've had all the software to the
> PKIX key for 20+ years.
>

Yeah, sorry 'bout that.


> The post-office is unique in that it can get a letter to many people within
> 24h, rather cheaply, and I keep thinking that this is a better 2FA (or
> 3FA) for
> account recovery.
>

There is a classical problem called the innovator's dilemma that actually
mitigates against realizing such efficiencies.

    > Upside: you won't need to train their employees in how to validate
> IDs.
>     > Downside: risks being more of a political than business relationship.
>
> Maybe Amazon has the clout with the Post Office to make that happen :-)
> [I say with only half tongue-in-cheek]
>   "Alexa, please renew my certificates"
>


It could be made to happen. But the way to make it happen would be to
design a system that is capable of

1) Solving a very small stand alone problem by itself
2) Application to problems of arbitrary size.

I am just writing my submission to the deployment workshop (which I wont be
able to attend but thought I would submit to anyway). The paper describes
the approaches we took in the Web.

People think we just sat in our offices at CERN and waited for the Web to
take off. We didn't we were busy pushing it as hard as we could long after
the Web was a success. One of my big fears was that the press that had been
building us up for so long would decide it was time to try and take us
down. They did - see the Time-Warner 'Cyberporn' article.