Re: [saag] post-X509 cryptographic identities

[Henry Story <[e-mail]>]

> On 13 Feb 2020, at 23:20, Nico Williams <[e-mail]> wrote:
> 
> On Thu, Feb 13, 2020 at 05:02:16PM -0500, Tony Rutkowski wrote:
>> All important electrical communication identifier systems invariably end up
>> at the point of nation state regulation. Consider what is occurring now with
>> telephone CallerID which went through a full cycle of regulation to
>> deregulation to re-regulation.  There are several compelling bases.  On one
>> side, nation states have sovereign jurisdiction over all communication
>> within their geospatial boundaries and assert it for a swath of national
>> security and law enforcement reasons.  On the other, the providers seek
>> indemnification (antitrust and tort) and the end users an expectation of
>> trust and consumer protection.  Consider it a recognition of relevance.
>> 
>> The DARPA DNS itself went through a cycle of strong government regulation to
>> deregulation to Ira Magaziner's scheme for healthcare governance (a/k/a
>> ICANN) and now likely to re-regulation or irrelevance.
> 
> I am in full agreement.
> 
> It is fair to predict that anything new that might replace WebPKI or DNS
> will have to deal with regulation of registries eventually, and should
> be designed with it in mind.
> 
> I'm just quite skeptical that the DNS could be replaced.  The protocol,
> perhaps, some of the details, sure, but domainnames?  the registries?
> nah.  Anything new will have to be in-addition-to DNS for a long time,
> or bolted-onto DNS (e.g., DANE).

Indeed a lot has been built on these, and one can build a lot more.

> 
> Back to Henry S.'s call for more public metadata...  More metadata
> doesn't help the user.  E.g., when I need some less-well-known app from
> an app store, I often find apparent dups by different vendors, and it's
> hard to tell which one is legitimate if any, and the vendor names
> (metadata) often don't help in the least because they are obscure enough
> that the user can't really do anything with them -- the user is entirely
> at the mercy of the curators, and the curators are obviously not doing a
> good enough job.  Requiring more public metadata may not help at all,
> not without lots more regulation and off-line authentication of said
> metadata, with attendant problems.

Metadata just as data by itself is not the answer, of course. It all
depends on who is making the claim. If someone in a bar tells you
to take some medicine, it has a different value than if your
doctor tells you exactly the same thing in his office, even if both
use exactly the same words. 

So I am not making a call for "more public metadata” as if it were a question of quantity. What is important is for official enforceable 
data to be standardized so as to be useable by browsers and the OS to
help inform the user about what web site they are visiting for example,
or who is responsible for writing an app running on their device.

If an App store is to be thought of as a service that verifies application
then the only added data that legitimately the Store needs to assert is that they verified App ”TicTacToe” (to take an arbitrary example), that came from 
company <https://tictacktoe.example/> registered at <https://regitry.ca.us/co/TickTackToeCorp>.  

In terms of BAN logic of "saying that” [1] we need to distinguish who says what. Whether later you sign that statement or refer to a statement
someone else made is not logically that much of a difference.

AppStore says { <ttt> a VerifiedApp;
                      :verified <apps/ticktacktoe/>;
                      :source <https://tictacktoe.example/app/ttt>;
                      :builtBy <https://regitry.ca.us/co/TickTackToCorp> }
     
We think of { … } as quotes.
Of course if you download the info from AppStore’s web site then you won’t find AppStore says { … } just as when one speaks to someone one does not start every sentence by saying ”I say …”. That is something inferable from the pragmatic context, and verifiable on the web through TLS authentication 
for example. 

Still you may wonder: how do I know I am on the AppStore? 

Well it works for Apple and Android because their marketing power
is good enough that they can teach everyone in the world to remember
their URL (or indeed build it into their OS). 

But most other companies have to rely on trust because the links to real government registrars with legal clout is not there. If it were there it
could provide completely new security for Apps as I describe in this short
post applying Modal Logic used in Epistemology to User Interfaces.

https://medium.com/cybersoton/phishing-in-context-9c84ca451314

Henry


[1] https://en.wikipedia.org/wiki/Burrows%E2%80%93Abadi%E2%80%93Needham_logic
https://www.sciencedirect.com/science/article/pii/S1571066107000746

> 
> PS: The telephone system has the great misfortune of being stuck with
>    SS7; the DNS is ahead on security.