Re: [saag] Direct trust between users

[Nico Williams <[e-mail]>]

On Thu, Apr 25, 2019 at 04:44:15PM -0400, Phillip Hallam-Baker wrote:
> On Thu, Apr 25, 2019 at 11:48 AM Michael Richardson <[e-mail]>
> wrote:
> > Nico Williams <[e-mail]> wrote:
> >  > Long long ago I used to imagine the U.S. postal service selling
> >  > what you might call EV user certificates: after all, there are
> >  > post offices everywhere and their staff are trained in validating
> >  > government-issued IDs, often they're even notaries public!  I
> >  > supposed one might even be able to get attribute certs attesting
> >  > that the holder of the key is, e.g., a citizen, or over 18 years
> >  > of age.
> >
> > Canada Post had a key in the browser list for a decade or so, and
> > there was some project with Entrust to do something, but I don't
> > think it ever happened.
> 
> The US Post office had a series of proposed schemes as well. None of
> them ever got anywhere because we poached their staff as fast as they
> could train them.
> 
> Every 18 months some political appointee would attempt to start some
> information superhighway effort. A team would be staffed up in the
> USPO and learn about PKI. About twelve months in, they would be all
> nicely trained up and we would show up and offer double their salary
> plus stock.

Oh.  That's the reason?  This is the sort of thing that should be setup
via a contract with an external party, then this sort of "sabotage" (no
offense intended) is much less likely (the external party won't want to
be in breach).

> > The post-office is unique in that it can get a letter to many people
> > within 24h, rather cheaply, and I keep thinking that this is a
> > better 2FA (or 3FA) for account recovery.

You don't need them to do anything special for that.

And note well that the post service generally doesn't know how to
contact people -- it depends on the sender to furnish the recipient's
address.  I.e., the postal service is like a network layer 3, and there
is no DNS for it.  If the postal service were to sell certificates and
also use postal delivery for 2FA, they'd have to know where you live --
"know" in very different sense from "they seem all the letters go by, so
they could know where everyone lives".

> There is a classical problem called the innovator's dilemma that
> actually mitigates against realizing such efficiencies.

That and the fact that postal services are generally publicly owned and
operated, so there's very little incentive for them to innovate.

> > > Upside: you won't need to train their employees in how to validate
> > > IDs.
> > > Downside: risks being more of a political than business
> > > relationship.
> >
> > Maybe Amazon has the clout with the Post Office to make that happen :-)
> > [I say with only half tongue-in-cheek]
> >   "Alexa, please renew my certificates"
> 
> It could be made to happen. But the way to make it happen would be to
> design a system that is capable of
> 
> 1) Solving a very small stand alone problem by itself
> 2) Application to problems of arbitrary size.

Hmm, because these certificates couldn't be short-lived... the issuer
would have to support revocation, and probably record all issued
certificate serial numbers and names.  Not trivial, though still not
very difficult.  OTOH, if such certificates are strongly bound to
_devices_, then you can push the revocation burden to that layer, and
make the issuer O(1) -- that being key to (2).  (1) is already met, I
think.

Nico
--