Re: [saag] post-X509 cryptographic identities

[Henry Story <[e-mail]>]

> On 11 Feb 2020, at 20:17, Nico Williams <[e-mail]> wrote:
> 
> On Tue, Feb 11, 2020 at 07:05:01PM +0100, Henry Story wrote:
> 
> [Quoting out of order]
> 
>> You can’t do anything in the User interface of interest with the
>> information provided in certificates currently. That is just because
>> the information is so poor, and it is so poor because no private
>> entity wants to risk certifying more information than the minimal
>> amount. 
> 
> This is one thing we can improve: the binding of HTTPS URL authority to
> an actual owner.  The certificate is useless, indeed, and cannot bring
> any more metadata into the picture than the hostname -- the binding of
> that to authorization by a proper owner is essential, and the WebPKI
> cannot provide this well enough.
> 
> Providing _more_ metadata likely won't help human users: they can barely
> cope with the concept of a domainname, let alone more stuff.

I believe you are drawing completely the wrong conclusions from the
data. In my view they can’t cope with the domain name info because
it is completely uninteresting (given the many other tasks they are
involved in when using the Web). 

Just try to think your way back to a user first discovering the 
certificate description box. What information do they find there
that would warrant them coming back? Do they find a telephone number?
Shop opening times? information about if the CEO landed in Jail?
No. They may just find a URL. Why would anyone ever come back?

They then find that a certificate authority signed it. Who is that CA?
No idea. 

Now adding more data does not of course help if you don’t display it
intelligently. That is what designers make their profession. But they
can’t do anything if there is nothing to display.

> 
>>> On 11 Feb 2020, at 18:45, Nico Williams <[e-mail]> wrote:
>>> DNSSEC has name constraints fully built-in to the system.
>> 
>> I am not arguing against DNS-SEC Dane nor X509, but to
>> enlarge one’s view of how names get meaning. Those
>> two systems only allow one to tie a name to a referent.
> 
> I don't think I implied that you were.
> 
>> [...]
> 
> You're headed right for the identity problem, and thorny problems in
> philosophy like the Ship of Theseus problem.

The Ship of Theseus problem is the ancient puzzle that asks if the ship
is the same if one changes one plank, then another, … until one has
changed all planks.

That is: it is about the identity of a changing thing over time. When is 
it the same and when is it other? The answer depends on one’s criteria of identity for a given type of thing. Usually opinions vary.

In our situation the question would be: when is the site the same 
and when different?  Is it different 
- when a page changes? No
- when the owners change? Perhaps…
- if the owners stay the same but move to different country? …
   what if that country is at war with yours?

Importantly: this criterion of identity does not need to be decided once and
for all, in abstraction of all individual cases. 

The user can decide on a set of policies to make him aware 
depending on his relation to the owner of the domain. Eg. 
a user that has a contracts with that domain, would be very 
interested in knowing that a web site has changed legal space.
Someone going to a restaurant may be very interested if the cook
changed.

These criteria can be set by the user and these may be enhanced
in some countries by legal requirements. Eg. an owner can’t claim
his web site is different and that he does not have to abide
by his contracts because he changed a page.

> 
> You will not find an answer to these problems in cryptography.

I agree. 

> 
> All of our naming schemes have a layer of indirection where the tie to a
> physical entity is weak (a physical entity whose own "identity" is
> weak).

yes. My claim is that one needs to tie these into national or regional
institutions that have been set up for over a century to do this job.
The UK has a company index called Company House that has JSON machine
readable versions of their records.

See the curl example on 
https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9


> 
>>>> I explain what is is good and what the limitations are in
>>>> "Stopping (https) phishing"
>>>> https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9
>>> 
>>> Phishing is a whole different and separable issue.  The fundamental
>>> problem with phishing is that humans too-easily fall for scams, and no
>>> authentication technology can stop this.
>> 
>> How can you ever improve your system if you start with such a
>> flawed psychological theory? 
> 
> Oh?
> 
>> Humans are not stupid. They have limited time to dedicate to
>> the task of understanding where an web site is located. This
>> could be improved by making the information
> 
> Humans are _often_ quite stupid.  Not always, but also not never.
> 
>> 1) enriching the information provided to be interesting and relvant
>> 2) by making the information dynamic
>> 3) and making it visible to the users.
> 
> You quickly run into issues.  UIs that are too busy.  Different people
> having different attention spans, different likes and dislikes for UIs.
> 
> There is no one-size-fits-all UI.

Exactly. That is why UIs have to be personalized. It’s not an easy job,
but it is not impossible. Look at how many people are using Unix now
that it has a GUI called Android or one called iOS. (In the early
1990ies people would laugh if you told them that Unix would be
widely used because they would boggle quite rightly at the idea
that everyone would use the command line).

> 
> Browser developers have been struggling for decades with this problem.

yes, because there is no information for them to work on!

> 
> "Look to epistemology" is a platitude.

Btw. I don’t just say ”Look to epistemology”.

I have an analysis of where the problem comes from, and some suggestions
on where one has to look to fix it. It is not easy to see, because
it is in very different place from where the IETF has its focus
(to simplify: protocols) whereas here we are thinking of linking
nations into a peer to peer decentralized social network: a Web
of Nations, in order to provide users information about the legal space
of web sites they are in. So one has to have a view of the whole space
of what makes an individual: what they do, the society they are in, the relations of those societies to each other and to yours, … and the tools
they are using which transforms the above space.



> 
> Nico
> --