Re: [saag] post-X509 cryptographic identities

[Henry Story <[e-mail]>]

> On 11 Feb 2020, at 18:45, Nico Williams <[e-mail]> wrote:
> 
>> 
>> The same is true of X509. It can also work to verify identifiers for
>> web sites, and Let’s encrypt does a great job for that. 
> 
> WebPKI can never have a root.  WebPKI is already decentralized.
> 
> The problem with WebPKI is not lack of a root nor centralization, but
> lack of name constraints.
> 
> DNSSEC has name constraints fully built-in to the system.

I am not arguing against DNS-SEC Dane nor X509, but to
enlarge one’s view of how names get meaning. Those
two systems only allow one to tie a name to a referent.
They don’t give the meaning of a name, which it squires by
how it is related to other entities.

This is similar to ideas from Category theory, that
an object in a category is determined by its relation
to all other objects in that category. One does not
need the relation to all other things to be visible, for
a web site, but one needs more than a name. 

Paying Certificates provide a little more: an address. But that
is static, and epistemologically quite problematic: who knows
all geography so well that they can tell from an address 
where the site is located? 

> 
>> I explain what is is good and what the limitations are in
>> "Stopping (https) phishing"
>> https://medium.com/cybersoton/stopping-https-phishing-42226ca9e7d9
> 
> Phishing is a whole different and separable issue.  The fundamental
> problem with phishing is that humans too-easily fall for scams, and no
> authentication technology can stop this.

How can you ever improve your system if you start with such a
flawed psychological theory? 

Humans are not stupid. They have limited time to dedicate to
the task of understanding where an web site is located. This
could be improved by making the information
 1) enriching the information provided to be interesting and relvant
 2) by making the information dynamic
 3) and making it visible to the users.

You can’t do anything in the User interface of interest with the
information provided in certificates currently. That is just because
the information is so poor, and it is so poor because no private
entity wants to risk certifying more information than the minimal
amount. 

> 
>> But one has to think much bigger and from an epistemological point
>> of view. That is one has to consider what it is that the user of
>> a browser can learn from the information given to him.
> 
> See above.  Humans are stupid and fall for scams too easily.  Technology
> cannot provide a complete answer to that.

That is equivalent to the standard argument from epistemological skepticism,
you cannot know that you are not dreaming, so how can you know anything.

It is not because you cannot remove all potential security threats, 
that you cannot make big steps forwards.

> 
>> Currently one learns nearly nothing from an X509 certificate. Nothing
>> that is interesting enough and useful enough to a user, that they
>> would feel like looking there. And nothing that really helps establish
>> trust in an international environment. That requires one to tie these
>> into rich data provided by legal systems tied into a ”Web of Nations” 
>> https://co-operating.systems/2019/07/29/Web_of_Nations.proposal.pdf
> 
> See above commentary about name constraints.

Clearly you did not spend any time reading any of the links I sent
there. As you would see that my point is not that naming is broken
but that the linking between the names is non existent.

Henry