Re: [saag] Direct trust between users

[Michael Richardson <[e-mail]>]

Nico Williams <[e-mail]> wrote:
    > Long long ago I used to imagine the U.S. postal service selling what
    > you might call EV user certificates: after all, there are post offices
    > everywhere and their staff are trained in validating government-issued
    > IDs, often they're even notaries public!  I supposed one might even be
    > able to get attribute certs attesting that the holder of the key is,
    > e.g., a citizen, or over 18 years of age.

Canada Post had a key in the browser list for a decade or so, and there was
some project with Entrust to do something, but I don't think it ever
happened.
I also don't understand why I have a scanned PDF from ic.gc.ca as a corporate
identity, and not a PKIX certificate. They've had all the software to the
PKIX key for 20+ years.

The post-office is unique in that it can get a letter to many people within
24h, rather cheaply, and I keep thinking that this is a better 2FA (or 3FA) for
account recovery.

    > But why did this not happen??  Did anyone even try?  Would you?  How
    > would one make it happen?  How much can be done without having to hire
    > a lobbyist to lobby Congress or 50 State legislatures?  Has this been
    > done outside the U.S.?  If so, was it a success?  If so, can that be
    > used to make it happen elsewhere?

Canada Post is among the most technologically incompetent organizations ever.
They are captive for big consulting companies, and I think that the big
consulting companies couldn't figure how to turn such an effort into a profit
center for *them*.  I figure that is the reason.

    > For example, suppose you gave away to the postal service cheap devices
    > for use at post offices for the purpose of enrolling users, then let
    > the postal service charge a fee for providing the service, with you
    > keeping either a nominal portion or even none of the fee.  What would
    > be the legal barriers to making that happen?

    > Upside: you won't need to train their employees in how to validate IDs.
    > Downside: risks being more of a political than business relationship.

Maybe Amazon has the clout with the Post Office to make that happen :-)
[I say with only half tongue-in-cheek]
  "Alexa, please renew my certificates"

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-