[EMAIL PROTECTED] wrote: > On Thu, Nov 30, 2006 at 02:09:27PM -0800, James G. Sack (jim) wrote: >> Relying on any such "authority" as is provided built-into browsers, >> seems shaky strategy (at best). Why should I trust the certs of the CAs >> themselves -- the only argument is that the software vendors, and hence, >> a lot of other people do. As you say, trusting the reliability of the >> CA's certification process is a second weak link. > > How about if there was //one// CA you liked and you just trusted anything > signed > //only// by them? Then you would only have to import their cert into your > browser > to be golden!?
Basically, yes. That's what I meant by trusting my own CA. Delete all the stock authorities and import my own trusted CA cert. Self-signed, even .. paying Verisign to sign my cert doesn't increase my trust in my own cert. Of course, I have to distribute my CA cert to my correspondents. > >> Lacking private capabilities, I would guess that web-of-trust systems >> might be more sensible than a common authority system. > > I'm not familiar with the web of trust but would business go for it? Web-of-trust is the idea behind PGP. Probably jhriv can spout more about it, but the idea is I trust myself (of course, implicitly), and I trust my good buddies, as well as trust _some_ of them enough to trust whomever they call trustworthy. I assign & record those trust strengths in my own database. If there exists a strong enough "trust-strength measurement", I would trust someone I had never met, even. Would business go for it? I'd guess not-bloody-likely! Not as much as a system traceable to God, or JEdgarHoover, or GWB, or some equally "ultimately-trusted" authority (by which I mean that I can't be fired for that security decision). Whom do you trust? Not a trivial problem, is it? Regards, ..jim -- [email protected] http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list
