It seems there is restraint of trade since only a few 'selected'
companies can get on the CA root of IE and Navigator. To pay USD 300
every couple of years to prove you exist is silly. The price of domaine
registration is coming down, why not certs since there is more e-commerce?
In the U.S. the cert only proves you have a DUNS number, a phone number,
and a fax'd copy of a state registration. Every scam artist has those.
EM
Karl Denninger wrote:
>Well, I understand that, but it seems that people (including Thawte,
>Microslug and Nutscrape) are missing the point.
>
>There are to separate things that secure web servers do.
>
>1. Authenticate who you're talking to, so that when you engage in
> commerce you have some indication that the merchant you think you're
> dealing with is really who you're dealing with.
>
>2. Encrypt the data so that it cannot be intercepted between the
> sending and receiving machines.
>
>These are NOT the same function, and needing one of them does not imply
>needing the other.
>
>Yet, in today's world, you cannot have one without the other, which means
>that to get EITHER you must pay someone.
>
>Contrast this with PGP for email, in which I can publish a public key and
>once you obtain it you're able to receive an encrypted communication from
>me and decode the traffic. My generation of that key pair does not require
>that it be "certified" by any third party.
-----------
Eric Moore
Miami, Florida
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
