Bob Relyea wrote: > The definition of 'vetted' means the CA has a CPS that restricts > this. There are Strong market forces that operation on 'serious' CA's > to prevent this from happening. Verisign is highly unlikely to issue > an SSL cert to any government (including the US), for any domain name > other than the appropriate .gov domain owned by the government. Such > action would amount to immediate legal action against Verisign, as > well as a loss in trust which is the whole value associated with the > company. The 'vetting' process includes checks to make sure that the > CPS *IS* followed. The goal of any vetting process would be to make > sure such a CA could not be tricked or coerced into violating their > CPS.
As Ian just pointed out in another post, a gag order + an order to comply would break virtually all CPS' that any CA had vetted...
One of the changes to CAcert's constitution we're planning is to include a clause that we'd rather shut-down then be coerced into anything, how many commercial CAs could claim the same to protect their user base, and/or the community at large?
> That can be done today, without adding any new CA's into the browser, > though it does have a prerequisite of removing *ALL* CA's from the > browser to make sure (assuming the ultra-paranoid). I'm just picking
If my life was on the line I think I'd want to be ultra-paranoid...
> up your argument. You said we would be better off and safer if > security was more pervasive, but meaningless authentication. I > explained that your example would not be more secure, and now you > counter that PKI doesn't matter in that situation!
Not sure what you meant by meaningless authentication, my whole point resolves around the fact there is so much money involved in the PKI industry that it's not hard to loose sight of the fact security is supposed to be the reason for doing all this, but I often wonder if companies go through all this just for the money and beyond an audit don't really give a damn about security...
> They haven't pushed because the encryption genie is a out of the bag. > Al-Queda can grab their own versions of security software, build > their own trust domains, and communicate securely with its members no > matter what the government does in this area.
Almost as amusing as the headline on theregister.co.uk about some Iraq
general, was something like "mistakes mobile phone for cloaking device",
while it may be out of the bag I doubt it's out of their minds,
everything to date seems as much or more aimed at internal security and snooping powers in the US domestic area then spying on people outside of the country, why else would they want checks on domestic flights?
> BTW sorry if I tend to rant on this it's because "partial security" > is a pet peeve of mine. It's more dangerous than no security because > it invites people to 'trust' connections more than they should. > 40-bit encryption is another area. 40-bit encryption only tags > messages as 'interesting to look at'. What you are proposing is > another form of the 40-bit encryption problem. We *CAN* build secure > systems. We *SHOULD* build secure systems. We *SHOULD NEVER* build > systems that are only partially secure, but broken in fundamental > ways. Also, the scenario you just blithely threw out is one that I > care deeply about getting right.
One of the local police forces in Australia not only expected people to use 40bit encryption to supply "anonymous" tip off's to them, they even boasted the fact it was "high" security... Not to mention the fact they were using IIS but that's another kettle of fish...
-- Best regards, Duane
http://www.cacert.org - Free Security Certificates http://www.nodedb.com - Think globally, network locally http://www.sydneywireless.com - Telecommunications Freedom http://happysnapper.com.au - Sell your photos over the net! _______________________________________________ mozilla-crypto mailing list [EMAIL PROTECTED] http://mail.mozilla.org/listinfo/mozilla-crypto
