It falls between two stools of being too expensive for most home users to buy one (so 99.7% of my regular correspondents don't have a CA validated cert.), and yet too cheap to issue properly (so several % of CA issued certs weren't properly validated anyway).

If we make it cheap and easy enough so that most people have one, they will be issued by every corner store and it will be trivial to obtain a fake. If we make the verification process at issue sufficiently rigorous, hardly anyone will have one and they will only be used for B2B.

The only solution to this that I can see is the X.509 certs should be issued solely by governments, and made available for free as a public service.

(A third, lesser issue is semantics; the issue of an X.509 cert can have more than one human-centric possible meaning, and no client tools currently available make that meaning clear.)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/404/33716#33716