>
>My understanding of the business model was similar to an organization
>like the Better Business Bureau; the customers are the ones paying to
>be certified, because being certified gives them some extra
>legitimacy. BBB is able to do this because they have built up public
>trust; essentially they're a reseller of public trust. If they do a
>poor job of screening, it reflects poorly on their customers, and
>trust in them is reduced.
>
>CAs serve a similar function. If they have no public trust, what do
>they have to sell? Surely people don't pay them 50-100 bucks for the
>5 seconds of CPU time it takes to sign the certificate...
>
>
>
The difference between CAs and the BBB is that the BBB is well known and
highly accountable. CAs are not necessarily.
There is no widely screened public discussion or understanding of the
function of CAs. The accepted root CAs do their jobs on the browser
entirely in the background. Their "seal of approval" is considered
implicit by the lack of a message at all.
Therefore, when a CA screws up, all the CA has to do is say "Mea Culpa -
it wasn't that way when we approved them." and they wash their hands of
it and only a very small percentage of people (who are more likely to be
labelled paranoid than listened to by the masses) are ever actually
talking about it.
The same is not true of the BBB and as such the argument that there's a
valid trust relationship there is invalid. There is no relationship
between the end user and the CA in the first place, nevermind a trusted one.
>
>My understanding of the business model was similar to an organization
>like the Better Business Bureau; the customers are the ones paying to
>be certified, because being certified gives them some extra
>legitimacy. BBB is able to do this because they have built up public
>trust; essentially they're a reseller of public trust. If they do a
>poor job of screening, it reflects poorly on their customers, and
>trust in them is reduced.
>
>CAs serve a similar function. If they have no public trust, what do
>they have to sell? Surely people don't pay them 50-100 bucks for the
>5 seconds of CPU time it takes to sign the certificate...
>
>
>
The difference between CAs and the BBB is that the BBB is well known and
highly accountable. CAs are not necessarily.
There is no widely screened public discussion or understanding of the
function of CAs. The accepted root CAs do their jobs on the browser
entirely in the background. Their "seal of approval" is considered
implicit by the lack of a message at all.
Therefore, when a CA screws up, all the CA has to do is say "Mea Culpa -
it wasn't that way when we approved them." and they wash their hands of
it and only a very small percentage of people (who are more likely to be
labelled paranoid than listened to by the masses) are ever actually
talking about it.
The same is not true of the BBB and as such the argument that there's a
valid trust relationship there is invalid. There is no relationship
between the end user and the CA in the first place, nevermind a trusted one.
-Barry
[ reply ]