bkfsec wrote:
> Scott Gifford wrote:
>
>>
>> My understanding of the business model was similar to an organization
>> like the Better Business Bureau; the customers are the ones paying to
>> be certified, because being certified gives them some extra
>> legitimacy. BBB is able to do this because they have built up public
>> trust; essentially they're a reseller of public trust. If they do a
>> poor job of screening, it reflects poorly on their customers, and
>> trust in them is reduced.
>>
>> CAs serve a similar function. If they have no public trust, what do
>> they have to sell? Surely people don't pay them 50-100 bucks for the
>> 5 seconds of CPU time it takes to sign the certificate...
>>
>>
>>
> The difference between CAs and the BBB is that the BBB is well known and
> highly accountable. CAs are not necessarily.
> There is no widely screened public discussion or understanding of the
> function of CAs. The accepted root CAs do their jobs on the browser
> entirely in the background. Their "seal of approval" is considered
> implicit by the lack of a message at all.
Ermmmmmm. Well, yes and no. CAs publish CPSs (Certification Practice
Statements). The purpose of the CPS is to provide: a) and auditable
statement of what the CA does when it certifies a public key at a given
level. If one doesn't like what one sees in the CPS, one doesn't need
to accept keys certified by that CA. It is up to the relying party (the
entity which needs to decide whether or not to accept a key) to read the
CA's CPS(s). The problem with PKIs is that 99.99999% of the people who
use public key cryptography are absolutely clueless when it comes to
understanding the technology, its applications or how to use it.
*/Theoretically/* CAs have *real* liabilities. BBBs don't. Having said
that, after reading the fine print in the CPSs, most disclaim things to
such a point that nailing them for anything real would not be worth the
effort . . .
See http://www.schneier.com/paper-pki.html for more info . . .
> Scott Gifford wrote:
>
>>
>> My understanding of the business model was similar to an organization
>> like the Better Business Bureau; the customers are the ones paying to
>> be certified, because being certified gives them some extra
>> legitimacy. BBB is able to do this because they have built up public
>> trust; essentially they're a reseller of public trust. If they do a
>> poor job of screening, it reflects poorly on their customers, and
>> trust in them is reduced.
>>
>> CAs serve a similar function. If they have no public trust, what do
>> they have to sell? Surely people don't pay them 50-100 bucks for the
>> 5 seconds of CPU time it takes to sign the certificate...
>>
>>
>>
> The difference between CAs and the BBB is that the BBB is well known and
> highly accountable. CAs are not necessarily.
> There is no widely screened public discussion or understanding of the
> function of CAs. The accepted root CAs do their jobs on the browser
> entirely in the background. Their "seal of approval" is considered
> implicit by the lack of a message at all.
Ermmmmmm. Well, yes and no. CAs publish CPSs (Certification Practice
Statements). The purpose of the CPS is to provide: a) and auditable
statement of what the CA does when it certifies a public key at a given
level. If one doesn't like what one sees in the CPS, one doesn't need
to accept keys certified by that CA. It is up to the relying party (the
entity which needs to decide whether or not to accept a key) to read the
CA's CPS(s). The problem with PKIs is that 99.99999% of the people who
use public key cryptography are absolutely clueless when it comes to
understanding the technology, its applications or how to use it.
*/Theoretically/* CAs have *real* liabilities. BBBs don't. Having said
that, after reading the fine print in the CPSs, most disclaim things to
such a point that nailing them for anything real would not be worth the
effort . . .
See http://www.schneier.com/paper-pki.html for more info . . .
Cheers,
/g
[ reply ]