PDA

Bekijk Volledige Versie : Re: International Domain Name [IDN] support in modern browsers



Scott Gifford
12/02/05, 21:35
Neil W Rickert <rickert+bt@cs.niu.edu> writes:

> Scott Gifford <sgifford@suspectclass.com> wrote on Feb 11, 2005:
>
>>Maybe I'm naive, but shouldn't a trustworthy root CA not sign
>>certificates for domain names which are obviously meant to be
>>deceptive?
>
> Signing the certificate earns income for the CA and its shareholders,
> and serves the customer who requested that the certificate be
> signed. If a CA were to set very high standards and check very
> carefully, then it would price itself out of the market.
>
> As a user of a browser I am not a customer of the CA, and it isn't
> evident why the CA should be under any obligation to me. They surely
> are under an obligation to their shareholders and their customers.

My understanding of the business model was similar to an organization
like the Better Business Bureau; the customers are the ones paying to
be certified, because being certified gives them some extra
legitimacy. BBB is able to do this because they have built up public
trust; essentially they're a reseller of public trust. If they do a
poor job of screening, it reflects poorly on their customers, and
trust in them is reduced.

CAs serve a similar function. If they have no public trust, what do
they have to sell? Surely people don't pay them 50-100 bucks for the
5 seconds of CPU time it takes to sign the certificate...

----ScottG.