Re: International Domain Name [IDN] support in modern browsers allows

David Schwartz wrote:

>>Wow. You just conceded that there is significant pressure on major
>>vendors to not counter the CA, and then claimed that some ethereal other
>>would magically be able to enforce it where Symantec couldn't.
>>
>>
>
> What?! I did nothing of the sort. My "then" follows his "if". It does not
>concede that his "if" is true, in fact I think it's preposterous.
>
>
Refusing to address a point in an argument and responding with "then
someone else would have" is, by definition, conceding the point.

It's not a preposterous point. Why should Symantec use their AV product
to police the CA market? How about their other products? It would only
happen when it benefits them to do so, and that will only happen if the
CAs completely fail to do their duties.

>
>
>>Market demand sometimes does create solutions, however to claim that it
>>does without fail is a bit naive.
>>
>>
>
> Didn't say that.
>
>
Yes, you did say that. Look back in the thread. You were saying "The
market will provide a solution". I said that that was naive. Your
retort was "didn't say that".

Are you conceding more points or just ignoring your own arguments?

>>So, if not Symantec, then who else do you propose would?
>>
>>
>
> Lavasoft, Computer Associates, Bazooka, Webroot, Zone Labs, and pretty much
>every other computer security vendor.
>
>
The same pressures that affected Symantec would affect them.



>>History disagrees with you. So do a number of economists.
>>
>>
>
> First of all, the unusual circumstances have occured in distorted markets.
>
>
All markets have the potential to be distorted. And any sober review of
any market will find most of these practices in place to one degree or
another.

>Second, it took awhile for people to learn that these strategies almost
>never work and to figure out precisely under what circumstances they do
>work.
>
>
Sure, they didn't know the best way to cheat people at first. All
solutions are better managed after trial and error. The problem with
your argument is that there is corruption in the markets, or are you
arguing that corruption is dead and all markets fix themselves? That
would seem a bit assinine to me. I guess you'll just respond with "I
never said that markets correct themselves..." :)


>>It would harm them, yes, but they very well can get away with it.
>>
>>
>
> Right, until it harms the users.
>
>
Correction: until it materially harms the user enough to address the
issue. All decisions have a cost/benefit basis to them.

>
>>It's interesting how you cite market dynamics in your arguments, but
>>disregard them when they aren't favorable to your point.
>>
>>
>
> How so?
>
>
Because you're neglecting to consider important factors in the markets
that are affected by this particular bug and, in fact, all CA root cert
revocations on the part of browser producers and when I bring them up,
you ignore them. Ignoring them makes it appear that you're being
selective in your positions.

>
> Or people set up that CA to a lower level of trust where they know the
>certificate has come from a CA they don't fully trust. Or maybe they
>download a list of certificates manually from that CA and don't trust
>unknown CAs without querying them with a third party. Or maybe, ...
>
> You can't predict how the market will work.
>
>
Of course not - I can only speculate based on factors at work at the
time. The same goes for yourself.



>
> There is a market in keeping users ignorant. So long as things "just work"
>users can stay ignorant, and I assure you, if CAs create a situation that
>doesn't "just work", someone else will work hard to come up with a solution
>to keep things that way.
>
>
Whoa whoa whoa. We're not talking about CAs creating a situation where
things don't "just work". Not in the least.

We're talking about the current IDN "bug" and the CAs dealing with
that. Someone else already answered that point by (correctly) stating
that it is not the responsibility of the CAs to protect people from
things like that.

My point is that even if it were their responsibility, you can't just
explicitely trust them to do so. Their accountability in dealing with
it is limited because as long as they are providing their service, they
won't be harmed.

If that situation became the norm, obviously - over time - that CA would
be obsoleted.

However, in the current context we're not talking about the CA system
failing.


>
>
>>There are millions of people out there who don't trust the MPAA or the
>>RIAA, for that matter. Not having the trust of the people hasn't
>>stopped them. Again, you've chosen a very poor example.
>>
>>
>
> No, the issue (with the MPAA, I'm not sure how the RIAA got into this) is
>not that people trust or don't trust them, the issue is that all they have
>to sell is their trust. For the vast majority of people, trusting the MPAA
>has never caused them a problem. So the alternatives to the MPAA only target
>very specialized markets.
>
>
The average person doesn't have a choice. The MPAA is, effectively, a
trust and a control for the movie industry. Looking through my own
movie collection, I don't have many movies that aren't associated with
the MPAA and I think I'd be hardpressed to find more than five.

The average person doesn't have a trust relationship with the MPAA.
It's more of a dictatorial relationship. People buy or go watch movies
and, if the product is defective, they return it. There's not much of a
trust relationship there to speak of.

Hell, most people don't even trust the MPAA to properly rate movies.



>
>
>>The market does not inherently protect people. Anyone who believes that
>>is reality impaired and doesn't have a very good understanding of
>>history nor economics.
>>
>>
>
> That's not what I'm saying. I'm saying CAs have a huge interest in making
>sure their customers don't get harmed by their actions.
>
>
>
Yes, they have an interest in providing their services in the way that
is economically feasible to achieve their best goals. Obviously, they
don't want to see their customers harmed by their actions. However,
it's a leap of faith to go from that to "they will provide the best
service ever possible".

-Barry

On Wed, 16 Feb 2005, Gwendolynn ferch Elydyr wrote:

> On Wed, 16 Feb 2005, bkfsec wrote:
> > The local BBB is accountable to local laws. CAs are spread throughout the
> > world and are global in nature. As a member of a local community, I can
> > choose to familiarize myself with those regulations, understand them, and use
> > them against the BBB if they violate their trust. I can also choose to go on
> > a crusade against the local BBB.
> >
> > I think that deep down we're agreeing on the point that they're inherently
> > untrustworthy. My point in saying "if you take my meaning" was to hi-light
> > that rather than focus on this relatively minor nitpicking of point. I'm not
> > the first one in this thread to bring up the BBB. So take your point up with
> > the person who did bring it up, please.
>
> Actually I'm just trying to be explicitly clear about the path that
> you're using for trust. The BBB just happens to be the example that
> you'd used as an organization that you'd trust more than your average CA.
>
> As I'm reading you, you're saying that you:
>
> (1) trust establishments that you can see and touch more
> than you trust establishments that you can't see or touch.
>
> (2) trust establishments that are bound by a legal system that
> you're familiar with more than establishments that are bound
> by a legal system that you aren't familiar with.
>
> IMHO the question is more about what your particular grounds for trust
> happen to be than whether CAs are all/partially/not trustworthy - or
> if the BBB in your area happens to be trustworthy.
>
> Personally I'd really debate the concept that physical proximity is
> in any respect grounds for trust - and that familiarity implies the same.
>
> I'd be far more inclined to suggest using consistent long term behaviour
> as a predictor - and implementing a system where significant incentives
> towards desired behaviour exist.
>

But do not "physical proximity" and "familiarity" not also imply that a
lengthy relationship is probable which would enable behavioural
observations of said length to determine it's consistency? Somewhat like
the concept that a person gets better service from a smaller mom&pop shop
then they do in a superstore?


Thanks,

Ron DuFresne
--
"Sometimes you get the blues because your baby leaves you. Sometimes you get'em
'cause she comes back." --B.B. King
***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D. Just don't touch anything.

David Schwartz wrote:

>
> Then somebody else would. Market demand creates solutions. I can't see how
>the legal issues are any different from the ones they face when they label
>software as adware or spyware.
>
>
>
Wow. You just conceded that there is significant pressure on major
vendors to not counter the CA, and then claimed that some ethereal other
would magically be able to enforce it where Symantec couldn't.

Market demand sometimes does create solutions, however to claim that it
does without fail is a bit naive.

So, if not Symantec, then who else do you propose would?

>
>
>>t's also like saying that corporations never form trusts and price fix
>>for fear of the consumer.
>>
>>
>
> No, they never do so because such strategies only work in very unusual
>circumstances. Nobody can make a person pay more for something than it is
>worth.
>
>
History disagrees with you. So do a number of economists.


>
> I'm not assuming anything, I'm making an argument why it would be
>self-destructive for any CA to adopt such a strategy. That doesn't mean they
>won't do it, people certainly do stupid things when they think they can get
>away with it. But the fact is, CAs can't get away with it. So if they think
>they can, they will quickly be proven wrong.
>
>
It would harm them, yes, but they very well can get away with it.


>
>
>>Also, the fact that the CA market is competitive only further muddies
>>the waters. Not all CAs are in the same country and their competition
>>forces them to be price-competitive. This reduces the priority of being
>>responsible. Or, to use your meat analogy, mass-produced meat tends to
>>be of a lower quality than individually produced meat products,
>>particularly in unregulated countries.
>>
>>
>
> I could not disagree more. All a CA has to sell is its trust. The trust is
>its product. CAs sell trust, they are in the trust business. If a CA loses
>the trust of browser vendors, it has nothing to sell. If a CA loses the
>trust of users, pressure will be put on browser vendors.
>
>
It's interesting how you cite market dynamics in your arguments, but
disregard them when they aren't favorable to your point.

If hundreds of thousands of sites use a particular CA as their root,
then removing the CA trust from the browser will cause an annoyance for
the browser consumer, resulting in 1 of 2 possible outcomes:

1) People learn to modify their configs and setup the CA as trusted.

2) People move to browsers that trust that CA by default.

The only way that a CA can lose the trust of the browser users is if the
browser users understand how the CAs work and understand how to put
pressure on the browser market to achieve that end result.

Again, we get back to the fact that most end users (browser market
customers) can barely turn on their PCs, nevermind understand or care
about CA trust relationships. You have to put yourself into that
position and think like they do before you should ever propose a
pie-in-the-sky market solution to something like this.

>
>
>>People who think that the market will inherently protect them have been
>>reading too much Ayn Rand and need to step away from the
>>fiction-proposed-as-fact isle. No offense meant by that - it's said
>>tongue-in-cheek. :)
>>
>>
>
> Except that it does. Especially when all a company has to sell is its
>trust. This is true in many markets where companies have specifically set up
>to sell trust. You don't see people bribing the MPAA or Consumer Reports.
>Because such things could not possibly be hidden, and there's an immediate
>market remedy (stop trusting).
>
>
>
>
There are millions of people out there who don't trust the MPAA or the
RIAA, for that matter. Not having the trust of the people hasn't
stopped them. Again, you've chosen a very poor example.

The market does not inherently protect people. Anyone who believes that
is reality impaired and doesn't have a very good understanding of
history nor economics.

-Barry

Thor (Hammer of God) wrote:

>
> Hmmm... I'm confused now... You just said in your last post that
> average users don't want, need, or know how certificates work, and how
> your previous (and specious) point stood because of that fact. Yet
> here, you state that enough of a backlash from these users exists to
> keep a global entity like Symantec from taking action should they
> revoke a trusted CA from a users' certificate store even though the
> user (according to you) didn't know they trusted in the first place.
> Explain that.

Simple. If a major CA root is revoked, a large number of major sites
will all start displaying browser warnings which will be an annoyance to
the user, causing at least a decent percentage of them to question why
they are getting a constantly recurring pop-up whenever they go to a
large number of sites.

Users are only interested (and not always so, but often) in things that
pop up in front of their faces and annoy them.

The user wasn't aware of the CA before (since a root CA being
automatically accepted by a browser will result in no warning message
for the user on sites that use certs supplied by the CA) but are aware
that something is up (and annoying) after (if) they update their browser.

So, no - it's neither specious nor is it confusing. It just requires
some common sense and actual exposure to the user population. Something
which some people here seem to be lacking.

>
>> Comparing CA accountability to meat sales isn't a valid analogy.
>> Obviously, the CAs don't want to be regulated, but trusting them
>> because of this is a bit like saying that business owners would never
>> short-pay an employee because of fear of what the employees would do.
>
>
> David was not comparing accountability to sales. He compared trust to
> trust. Pretty simple stuff.

David is the one who used the term sales - bring it up with him. Yeah,
pretty simple stuff - which is why I disagreed with it.



>
>
>> Also, the fact that the CA market is competitive only further muddies
>> the waters. Not all CAs are in the same country and their
>> competition forces them to be price-competitive. This reduces the
>> priority of being responsible. Or, to use your meat analogy,
>> mass-produced meat tends to be of a lower quality than individually
>> produced meat products, particularly in unregulated countries.
>
>
> I acquiesce. I failed to take into account the multi-national
> not-for-profit CA's out there making a killing by scooping up the free
> end-user business that you claim does not exist in the first place.

Who said anything about not-for-profit?

>
>> People who think that the market will inherently protect them have
>> been reading too much Ayn Rand and need to step away from the
>> fiction-proposed-as-fact isle. No offense meant by that - it's said
>> tongue-in-cheek. :)
>
>
> No Barry, we just understand that the market corrects itself in these
> matters. That's how the market works. Once upon a time, there was no
> such thing as a certificate. Now it is a billion dollar biz. It has
> nothing to do with the BBB or who you think is the average user. I
> deploy and maintain an extensive PKI infrastructure for my company as
> I do for many of my clients. I'm happy to engage in further dialog
> regarding this subject so that I may have the opportunity to learn
> something, but before I do so, I'd like to get a glimpse into the vast
> PKI infrastructure you maintain so that I may prioritize your input.
> Please describe your Cert/PKI infrastructure so that we may all
> benefit from your knowledge.
>
Suffice it to say that I'm involved in maintaining one for a very large
corportation.

Frankly, I could care less how you prioritize what I say. You clearly
have your own opinions on the matter, I personally feel that they don't
take into account factors that are important.

You talk about browsers revoking trust in CAs as if it has no impact on
the end user.

You talk as if it's a simple proposition for Microsoft or any other
browser manufacturer to revoke a CA trust.

I'm saying that it's not, and that the browsers have to consider the
affects on their customers. I'm also saying that corporations, in this
case, don't always make the secure decision, but rather the decision
that gives the user the greatest amount of likelihood of using their
product.

If you disagree with this concept, I say that you're wrong.

It is a simple concept, yet you are continuing to disagree with it.

I'm sorry if you don't feel like you can learn anything from me, but I'm
not here to teach you. I'm simply saying that you are not taking all of
the factors into account. Feel free to disagree with that, but you'd
still be wrong.

The CA and browser markets do not exist in a vacuum.

-Barry

David Schwartz wrote:

>
> This is no different than the case of Burger King buying inferior beef.
>While it's true the beef vendor only has to convince Burger King to buy the
>beef, not Burger King's customers, there wouldn't be any customers as soon
>as they found out that Burger King was reselling food made from inferior
>beef.
>
> This is just like any other indirect relationship. Buyers never want poor
>quality raw materials because they result in poor quality finished goods.
>
>
>
>

Ironically, you're talking about fast food companies buying "high
quality" materials. Fast food companies are notorious for buying
low-quality materials in order to keep prices low and, frankly, if they
lowered the quality of their beef, no one would notice.

Talk about picking a bad analogy.

-Barry

David Schwartz wrote:

>
> I disagree with this entirely. First of all, there is no incentive to buy
>low-quality materials. It's obviously nonsensical. What they do try to do is
>buy the highest quality materials they can for the cost they're willing to
>spend. If they could lower the quality and no one would notice, why don't
>they?
>
>
Because they really couldn't get any lower in the quality chain without
seriously impacting their customers in an obvious fashion.

The concept you're referring to is quality versus grade. Burger King
wants the highest quality in the lowest grade possible.

The distinction you're making here is problematic, because you're taking
a general statement and quantifying it to market it's in. The problem
with this is that Low-quality, medium grade meat would still be of a
higher relative quality than high-quality, low grade meat.

The key here is the point "for the cost they're willing to spend" which
is the real factor which dictates what the actual product being sold
is. The low cost of burgers dictates that they can't purchase truly
high-quality meats

Take the Angus Steakburger for instance. I love that burger - don't get
me wrong, I'm not a fast food bigot. However, is the Angus Steakburger
made with the same quality of meat that a gourmet steakhouse would use?
Obviously not.

It's probably the best of brand in the grade that it's in, but the fact
of the matter is that even if it's high-quality low grade steak, it's
still very low quality in reality.

In other words: the distinction is irrelivent because, to the consumer
and in reality, the meat is of a lower overall quality than meat they
would buy elsewhere.


>
>
>>Talk about picking a bad analogy.
>>
>>
>
> Actually, it's really good, just not a good one to pick because most people
>have serious prejudices about the food market, just as they do about the
>medical market. Fast food restaurants provide an excellent product at a very
>low price. Yes, it's not the best possible product, but nobody could produce
>that at the same price point.
>
>
>
Of course not. It's pure economics, and that's why your analogy is wrong.

-Barry

Vincent Archer wrote:

>On Wed, Feb 16, 2005 at 04:34:27PM -0800, David Schwartz wrote:
>
>
>> I'm not assuming anything, I'm making an argument why it would be
>>self-destructive for any CA to adopt such a strategy. That doesn't mean they
>>won't do it, people certainly do stupid things when they think they can get
>>away with it. But the fact is, CAs can't get away with it. So if they think
>>they can, they will quickly be proven wrong.
>>
>>
>
>Quickly? When Verisign issued in 2001 a certificate for "Microsoft" to
>somebody who simply said he was a Microsoft employee, and they didn't
>do any check about the identity of the person, what happened?
>
>Nothing. Except issuing a couple of "oops" certificate revocations.
>
>I can't even find a public announce by Verisign stating they would take
>actions to correct their own validation procedures and avoid repetition
>of the incorrect (and for a public CA, inexcusable) behaviour. Everybody
>here hopes they fixed their procedures... but no one even knows.
>
>
>

I, too, would be interested in some kind of "lessons learned"-document,
describing why this could happen at all - and how Verisign wanted to
avoid it in the future.

It's really a pitty that the root-CAs in browsers haven't been subject
to more public scrutiny - now and back then.




cheers,
Rainer

--
================================================== =
~ Rainer Duffner - rainer@ultra-secure.de ~
~ Freising - Munich - Germany ~
~ Unix - Linux - BSD - OpenSource - Security ~
~ http://www.ultra-secure.de/~rainer/pubkey.pgp ~
================================================== =