Onderwerp: Re: International Domain Name [IDN] support in modern browsers allows

On Tue, 15 Feb 2005, bkfsec wrote:
> The difference between CAs and the BBB is that the BBB is well known and
> highly accountable. CAs are not necessarily.
> There is no widely screened public discussion or understanding of the
> function of CAs. The accepted root CAs do their jobs on the browser entirely
> in the background. Their "seal of approval" is considered implicit by the
> lack of a message at all.

The BBB is certainly well known, but describing it as highly accountable
is certainly inaccurate. A quick web search will inform you that the
BBB has local 'affiliates', and that the quality of these 'affiliates'
can vary dramatically from location to location.

There's no widely screened public discussion or understanding of the
function of the BBB - and their seal of approval certainly appears on
sites and businesses they've never heard of.

cheers!
================================================== ========================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet. This is the defining metaphor of my life right now."

Gwendolynn ferch Elydyr wrote:

> On Tue, 15 Feb 2005, bkfsec wrote:
>
>> The difference between CAs and the BBB is that the BBB is well known
>> and highly accountable. CAs are not necessarily. There is no widely
>> screened public discussion or understanding of the function of CAs.
>> The accepted root CAs do their jobs on the browser entirely in the
>> background. Their "seal of approval" is considered implicit by the
>> lack of a message at all.
>
>
> The BBB is certainly well known, but describing it as highly accountable
> is certainly inaccurate. A quick web search will inform you that the
> BBB has local 'affiliates', and that the quality of these 'affiliates'
> can vary dramatically from location to location.
>
> There's no widely screened public discussion or understanding of the
> function of the BBB - and their seal of approval certainly appears on
> sites and businesses they've never heard of.
>
>
Well, I meant more accountable than CAs are. I still think that that
statement is accurate if you take my meaning.

-Barry

Thor (Hammer of God) wrote:

>
> Of course the CA has to gain the trust of the users... There are many
> uses for client-based certificates: code signing, user verification,
> email encryption, automatic mapping of user account to personal
> certificates, blah blah blah. The business model of commercial CA's
> is most certainly not limited to server operators only. While
> personal certificate stores come with pre-trusted root certificates
> from many CA's to automatically trust many server-based functions,
> there is a vast market for client certs.
>
Yes, and how many average users do you know of who know this?

I know quite a number of average users and know of absolutely 0 who
would be aware of this.

-Barry

A quick (and very non-scientific) thought: Do you have trust in the
issuer of your CC?
Do you trust a shop that has "Your major CC accepted" posted on the door?
Do you trust someone that can't provide the means to verify that trust,
with or without the sign?
Do you, as an average tourist, even know how you could check it?

I would think that the answer lies in one of those questions..

-Sebastian




Thor (Hammer of God) wrote:

>>> Nonsense. The CA is asking for your trust and can only earn revenue
>>> based
>>> upon the number of people who trust it.
>>
>>
>> Wrong. The CA gains trust because it manages to get its certificate
>> included
>> with the default package for major browsers.
>>
>> It then has to persuade its customers (the server operators) to buy a
>> certificate. It does not have to persuade any user: trust is already
>> implied by the bundling.
>
>
> Of course the CA has to gain the trust of the users... There are many
> uses for client-based certificates: code signing, user verification,
> email encryption, automatic mapping of user account to personal
> certificates, blah blah blah. The business model of commercial CA's
> is most certainly not limited to server operators only. While
> personal certificate stores come with pre-trusted root certificates
> from many CA's to automatically trust many server-based functions,
> there is a vast market for client certs.
>
> T




--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.8.8 - Release Date: 14/02/2005

bkfsec wrote:
> Scott Gifford wrote:
>
>>
>> My understanding of the business model was similar to an organization
>> like the Better Business Bureau; the customers are the ones paying to
>> be certified, because being certified gives them some extra
>> legitimacy. BBB is able to do this because they have built up public
>> trust; essentially they're a reseller of public trust. If they do a
>> poor job of screening, it reflects poorly on their customers, and
>> trust in them is reduced.
>>
>> CAs serve a similar function. If they have no public trust, what do
>> they have to sell? Surely people don't pay them 50-100 bucks for the
>> 5 seconds of CPU time it takes to sign the certificate...
>>
>>
>>
> The difference between CAs and the BBB is that the BBB is well known and
> highly accountable. CAs are not necessarily.
> There is no widely screened public discussion or understanding of the
> function of CAs. The accepted root CAs do their jobs on the browser
> entirely in the background. Their "seal of approval" is considered
> implicit by the lack of a message at all.

Ermmmmmm. Well, yes and no. CAs publish CPSs (Certification Practice
Statements). The purpose of the CPS is to provide: a) and auditable
statement of what the CA does when it certifies a public key at a given
level. If one doesn't like what one sees in the CPS, one doesn't need
to accept keys certified by that CA. It is up to the relying party (the
entity which needs to decide whether or not to accept a key) to read the
CA's CPS(s). The problem with PKIs is that 99.99999% of the people who
use public key cryptography are absolutely clueless when it comes to
understanding the technology, its applications or how to use it.
*/Theoretically/* CAs have *real* liabilities. BBBs don't. Having said
that, after reading the fine print in the CPSs, most disclaim things to
such a point that nailing them for anything real would not be worth the
effort . . .

See http://www.schneier.com/paper-pki.html for more info . . .

Cheers,

/g

Gwendolynn ferch Elydyr wrote:

>> Well, I meant more accountable than CAs are. I still think that that
>> statement is accurate if you take my meaning.
>
>
> Actually I don't take your meaning. I'd appreciate it if you could
> spell out why you think that one organization paid to provide trust is
> different from another organization paid to provide trust.
>

Simple: relative physical location.

The local BBB is accountable to local laws. CAs are spread throughout
the world and are global in nature. As a member of a local community, I
can choose to familiarize myself with those regulations, understand
them, and use them against the BBB if they violate their trust. I can
also choose to go on a crusade against the local BBB.

Listen, I'm sure that you have a bone to pick with the BBB and I have no
quarrel with that. My point isn't that the BBB is a reputable, great
organization (I don't really believe that it is). My point is that the
CAs aren't trustworthy in that way and are even less trustworthy in my
view than the BBB.

I think that deep down we're agreeing on the point that they're
inherently untrustworthy. My point in saying "if you take my meaning"
was to hi-light that rather than focus on this relatively minor
nitpicking of point. I'm not the first one in this thread to bring up
the BBB. So take your point up with the person who did bring it up, please.

-Barry

On Wed, 16 Feb 2005, bkfsec wrote:
> The local BBB is accountable to local laws. CAs are spread throughout the
> world and are global in nature. As a member of a local community, I can
> choose to familiarize myself with those regulations, understand them, and use
> them against the BBB if they violate their trust. I can also choose to go on
> a crusade against the local BBB.
>
> I think that deep down we're agreeing on the point that they're inherently
> untrustworthy. My point in saying "if you take my meaning" was to hi-light
> that rather than focus on this relatively minor nitpicking of point. I'm not
> the first one in this thread to bring up the BBB. So take your point up with
> the person who did bring it up, please.

Actually I'm just trying to be explicitly clear about the path that
you're using for trust. The BBB just happens to be the example that
you'd used as an organization that you'd trust more than your average CA.

As I'm reading you, you're saying that you:

(1) trust establishments that you can see and touch more
than you trust establishments that you can't see or touch.

(2) trust establishments that are bound by a legal system that
you're familiar with more than establishments that are bound
by a legal system that you aren't familiar with.

IMHO the question is more about what your particular grounds for trust
happen to be than whether CAs are all/partially/not trustworthy - or
if the BBB in your area happens to be trustworthy.

Personally I'd really debate the concept that physical proximity is
in any respect grounds for trust - and that familiarity implies the same.

I'd be far more inclined to suggest using consistent long term behaviour
as a predictor - and implementing a system where significant incentives
towards desired behaviour exist.

cheers!
================================================== ========================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet. This is the defining metaphor of my life right now."

Thor (Hammer of God) wrote:

>
> The number of people that you know (or who I know) that are aware of
> the uses for client
> certificates is not what drives commercial certificate authority business
> models. The simple fact of the matter is that user-level
> certificates are an important part of the commercial certificate
> authority plan, and becoming more and more so as your "average" users
> become aware of certificate applications.

Actually, the number of people who are aware of the functioning and
usage of certificates is very important to the web of trust and, as
such, the business model. The "trustworthiness" of the CA is only
affected if enough people refuse to accept their certificates.


>
> When I got my NIC handle untold years ago, only 561 other humans had
> one. Your logic would preclude getting one in the first place, since
> no one knew they existed at the time. When SSL certs were first being
> created commercially, how many server operators did you know that had
> one? How many do you know now? It's the same thing with client
> certs, and the logic stands that certificate applications apply to
> them as well; particularly in regard to the business and marketing
> models various certificate authorities are running their business by.
> That was the point.
>
No - implying that my logic implies anything itself implies that I made
a recommendation against certification. I did no such thing.

The CAs have many uses and the way that they are used right now is
good. However, the question is whether you can trust them to moderate
IDN or any other site as trusted authorities.

My proposition is that the argument that they (and their associated webs
of trust) are inherently trustworthy because of external pressures is a
flawed assumption because they do not have the proposed level of
pressure applied to them since most of the people affected by their web
of trust don't understand it.

Until the average person can read and understand certs, my point stands.

-Barry

On Tue, 15 Feb 2005, bkfsec wrote:
>>> The difference between CAs and the BBB is that the BBB is well known and
>>> highly accountable. CAs are not necessarily. There is no widely screened
>>> public discussion or understanding of the function of CAs. The accepted
>>> root CAs do their jobs on the browser entirely in the background. Their
>>> "seal of approval" is considered implicit by the lack of a message at all.
>>
>> Gwendolynn commented:
>> The BBB is certainly well known, but describing it as highly accountable
>> is certainly inaccurate. A quick web search will inform you that the
>> BBB has local 'affiliates', and that the quality of these 'affiliates'
>> can vary dramatically from location to location.
>>
>> There's no widely screened public discussion or understanding of the
>> function of the BBB - and their seal of approval certainly appears on
>> sites and businesses they've never heard of.
>>
>> bkfsec retorted:
> Well, I meant more accountable than CAs are. I still think that that
> statement is accurate if you take my meaning.

Actually I don't take your meaning. I'd appreciate it if you could
spell out why you think that one organization paid to provide trust
is different from another organization paid to provide trust.

cheers!
================================================== ========================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet. This is the defining metaphor of my life right now."

David Schwartz wrote:

>>My proposition is that the argument that they (and their associated webs
>>of trust) are inherently trustworthy because of external pressures is a
>>flawed assumption because they do not have the proposed level of
>>pressure applied to them since most of the people affected by their web
>>of trust don't understand it.
>>
>>
>
> They don't have to. I don't understand how my supermarket gets their meat,
>but I trust them to use safe sources because I know that if they didn't
>those who do understand would tell me, and then I'd figure out a way to
>avoid it.
>
> No CA wants to find out what market forces will appear as soon as they
>prove to be untrustworthy. There are already many vehicles for immediately
>deploying blacklists. For example, Symantec could release an update for any
>of their security products that removed a root CA. It wouldn't take more
>than a small percent of web users to have a problem with a CA before people
>wouldn't want their certificates to be signed by that CA.
>
>
>
Symantec wouldn't do this. The backlash they would recieve from angry
users alone would be enough to discourage it, nevermind the potential
for legal problems.

Comparing CA accountability to meat sales isn't a valid analogy.
Obviously, the CAs don't want to be regulated, but trusting them because
of this is a bit like saying that business owners would never short-pay
an employee because of fear of what the employees would do.

It's also like saying that corporations never form trusts and price fix
for fear of the consumer.

Obviously, both of these assumptions are wrong and the assumption
regarding CAs is also wrong. The fact that it is assumed in the first
place is *the problem*.

Also, the fact that the CA market is competitive only further muddies
the waters. Not all CAs are in the same country and their competition
forces them to be price-competitive. This reduces the priority of being
responsible. Or, to use your meat analogy, mass-produced meat tends to
be of a lower quality than individually produced meat products,
particularly in unregulated countries.

People who think that the market will inherently protect them have been
reading too much Ayn Rand and need to step away from the
fiction-proposed-as-fact isle. No offense meant by that - it's said
tongue-in-cheek.

-Barry

[BBB vs. CA]

Gwendolynn ferch Elydyr <gwen@reptiles.org> wrote:

> Actually I don't take your meaning. I'd appreciate it if you could
> spell out why you think that one organization paid to provide trust
> is different from another organization paid to provide trust.

Some are more competent than others.

In this case, neither is worth anything.

The CA says at most "They verified ownership of a domain at a very low
standard of proof." The BBB says "They pay us and they responded to
all complaints and said they did the right thing."

Neither of them is on the hook for having bad customers, nor will
either be likely to say bad things about its customers (which are
those who pay it).

Seth

On Wed, 16 Feb 2005, David Schwartz wrote:
>
> Correct. And the browser vendors gain trust because they only include
> reputable CAs.

Ummm.

No.

'They' (to a good first order approximation: 'Microsoft') are 'trusted'
because 'they' own 90% of the browser market following the abuse of a
desktop OS monopoly to force their applications competition out of the
market.

Defaults are power.

--
Benjamin Franz

"All right, where is the answer? The battle of wits has begun.
It ends when you click and we both serve pages - and find out who is right,
and who is slashdotted." - David Brandt

Sebastian wrote/schrieb/scripsit:
>A quick (and very non-scientific) thought: Do you have trust in the
>issuer of your CC?
>Do you trust a shop that has "Your major CC accepted" posted on the door?
>Do you trust someone that can't provide the means to verify that trust,
>with or without the sign?
>Do you, as an average tourist, even know how you could check it?
>
>I would think that the answer lies in one of those questions..

The key difference between a CA and a CC company is that the latter
takes part in the actual business transaction between the parties.
The customer does not have to trust the CC company to certify the shop
because he can demand the CC issuer to do a chargeback with almost no
questions asked.

The CC system also works in a way that is safe as long as customers
apply common sense, which they are expected to do. It still needs to be
figured out how to make common sense work for public key crypto on the
other hand.

-Stefan
--
junior guru SP666-RIPE JID:stefanp@jabber.de.cw.net SMP@IRC

Thor (Hammer of God) wrote/schrieb/scripsit:
>When I got my NIC handle untold years ago, only 561 other humans had one.
>Your logic would preclude getting one in the first place, since no one knew
>they existed at the time. When SSL certs were first being created
>commercially, how many server operators did you know that had one? How
>many do you know now? It's the same thing with client certs, and the logic
>stands that certificate applications apply to them as well; particularly in
>regard to the business and marketing models various certificate authorities
>are running their business by. That was the point.

Just like a NIC handle, a client certificate has no intrinsic value.
People get a NIC handle to use it in a specific process. Just like NIC
handles don't (anymore) work cross-registry, people will have to get
specific certificates to use in specific processes. It is only then
that certificates, being a complex technology, actually work when they
are dumbed down and sealed off sufficiently.
Server certificates are a slightly different thing, as their number is a
few magnitudes lower than the number of client certificates. It is only
economically viable to distribute knowledge if the number of ignorant
people is low enough.

-Stefan
--
junior guru SP666-RIPE JID:stefanp@jabber.de.cw.net SMP@IRC

David Schwartz wrote:

> > My proposition is that the argument that they (and their associated webs
> > of trust) are inherently trustworthy because of external pressures is a
> > flawed assumption because they do not have the proposed level of
> > pressure applied to them since most of the people affected by their web
> > of trust don't understand it.
>
> They don't have to. I don't understand how my supermarket gets their meat,
> but I trust them to use safe sources because I know that if they didn't
> those who do understand would tell me, and then I'd figure out a way to
> avoid it.

That is not why you trust your supermarket to source good/safe meat at
all.

You trust your supermarket to source good/safe meat because you live
somewhere that has strongly enforced regulations, with very stiff
financial penalties, covering the slaughtering of animals, preparation
of their carcasses into meat products, and every step of the storage,
shipping, handling, display and sale of such products.

And, in fact, very similar reasons are why you trust so many other
conveniences that comprise "the modern Western way of life".

Further, these systems are so ingrained and work so well, most people
(such as yourself?) have forgotten that the checks and balances even
exist, taking for granted "safe meat from the supermarket" and so on.

The previous poster, to whom you responded is essentially correct. The
difference between CAs and the webs of trust surrounding them and the
whole CA/certification process do not have the checks and balances
governing them that they are assumed to have. This is equally true of
most other trust issues with computers, such as the most basic ones as
the assumption on the part of consumers that the OS and standard
applications for the typical tasks to which computers will be put are
designed to competently and safely perform those tasks while protecting
the users from what should, to the technically competent and informed
folk it is assumed design, write and test such software, be "obvious
dangers".

> No CA wants to find out what market forces will appear as soon as they
> prove to be untrustworthy. There are already many vehicles for immediately
> deploying blacklists. For example, Symantec could release an update for any
> of their security products that removed a root CA. It wouldn't take more
> than a small percent of web users to have a problem with a CA before people
> wouldn't want their certificates to be signed by that CA.
>
> The CA market is competitive.

So, why is VeriSign still in the CA business? Or should releasing two
code-signing certificates in Microsoft's name to non-MS related folk
not be considered untrustworthy enough to utterly destroy any rational
person's or organization's trust in a CA?


Regards,

Nick FitzGerald