[Discuss] root CA bloat

[invalid at pizzashack.org (Derek Martin)]

On Tue, Nov 25, 2014 at 02:52:47PM -0500, Richard Pieri wrote:
> On 11/25/2014 1:15 PM, Derek Martin wrote:
> >Let's say I meet you on the street, and you tell me you are Steven
> >Smith, and produce very good fake ID to that effect.  As it happens
> >(in this scenario) I am exceptionally good at spotting fake ID.  I
> >prove that your ID is fake.  This does not prove to me who you are--it
> >only proves to me one identity whom you are not.
> 
> It proves that I'm that particular guy you met on the street. You
> may not know my real identity but you still have a piece of
> information -- a fingerprint if you will -- that is uniquely mine.

This misses the point:  we're talking about authenticating
(essentially) anonymous parties on the internet for (essentially)
trusting them with your money and/or secrets.  The above was only
an analogy to illustrate the problem.  Though your response sort of
makes my point for me.... sort of.  Having met "fake Steven Smith #32"
I would certainly trust him with neither my money nor my secrets.

> If that fingerprint is used then you know that it's the guy you met
> on the street with Steven Smith fake ID #32. That's all you need if
> you want to communicate with fake Steven Smith #32.

I have no use to communicate with "fake Steven Smith #32"... my goal
is to trust that the website behind certificate XYZ actually belongs
to my brokerage house, rather than some "fake Steven Smith #32" who
fully intends to abscond with my nest egg.  The fingerprint of "fake
Steven Smith #32" has no value to me (or, I dare say, anyone), and I
would not bother attempting to secure my communications with that
person.
 
> At which point a web of trust or hybrid web and chain can be used if
> you need more than that. It's not an unsolvable problem. It's
> already been solved: social networks.

Oh, right, just like the web of trusted certificate authorities.  It's
a solved problem, so we really don't need to continue this discussion!

-- 
Derek D. Martin    http://www.pizzashack.org/   GPG Key ID: 0xDFBEAD02
-=-=-=-=-
This message is posted from an invalid address.  Replying to it will result in
undeliverable mail due to spam prevention.  Sorry for the inconvenience.