Security issues such as specific security problems or ideas for making the code as a whole more secure can be discussed here

Gervase Markham | 7 Dec 2004 13:37

Re: 2004 - The Year of the Phish

Ian Grigg wrote:
> Good question.  The answer:  Branding.  VeriSign
> and other CAs would need to establish their brand
> with the public.  Verisign would need to act like
> Intel or Coke or Ford and establish a brand that
> speaks of trust.

Isn't that just reinforcing the monopoly they currently have on SSL 
certs? And raising the barrier to entry for newcomers?

> The problem is foistered on us somewhat by the PKI
> design.  At the moment, any cert signed by any CA
> is assumed to be good by the software, but it's
> pretty easy to see and to show that that is a really
> bad assumption.  Now, if we are going to have a PKI
> where a CA is expected to be trusted, then that name
> must be known by whoever relies on that trust (the
> user).

Or the trust has to be assessed by the user's software provider.

> It's a bit like if I were to sell you a can of
> Coke that was coloured green.  I say it's coke,
> but you know something's wrong coz you've always
> had familiar red cans.  That signal should be
> sufficient to get the average user thinking a
> bit more.

I suspect the average user would (if you told them) just assume it was a 
promotion.

(Continue reading)

headers

Ian Grigg | 7 Dec 2004 14:52

Re: 2004 - The Year of the Phish

> Ian Grigg wrote:
>> Good question.  The answer:  Branding.  VeriSign
>> and other CAs would need to establish their brand
>> with the public.  Verisign would need to act like
>> Intel or Coke or Ford and establish a brand that
>> speaks of trust.
>
> Isn't that just reinforcing the monopoly they currently have on SSL
> certs? And raising the barrier to entry for newcomers?

On a first order analysis, "branding" has that effect.
But, on further analysis of the economic effects of all
the factors, I don't necessarily think so.  There are
these things that can be said:

1.  The reason there is a strong dominating player at
the moment is because there is no way to compete.  The
lack of branding is an indication of lack of competition,
not the reverse.  Basically, the marketplace for certs
is primitive, "broken" in the techies lingo, and adding
branding would be one way to make it competitive.  If
all of the elements were employed ("if PKI is fixed")
then the structure of the marketplace would be very
different.  for example:

2.  One of the essential fixes is to permit a graduated
array of cert protection.  Currently the system is
binary;  either nothing or CA-signed cert.  What we
would desire would be a migration from nothing to self-
signed-certs to bargain CA-signed certs to heavily

(Continue reading)