Re: [TLS] EU cards

My take from this whole discussion is that PKI has been sold to unilaterally to one group of people. It has been sold to large banks and security heavy industries. They tend to make things more complicated, and their security people are too security conscious, having to deal with the most determined enemies. A good security profession in banks MUST like a good military man, be far from the daily family life. He is there to think about disasters, so that they don't happen, so that nobody should think about them. 

What should happen instead is to lower the security requirements, and enter the mass market. Just as we don't put fort knox security on our houses, but use simple keys with well known security issues, so one should start using PKI in a cheap but useful way. Of course PKI has to solve a problem that passwords don't solve, otherwise they can't get traction. But they don't have to solve EVERY security problem. 

To get that ball rolling PKI has to be dirt cheap, and extremely useful. It has to be 
- one click to create a throw away certificate
- authenticate across all sites (as Facebook connect does)
(-> tie into the social web)

That would provide a big enough improvement over passwords to get people interested, and it has a viral side to it. As soon as it works for enough people, those people become interested in getting others on board too.

With millions or billions of adopters you can create the momentum, and the mass market, that will make all the other problems easy to solve. If there were just a million active developers in open source software using PKI every day for checking in software and communicating with their peers, you would soon find the technology make its way into every web site, and browsers being adapted to make their interface easy to use. With mass adoption it would be much easier to solve all the other technological problems, because citizens and politicians would have an immediate understanding of what you were talking about. 

That is what http://webid.info/ offers. Start with the low hanging problems: passwords. Then move on to add technology piece by piece to move up the security ladder.  This is the way technology works. Microsoft started with DOS and moved its way up to more and more secure versions of Windows - whatever you think of their OS you can't deny that that was a very successful strategy.

  Henry

On 29 Jul 2011, at 09:34, Anders Rundgren wrote:

> On 2011-07-29 08:17, Peter Gutmann wrote:
>> Anders Rundgren <anders.rundgren@telia.com> writes:
>> 
>>> Dropping HTTPS CCA, it will never leave the 0.1% slot anyway so why would the 
>>> browser vendor bother about how it works?
>>> 
>>> Now to the cards: Since
>>> 1. readers is a non-standard item
>>> 2. all cards need different middleware
>>> 3. cannot be fitted with additional certificates
>>> 4. is generally only trusted by a restricted group
>>> 5. commercial CAs require certified RP SW, contracts this is simply put 
>>> entirely uninteresting
>> 
>> You forgot 2a:
>> 
>> 2a. The middleware is buggy, unstable, only works on certain system 
>> configurations or on certain hardware, prevents or upsets normal operation of 
>> the system it's installed on, etc.  Vendors mostly ignore bug reports, and 
>> aren't interested in updating their drivers unless you go back and buy another 
>> half-million cards.
> 
> You are [unfortunately] quite right.  The (relative) success smart cards have
> had in controlled environment such as payment terminals cannot be translated
> to the completely uncontrolled consumer computer base.
> 
> I see two possibilities:
> 1. The easy one.  Let Apple with iPhone/iPad provide us with the "container".
> 2. Define a new container where the interface is strict and support provisioning
> so that even Joe Sixpack can succeed.  This is my take on the subject which
> though is about 100 times more difficult than what Apple needs to do so
> I guess I'm an idiot even trying...
> http://webpki.org/auth-token-4-the-cloud.html

> I just don't like the idea of going from an OS monopoly to a fullblown
> OS + Device + Infrastructure monopoly. Banks and Governments have little
> to compete with and will also [much too] late realize they're screwed.
> 
> Anders
> 
>> 
>>> The government cards are status projects.  We have issued x millions cards.  
>> 
>> I tend to refer to them as "government charities", but that's more or less the 
>> same thing.
> 
> :-)
> 
> Anders
> 

Social Web Architect
http://bblfish.net/

Received on Friday, 29 July 2011 08:02:33 UTC