Subject: RE: Palladium (TCP/MS)

From: Franck Martin <[email-masked]>
Date: Tue, 22 Oct 2002 11:14:37 +1200

"Here is my preferred solution for Internet security. We could implement
a secure user identity system precisely like telephone Caller ID. It
would be essentially an Internet ID. All Internet transactions could be
based on it. Anyone who sends me e-mail can be identified. Anything I
send can be traced to me. People wouldn't be forced to participate, but
if they remain anonymous, I might choose to block them. I certainly
wouldn't accept file attachments from them. I know you hate this idea,
but I think the Internet needs a fingerprint. It does not have to have
personal information, but if you break the law it can be traced to you.
You can choose not to have a fingerprint, but then your ability to
communicate with others may be limited -- a price many people may choose
to pay. "

What i "quickly" read is that the author of the article is looking for a
system that put an ID on the sender of e-mails. This solution exists, it
is called S/MIME. Unfortunately, it is not widely used and poorly
implemented at a global level (unlike DNS). Also deploying digital
signature is only possible at company level, because nobody trustworthy
issues you a certificate that allows you to sign certificates.
 
The ISOC WG on PKI may help, see also the thread on Global PKI on DNS on
tht IETF list to find out the extent of the problem.
 
But it is not the first time I hear people wanting to digitaly certify
e-mails, personnal e-mails ,or commercial e-mails from respectable
companies (cf SPAM meeting before INET2002).
 
Cheers.
BTW I digitally signed this message, to make you understand some of the
problems of implemeting S/MIME.

Franck Martin
Network and Database Development Officer
SOPAC South Pacific Applied Geoscience Commission
Fiji
E-mail:  <mailto:[email-masked]> [email-masked]
Web site:  <http://www.sopac.org/> http://www.sopac.org/
Support FMaps:  <http://fmaps.sourceforge.net/>
http://fmaps.sourceforge.net/
Certificate: https://www.sopac.org/ssl/ <https://www.sopac.org/ssl/>  

This e-mail is intended for its addresses only. Do not forward this
e-mail without approval. The views expressed in this e-mail may not be
necessarily the views of SOPAC.

-----Original Message-----
From: TOMSON ERIC [mailto:[email-masked]]
Sent: Tuesday, 22 October 2002 1:09 
To: [email-masked]'
Cc: [email-masked]'
Subject: Palladium (TCP/MS)

Please read the 2 following links, then answer 2 simple questions :
- Is Palladium (TCP/MS) a real/serious threat?
- Do we have to be afraid of it?
 
http://www.pbs.org/cringely/pulpit/pulpit20010802.html
<http://www.pbs.org/cringely/pulpit/pulpit20010802.html> 
http://www.pbs.org/cringely/pulpit/pulpit20020627.html
<http://www.pbs.org/cringely/pulpit/pulpit20020627.html> 
 
E.T.

---

From: Gary Lawrence Murphy <[email-masked]>
Date: 24 Oct 2002 19:19:14 -0400

>>>>> "F" == Franck Martin <[email-masked]> writes:

    F> ...Anyone who sends me e-mail can be identified. Anything I
    F> send can be traced to me. People wouldn't be forced to
    F> participate, but if they remain anonymous, I might choose to
    F> block them. I certainly wouldn't accept file attachments from
    F> them. I know you hate this idea, but I think the Internet needs
    F> a fingerprint.

Isn't that PGP?

-- 
Gary Lawrence Murphy - [email-masked] - TeleDynamics Communications
   - blog: http://www.teledyn.com/mt/ - biz: http://teledyn.com/ -
  "Computers are useless. They can only give you answers." (Picasso)

---

From: Caitlin Bestler <[email-masked]>
Date: Thu, 24 Oct 2002 22:35:18 -0500

On 10/22/02, Franck Martin wrote:

>"Here is my preferred solution for Internet security. We
>could implement a secure user identity system precisely
>like telephone Caller ID. It would be essentially an
>Internet ID. All Internet transactions could be based on
>it. Anyone who sends me e-mail can be identified. Anything
>I send can be traced to me. People wouldn't be forced to
>participate, but if they remain anonymous, I might choose
>to block them. I certainly wouldn't accept file
>attachments from them. I know you hate this idea, but I
>think the Internet needs a fingerprint. It does not have
>to have personal information, but if you break the law it
>can be traced to you. You can choose not to have a
>fingerprint, but then your ability to communicate with
>others may be limited -- a price many people may choose to
>pay. "
>
>
If posting this comment on this thread is supposed to imply
that this is an alternative to Palladium, then I would
strongly suggest actually going and reading some of the
Palladium material.

Palladium is ultimately about creating a lockbox for key
data within a system. It really implies almost nothing about
system to system interaction -- it has more to do with how a
distributed application can avoid trusting the OS to store
data and keys.

Which is an admirable goal. I'll have to see the details. I
have some skepticism about how you prevent the OS, which is
the local traffic cop, from pulling off a man-in-the-middle
attack.

You can also make the obvious cheap jokes about Microsoft
leading the way to solve problems of applications developers
that do not trust the Operating System...

But seriously, there are two types of Operating Systems that
distributed applications should not trust: those where you
cannot review the source code, and those where any attacker
can modify the source code.

A lot of this thread has struck me as an attempt to import
the Bush/Cheney foreign policy to the IETF. Microsoft is
evil, therefore everything Microsoft does is evil. Any
statements they make are just part of their evil plan. We
might as well launch the pre-emptive strike right now.

It would make more sense to examine whether any aspect of
this problem is a proper topic for the IETF, and where our
concerns about interoperability would be.

For example, Microsoft's position papers claim that
alternate Nexus implementations will be legal. Will users be
able to enable different Nexus implementations to
interoperate and share keys for sealed storage?

Caitlin Bestler
http://asomi.com/CaitlinBestler/