Subject: RE: Certificate / CPS issues

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 6 Jun 2003 09:48:06 -0700

Signs keys for people you don't LIKE?

I give (well sell) certs to plenty of people I don't LIKE. That is not the
issue, the issue is whether the authentication proceedure is being applied
as stated in the CPS or not.

If a bogus certificate is issued and the CA refuses to revoke it then you
have a big problem.

In your scenario what happens if you find out that Ted Tso or Jeff Schiller
has signed a bogus key. Do you then revoke every key they ever issued on
that account?

Please remember here that we are trying to solve the spam problem here. The
guys sending the stuff are organized criminals. It is bad if even one
criminal spam gets through. But it is also bad if you can't use email unless
you go pay $10,000 to some email good practice accreditation agency (yes
thay is what they charge).

So yes we can use certificates to address the spam problem, but don't expect
the criteria to be set at military security levels. Most people simply won't
pay for that.

		Phill

> -----Original Message-----
> From: Pete Resnick [mailto:[email-masked]]
> Sent: Friday, June 06, 2003 12:10 PM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]'
> Subject: RE: Certificate / CPS issues
> 
> 
> On 6/6/03 at 7:41 AM -0700, Phillip Hallam-Baker wrote:
> 
> >Do you think that folk signing PGP keys are undertaking unlimited 
> >liability should the certification turn out to be incorrect?
> 
> No, but if Mary turns out to be someone who signs PGP keys for people 
> I don't like, I can simply say "Don't trust Mary" in my PGP 
> application and the things she signs won't show up as valid unless 
> someone I do trust signs them. If RSA screws up and signs keys for 
> people I don't like, I can't (practically) say "Don't trust RSA" 
> without invalidating a bunch of keys that I probably do want to trust.
> 
> I'm not by any means saying that PGP is a perfect solution. It's just 
> that the liability scenario is very different because amount of 
> damage any given signer can do is much different.
> 
> pr
> -- 
> Pete Resnick <mailto:[email-masked]>
> QUALCOMM Incorporated - Direct phone: (858)651-4478, Fax: 
> (858)651-1102
>

---

From: Pete Resnick <[email-masked]>
Date: Fri, 6 Jun 2003 12:44:50 -0500

>Signs keys for people you don't LIKE?

Well, I was referring to people who send spam, or aren't reputable 
business folk, or do any of a list of nasty things that I consider 
non-trustworthy. I should have put "don't like" in quotes.

>In your scenario what happens if you find out that Ted Tso or Jeff 
>Schiller has signed a bogus key. Do you then revoke every key they 
>ever issued on that account?

I might. It depends. If I think it was a fluke incident, I might not. 
But, if I thought that Ted and/or Jeff were repeatedly signing keys 
for disreputable folks, I might very well mark their keys as 
"untrusted" and not trust keys that were solely signed by them. Or 
(if we start talking about pie-in-the-sky kinds of things), I could 
imagine my e-mail filters saying, "Quarantine e-mail not signed by 
someone in this list of keys", and I might remove Ted and/or Jeff 
from that list of keys.

>Please remember here that we are trying to solve the spam problem here.

That's not what *I* was doing here. I was simply trying to point out 
that the liability model was different for a web of trust than for CA 
trust. Whether using either method is more or less applicable to 
solving the spam problem is not something I'm willing to discuss in 
this forum.
-- 
Pete Resnick <mailto:[email-masked]>
QUALCOMM Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102