Re: [tlug] System security and public policy [was: Anyone seen this gizmo yet?]

[Edward Middleton <emiddleton@example.com>]

Curt Sampson wrote:
> Edward Middleton wrote:
>   
>> Coupled this with the inability of users to determine whether
>> something came from a trusted source.... Until recently the only check
>> required to issue an SSL certificate was to check the domain name was
>> registered by the applicant, because bad people can't own domain names ;)
>>     
>
> That's a misinterpretation (and extremely typical one) on your part
> of what it means to be issued an SSL certificate..
>   
What it means depends on what the level the ca went to verify the
identity of the holders of the domain[1].

> The current system does *authentication*: all that a valid HTTPS
> authentication exchange says is that you really are connected to a
> server associated with the holders of that domain name, if those holders
> have been reasonably careful.
>   
With only a domain name check it doesn't tell you who the holders of the
domain are.  Without that information it is pretty difficult to assess
the trustworthiness of the site.

Edward

1. http://en.wikipedia.org/wiki/Extended_Validation_Certificate