Re: [tlug] System security and public policy [was: Anyone seen this gizmo yet?]

[Curt Sampson <cjs@example.com>]

On 2009-09-08 12:49 +0900 (Tue), Edward Middleton wrote:

> Coupled this with the inability of users to determine whether
> something came from a trusted source.... Until recently the only check
> required to issue an SSL certificate was to check the domain name was
> registered by the applicant, because bad people can't own domain names ;)

That's a misinterpretation (and extremely typical one) on your part
of what it means to be issued an SSL certificate. We've known from
the beginning that bad people own domain names, and that good people
sometimes do bad things with their domain names. SSL certs within the
certification infrastructure do not, never have, and were never intended
to address that problem. (And for good reason: what's a "bad" person?
That varies depending on who *you* are.)

The current system does *authentication*: all that a valid HTTPS
authentication exchange says is that you really are connected to a
server associated with the holders of that domain name, if those holders
have been reasonably careful.

The *authorization* part, that is, what information you're going to give
them and what you'll allow them to do, is up to you.

And that's the correct security tradeoff for this situation.

cjs
-- 
Curt Sampson       <cjs@example.com>        +81 90 7737 2974
           Functional programming in all senses of the word:
                   http://www.starling-software.com