Subject: RE: Software for PKI

From: "Harrington, Chris" <[email-masked]>
Date: Wed, 7 Nov 2001 14:20:48 -0500

>indicates that the majority of technical computer users (let alone Joe
Sixpack) don't understand PKI and can't do much with >it if you hand it to
them 

I am in agreement with that. However, I don't feel that users should HAVE to
understand PKI in order to use it. Can you imagine how much web surfing
would be going on if Joe Sixpack had to understand TCP/IP and HTML. Jennifer
brings up a good point about SSL being widely used because it is transparent
to Joe Sixpack. 

Chris

-----Original Message-----
From: Peter Gutmann [mailto:[email-masked]]
Sent: Wednesday, November 07, 2001 12:18 PM
To: [email-masked]
Subject: RE: Software for PKI

"Harrington, Chris" <[email-masked]> writes:
>>>Finally, we seem to be making progress in getting signatures and
certificates
>>>sufficiently accesible for the average citizen to start actually using!
>>Is this of any value if they're mostly worthless?
>Instead of shouting at the rain about how insecure MS CAPI may or may not
be,

It wasn't so much a comment on security (or lack thereof), it was a reply to
the original poster's question about needing something to test PKIX
standards
with.  My response to Peter Williams' comment was that for testing PKIX
standards compliance, the PKI stuff which comes with Windows isn't terribly
useful.

>we should concentrate on developing some PKIX / RFC compliant apps that
give
>the users that "warm and fuzzy" feeling.
>
>Thoughts??

Now that's something I'd really like to see.  So far the *sole* PKI
usability
study which has been done ("Why Johnny can't encrypt") indicates that the
majority of technical computer users (let alone Joe Sixpack) don't
understand
PKI, and can't do much with it if you hand it to them (and PGP is probably
about as usable as the Windows PKI stuff, at least from what I've seen of
either).  How can we make it usable?  More importantly, *can* we make it
usable?  Will Joe Sixpack ever be able to sit down and do something
meaningful
with certificates?  Or will Passport (warm fuzzies technology if ever I saw
it)
conquer the world while we're still trying to figure out how to get an LDAP
schema everyone can agree on?

(At the moment I'm kinda putting my money on the last option, sigh.  If
there's
 any HCI people out there who'd like to work on a paper on making PKI usable
 for end users, please get in touch).

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Wed, 07 Nov 2001 23:13:26 +0100

> brings up a good point about SSL being widely used because it is transparent

And it's a good example of a cryptographic protocol which is widely
deployed in an unsecure manner.

Ciao, Michael.

---

From: "Max Pritikin" <[email-masked]>
Date: Wed, 7 Nov 2001 14:35:14 -0800

I think one could argue that SSL's security model fails exactly where this
conversation starts.

Lacking an easy deployment and human use scenario PKI ca certificates were
simply scattered onto browsers the world over. Isn't this the basic problem
with SSL? And once again we're back to discussing how to make a 'warm and
fuzzy' application for PKI that (without neglecting security) provides a
deployable, usable solution for the thousands of people that just want some
basic security when surfing the web (for example).

	- max

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Michael Stroder
> Sent: Wednesday, November 07, 2001 2:13 PM
> To: [email-masked]
> Subject: Re: Software for PKI
>
>
>