Subject: Re: [Cfrg] [saag] Further MD5 breaks: Creating a rogueCAcertificate

From: Paul Hoffman <[email-masked]>
Date: Thu, 8 Jan 2009 10:20:55 -0800

Folks: is rehashing the blue-sky discussions of how to create a better trust model for SSL without a stable proposal to look at really a good use of the the CFRG, SAAG, S/MIME, and PKIX mailing lists?

If you want to be serious about this, please write an Internet Draft and set up a mailing list for the discussion. Invite people from these lists to join, and maybe announce revisions to your draft. Be sure to invite people from the Mozilla security community: they are having their own (perpetually repeating) discussion of this, again without a stable document to comment on.

We *can* change the security model, but not with the current method of discussion-without-focus.

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
Cfrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/cfrg

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 09 Jan 2009 15:27:35 +1300

"Eric Gray" <[email-masked]> writes:

>Since the consumer ultimately pays the price in any case, perhaps a good
>argument can be made for paying a portion of it up front?

And how are you going to convince the consumer of this?  They get "free"
protection currently with their credit cards, and now they have to pay for it?

(In fact there's already been a case of this failing in the past, when banks
asked customers to pay a little extra to get their photos put on their credit
cards for fraud protection.  Went down like a lead zeppelin).

Anything that involves customers having to pay for something that they
consider as a right to get for free is going to fail before it even starts.
That's actually not as bad as it sounds since it's one of the few hard-and-
fast design guidelines for this area, unlike most other things ("this may or
may not work, depending on the circumstances").

Peter.