Subject: Re: [Asrg] New take on emerging idea. (Query/C-R system?)

From: "John Fenley" <[email-masked]>
Date: Fri, 11 Apr 2003 15:55:43 -0600

>From: Chuq Von Rospach <[email-masked]>
>On Thursday, April 10, 2003, at 07:13  PM, J C Lawrence wrote:
>
>>>>What government?
>>
[John Fenley wrote:]
>>>The United States Government.
>>
>>Most of the world is not American.
>
>And how do you implement this for Cuba? Syria? Libya? Whoever else America 
>is not on speaking terms this week? What happens when (inevitably) America 
>chooses to use access to this database as a lever to force it's access and 
>content policies on the world?
>
>How do you convince the world it won't try that? Not all e-mail users like 
>America, or trust America. that includes many americans.

The real question was who pays for this system.
I propsed the US government because they are an oganization who's purpose is 
to supply needed systems to the population, that would be to costly for a 
buisines.
Would we have an interstate highway system, or hoover/glen canyon/Grand 
Coulee Dam without the government? These systems help everyone. They would 
not have been created without the government. They were too costly.

The Government is a bloated beurocracy yes, but they have done good things 
for us(americans) in the past.

Has anyone heard of the National "Do Not Call" Registry?
http://www.ftc.gov/bcp/conline/edcams/donotcall/index.html

They are working on the problem, and they have the funds to pursue solutions 
that would be difficult or immpossible for a buissiness.

I would rather give my phone number to the government than, say, Microsoft. 
if anyone can get my phone number anyway why not. It's just a list of people 
who don't want to be called by telemarketers. how can that be used to 
control me? is it because they might not let me add my number if I am from 
cuba? Unfounded distrust is as dangerous as blind trust.

But enough about that... Does anyone have a reason that my system could not 
be used as a loose framework? Forget my bias against spam boxes. Assume it 
can be funded. Assume it could be distributed in nature (cashes or 
something).
=====================================================
Would a system to alias whitelists be a good thing?
John Fenley

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Fri, 11 Apr 2003 16:24:51 -0700

On Fri, 11 Apr 2003 15:55:43 -0600 
John Fenley <[email-masked]> wrote:

> But enough about that... Does anyone have a reason that my system
> could not be used as a loose framework? 

Quite a few actually, but that gets into questions of information
theory, protocol design, zero knowledge systems, etc that I'd much
rather point you at generally than spend my time explaining what so many
others have done so well.

> Forget my bias against spam boxes. Assume it can be funded. Assume it
> could be distributed in nature (cashes or something).

Those are neither cheap or easy assumptions.  They are also rather
critical assumptions.  Getting buy-in is not just fundamental, but is a
prerequisite for any proposal to be considered seriously.  

Adding distribution to a protocol system is not just a matter of
sprinkling magic "distribute-this" pixie dust.  Its hard work, and
frequently impossible without gutting the starting premises.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Scott Bellware" <[email-masked]>
Date: Fri, 11 Apr 2003 18:48:08 -0500

> I would rather give my phone number to the government than, say,
Microsoft.

I think that there are interesting alternatives to the Microsoft monolith
approaches already in the works for domains other than unsolicited marketing
control, but that may be applicable nonetheless.

For example, the work that the Liberty Alliance has been doing to forward
the cause and solutions for federated online identity provide good models
for distributed, non-government repositories.  UDDI registries of web
services follow the same model.  And we wouldn't even have eCommerce if it
weren't for the trust that we already put in certificate authorities like
VeriSign and Thawte.

IMHO, non-government repository operators that have been vetted for
credibility are perfectly acceptable and in actual fact will probably be
able to execute better and faster than a government operation.

Although the government's national no-call list is a good start, it's really
a pretty unsophisticated technological solution when you compare it to the
exigencies of a solution to ultimately control all forms of unwanted
marketing and to manage consent and hopefully, one day, adsertor marketing.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 11 Apr 2003 19:57:22 -0400

"John Fenley" <[email-masked]> wrote:
> Coulee Dam without the government? These systems help everyone.

  Not me.  I don't live in the U.S., and I have no plans to *ever*
live in the U.S.

  As Chuq noted, the U.S. is not the entire world.  Not everyone
trusts the American government.  Any system *must* work world-wide,
and MUST NOT depend on the benevolence of one government.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 11 Apr 2003 18:43:27 -0600 (MDT)

> From: "Scott Bellware" <[email-masked]>

>                                  And we wouldn't even have eCommerce if it
> ...

That is technically wrong, although perhaps politically correct.
The politicial aspect is that people who don't have any idea or
interest in the technical details have been helped to overcome
their fears of "eCommerce" by the fig leaf of comemrcial PKI.

The certificates sold by VeriSign and Thawte have nothing to do with
any trust in any merchant by anyone with the least understanding of
how the system works.  The trust any minimally knowledgeable person
has in "eCommerce" is based on the consumer protection laws on credit
cards and personal due diligence.

Just as with PGP keys, a VeriSign, Thawte, or other commercial
certificate says nothing about whether the vendor or other outfit on
the other end of an SSL or TLS connection is a crook.  Those certificates
merely make some already very unlikely attacks on your data slightly
less likely.  Namely they make some man-in-the-middle attacks less
likely.  They don't eliminate MIM attacks because of holes in DNS
security.  When (and if) DNSSEC arrives, those holes will finally be
plugged, no thanks to commercial PKI.

The confidentiality of your credit card number or other private
information on Internet wires is provided by mechanisms that do not
require any sort of PKI.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Scott Bellware" <[email-masked]>
Date: Fri, 11 Apr 2003 21:12:47 -0500

My point is to say simply that an operator of a node of a distributed
authority will be trusted because the precedent for trust already exists.

Sure, there are problems with SSL/TSL and the susceptibility to man in the
middle, but if it weren't for cert providers, we wouldn't have wholesale
encryption at the transport.  Or perhaps we'd have some other form of
encryption at the transport that might present some other - or the same -
attack surface.  And even if it is merely a perception of security, the
perception has been effective enough to provide encouragement to consumers
for engaging in allowing their information to be transmitted across the
wire - regardless of their perception of what happens with it at the data
store.

Anyway, just my two cents...  I'm personally in favor of distributing a
repository to private operators the way that Project Liberty and UDDI do.  I
don't believe that it has to necessarily be a government entity.

The thing about VeriSign and Thawte was merely an aside to suggest - again -
that a centralized control does not need to be in the hands of the
government and I personally feel that a government agency might not be able
to execute with the agility of a private agency.

My point about the government-operated national no-call list is that it
isn't a compelling example of the potential of a government operation
because the app is _relatively_ simple.

My apologies for reiterating - just trying to clarify the intent of my
message.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 11 Apr 2003 21:32:19 -0600 (MDT)

> encryption at the transport. ...

That is mistaken, although it is the party line.  "Cert providers"
have practically nothing to provide "wholesale encryption at the
transport" in any honest technical sense.  Encryption can be and often
is provided with random, single-use session keys exchanged with the
Diffie-Hellman protocol.  Certificates can only give a little assurance
than when your browser contacts www.example.com, it is talking to
www.example.com.

See RFC 2246 and especially section 1.  Notice that Encryption parameters
are independent of any certificates.  Certificates only let you know
that your browser is really is talking to an organization that Verisign
says is "Microsoft Corporation." Again, to see how much that's worth,
please read http://www.cert.org/advisories/CA-2001-04.html and
http://www.microsoft.com/technet/security/bulletin/MS01-017.asp

Offense taken in some quarters to my pointing at that saga not
withstanding, I don't think Verisign did anything bad in it except
lie about the value of commercial PKI.  Anyone who looked into buying
a Verisign or Thawte cert found that they sell as much security as an
honest person expects to buy for $150-$350.  You can't expect a cert
vendor to do more than glance at your WHOIS records and the first page
of FAX a copy of what you say is your local business registration for
the fraction of $150-$350 that can go to checking up on you.

>              ... And even if it is merely a perception of security, the

Yes, that "perception of security" is what commercial PKI has provided.
I wish I didn't that eyewash is valuable but that the public could look
at the facts.  However, this is the IRTF/IETF where we're supposed to
be designing things with either real security or a well labelled lack
of security, regardless of what Joe Sixpack needs or wants to be told.

> because the app is _relatively_ simple.

As the saying goes, "In theory, there is no difference between theory
and practice, but in practice there is."  In theory, do-not-call lists
can be operated by private organizations, but in practice, the
do-not-call lists operated by the DMA as well as large telemarketing
firms have been ignored.  In advertised theory, the private organization
TrustE made outfits trustworthy as far as respecting privacy, but in
practice, other things happened.  In other theories, the do-not-send-spam
lists operated by the DMA and other private organizations fixed spam,
but in practice we're all here.

I don't mean to imply that a central do-not-spam whitelist or whatever
would make technical, political, operational, or any other sense
because it is operated by a government.

> My apologies for reiterating - just trying to clarify the intent of my

Perhaps I should also apologize for repeating what we should all know
about authentication, encryption, PKI, certificates, and so forth.