Web of Trust (a revolution)

[Tim]

Craig White:
>>> http://www.openca.org/

Tim:
>> Though that leaves you with a few problems:  
>> 
>> Few clients recognise them as an authority  ... (and) ...  not so
>> trustworthy trusting

Craig White:
> I agree that you are discussing the present day practical limitations
> but the concept of an open certificate authority would seem to defeat
> most, if not all of the problems of a corporate certificate authority
> such as Verisign or Thawte, etc. It would seem that those who harbor
> those concerns should join openca.org, help it reach critical mass, help
> it get root certificates installed in browsers by default, etc.

I agree it would be nice to bring in something better than some of the
existing systems, but I see two big problems in getting yet another root
certificate adopted:  

Just how many root certificates are software builders willing to add?
If they feel the list is getting too big (I'm sure there must be lots of
small certificate authorities, or organisations that want to be one),
they may settle for the *just* ones they feel are most important.

That sort of decision would be based on popularity (a problem you'd like
to see overcome, and could be overcome, given enough of a push, but
whether we have the numbers is another matter), and whether the
certificate authority is effective enough to support (i.e. why add any
root certificate that proves very little).

Then there's trying to convince organisations to use less trust worthy
root certificates.  Who wants their service to be flagged by web
browsers as "encrypted but a bit risky"?

It's perceptual, and ignoring the fact that existing, apparently better
certificates, are currently used by some services that don't prove who
they are any better than the lesser known root certificates.  But that's
the point of certificates - how things *look* to the casual observer.

-- 
[tim at localhost ~]$ uname -r
2.6.27.19-78.2.30.fc9.i686

Don't send private replies to my address, the mailbox is ignored.  I
read messages from the public lists.