[Cryptography] Verisimilitrust

[ianG]

On 10/01/2016 02:29 am, Phillip Hallam-Baker wrote:
> SIGH.
>
> The WebPKI was designed for the purpose of allowing people to buy
> stuff from online stores with at least the same degree of security as
> through traditional mail order or in traditional stores. That is all
> it was ever designed to do. If you are upset that it is not proof
> against certain attacks ask yourselves why you were using a system
> that was never designed to meet those requirements.


Then, the requirement wasn't for strong MITM protection because mail 
order or traditional stores already suffer MITM.

So, I disagree.  The WebPKI was designed to use some technology that 
happened to have been at hand at the time.  Retail just happened to be 
the driver for it, so the security model was crafted to make retail 
appear so that it needed that technology.


> Oh thats right, the WebPKI is the only open PKI that has ever been
> deployed and become ubiquitous.

Which is not true.  SSH, Skype, and all the other chat programs out there...

> Plenty of folk had much better ideas
> about how to make much more capable systems than I ever did. Which is
> of course why you have all been using them for the past decade.

:)  Let's not move the goalposts.  The original topic was the use of the 
word trust.

iang