, Emergent Chaos 2008-08-15
So there's some great discussion going on in the comments to "Certifiably Silly," and I'd urge you to read them all. I wanted to respond to several, and I'll start with Frank Hecker:
Could we take the cost issue out of this equation please ... [Adam: I'm willing to set it aside, because the conversation has spiraled.]I'd argue that these are the wrong questions: the real questions underlying our disagreement are probably "do certification authorities do what they're purported to do, and (if we agree they don't), what do we do about it?"The real questions as I see it are
1) Leaving aside the issue of cost, what are the pros and cons of introducing self-signed certificates into the current browser model of SSL?
2) If the advantages of introducing self-signed certificates into this model outweigh the disadvantages, what is the best approach (from a technical and user experience perspective) to introduce self-signed certificates into the current SSL model?
3) If there is a good technical/UX approach to introduce self-signed certificates into the current SSL model, what is the likelihood of such an approach being adopted on a universal basis (i.e., by all browser vendors), and how might this be made more likely?
I think we do two things: One, we stop investing so much in them, and second, we investigate the heck out of the alternatives, including persistence and organizational CAs, including CAs run by groups like the American Bankers Association. These are both in direct contradiction of the CA business model, and so they've been stillborn.
I'm not going to claim that either will have better user experience than the current SSL model, and that's a low bar.
So I'm wrong, the issue isn't really self-signed certs, it's the CA model.
There were another points raised, by both Frank and Andy Steingruebl about my bookmark model, which is that it breaks PayPal. There are two ways to read this model: One is "always use bookmarks." the other is "never click on a link in email." I intended the first, the second is unclear, given the prevalence of webmail. Perhaps we could address this by having merchants send transactions to PayPal, and then if I choose to login via a bookmark, I get a list of pending activity.
The final point that Andy raised is organizations with lots of web sites. A reasonable point, and one I'm not sure how to address. Part of how I'd address it is that most of us don't see all of those brands. I would be happy to see some of the brand profusion go away, which of course, doesn't mean it would happen. (I consulted for a bank for several years, I can't keep track of all the brands that they present around my retirement accounts.) If I can't keep track of them when they're 'not' security critical, I surely can't keep track when they are, and it is unreasonable to expect me to.
