Robot CA at toehold.com

[Kyle Hasselbacher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Dec 05, 2002 at 10:11:25PM +0100, Volker Gaibler wrote:
>On Thu, Dec 05, 2002 at 11:24:01AM -0600, Kyle Hasselbacher wrote:
>> With tools yet to be created, people could get the benefits of encryption
>> without having to understand it.  The robot CA will make those tools work
>> better.
>
>I think it is really dangerous to give people that feeling of security.
>Someone who doesn't understand the basics of encryption will not be able
>to use it an a secure way. I'm not talking about mathematics but about
>the meaning and implications of a exportable signature, a local
>signature and assigning trust - just as examples. 
>
>The most vulnerable point of encryption is the interface key <--> person. 
>Just as people get used to accepting all certificates when using SSL.
>And granny will not be aware of the fact that only email address is
>checked - at least not in every-day business. 

I'm willing to yell from the hilltops how secure this idea is not.  I
haven't plastered it all over the web site yet, but it'll be a big part of
the FAQ when I make one.

I agree with you in principle that security is hard, and that people should
understand the risks involved.  However, the reality is that people don't
understand security, and I, for one, think the majority of them never
will.  I'd like to give them some better security in spite of their own
limitations.

>> security.  I don't deny it.  What I think, though, is that the false sense
>> of security will always be a problem.  I've talked to users who are
>> astonished to learn that their sysadmin can read their email on the mail
>> server.  I want those who don't understand security, who think they have
>> some, to actually have more than they do now, even if it's not the most
>> that's possible.
>
>And the will be astonished that their sysadmin cannot only read their
>email but can also forge signatures.

They're already astonished that a From: line can be forged--not just by
their sysadmin, but by anyone.
- -- 
Kyle Hasselbacher | Relying on the government to protect your privacy is like
kyle@toehold.com  | asking a peeping tom to install your window blinds. - JPB
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE979G/10sofiqUxIQRAr/mAJ467RiyPnP74G43tQVO+ZOcx1YlygCgm07N
u7B2uWWp/A4dhZcg+juDMMk=
=aPSw
-----END PGP SIGNATURE-----