Free Certificate Authority Unveiled by Aussies 284
SonOfGates writes "Well, the Aussies have invaded Boston but at least they're not throwing tea into the harbor. AU-based nonprofit CAcert Inc has spent the last few days at USENIX '04 registering new users by the truckload. They bill themselves as a 'Community-Based CA.' Could this be the begining of a true 'open' certificate authority? See the O'Reilly story and press release."
who else remmbers (Score:5, Insightful)
But, we might be surprised. Opinions anyone?
ps. Maybe they should patch the browser first
Re:who else remmbers (Score:2, Informative)
Not as big an impact as you think..
-Mind
Re:who else remmbers (Score:5, Informative)
Sad as it may be, IE is still used by something like 85% of the world.
Re:who else remmbers (Score:5, Funny)
For that matter, just tell people to click "yes" to accept your uncertified cert...they'll do that too.
Re:who else remmbers (Score:3, Insightful)
Simple for people like you and me. Unfortunately, get your average end-user on the phone and ask them to go to https://www.cacert.org/ and install their certificate:
"What? What's a certificate? What's this error message (about not having this certificate installed)? Ah, hell. An error. Time to reboot."
Re:who else remmbers (Score:4, Funny)
illustrative anecdote: Today, at my girlfriend's house, she was trying to use IE to check her webmail. Every time a new page loaded, a message popped up saying she needed activex (or something, she was so used to the messages that she clicked the close box really fast), and then another box popped up with something to the effect of "are you sure?".
Anyway, I installed firefox for her before letting her finish checking her mail, but the point is that people get quite tolerant of popup crap.
Re:who else remmbers (Score:3, Informative)
Re:who else remmbers (Score:5, Insightful)
Re:who else remmbers (Score:2)
That's not what I meant, my bad for being unclear. I was getting at their general tendancy to shy away from things that are open, not proprietary. I know they are not opposed to everything open, just look at their recent open-sourcing of some of their code.
Re:who else remmbers (Score:3, Interesting)
Re:who else remmbers (Score:3, Funny)
Re:who else remmbers (Score:5, Informative)
Microsoft doesn't like the GPL, but the GPL is not the be all and the end all of Free Software. Microsoft has no problems with other open licenses.
Root certificate for Redhat, Opera, Mozilla (Score:5, Informative)
Quote from the article:
He goes on to describe the process of getting the root cert, hopefully, included into the Mozilla project through a Bugzilla feature enhancement request. From what I read from the article, the discussion about this is still going on.
Re:who else remmbers (Score:4, Funny)
You are obviously one of those
Re:who else remmbers (Score:3, Funny)
But what browsers will support (Score:3, Insightful)
The more non IE browsers have the better (Score:4, Interesting)
Re:But what browsers will support (Score:5, Insightful)
Translation: You still use Microsoft Internet Explorer.
People who use MSIE obviously are not concerned about privacy or security, so CAs are irrelevant to them.
Consequently, people who still use MSIE are irrelevant to those of us who are concerned about privacy and security. People who are concerned about privacy and security are a small minority of Internet users. That doesn't mean we shouldn't try to get the privacy and security we want.
Sounds like... (Score:4, Interesting)
Too bad this cert isn't defaultly trusted by IE/FireFox.
Interesting side note: when I recieved the registration email from them, Outlook 2003 (yeah, I know...) marked it as "junk mail".
Re:Sounds like... (Score:5, Informative)
Re:Sounds like... (Score:5, Informative)
I use a Thawte p.cert to sign my email - there's a good writeup on configuring it to work with OSX's Mail.app here [joar.com] -- also a good example on how to provide visually appealing technical documentation that I can talk non-technically inclined people into reading.
-- YLFIGood for them (Score:5, Informative)
The only reason the big companies charge so much (their claim, not mine) is the insurance they provide, and the fact that they are "trusted" by the various vendors.
Any new group wanting to be a trusted CA will face the liability issue -- if one of your customers sues you, even if you try to disclaim all liability up front, you will still face massive court fees. Even if you won in court, you would lose financially if not insured.
There is no technical or logistical problem with setting up a Free (and free) common-geek's CA, the problems are entirely legal ones. I know because I looked into it right after SSL came out. It looks like a good business plan, right up until someone takes you to court.
Re:Good for them (Score:3, Interesting)
Unless you win the case, and the losing party pays for your court fees. This is common in countries employing civil law [wikipedia.org], as opposed to (mostly) former members of the Commonwealth that employ common law [wikipedia.org].
Australia might not have been the best place to found this organization.
Re:Good for them (Score:3, Insightful)
Although they certainly do make for litigation-happiness, overall the non-loser-pays system is healthier for democratic participation in the
Re:Good for them (Score:3, Insightful)
Re:Good for them (Score:3, Interesting)
Very good point. It's a shame the same doesn't apply in criminal court. The accused (almost always a little guy) can be charged with virtually anything by the prosecution (ie, high potential cost), being coerced into accepting a plea-bargain for probation 90% of the time regardless of guilt (at least here in the US). So when it really counts litigation-ha
Re:Good for them (Score:3, Interesting)
In a system where everyone pays their own legal fees, smaller parties are more likely to avoid lawsuits against bigger parties, because chances are the bigger party will continue the suit until the smaller one goes bankrupt.
I observe this in the Real World, too. Many important court cases in the USA seem to get settled, even though in Europe, the smaller party would probably have continued and won. This fits my expectations. That said, I have not done any solid researc
Re:Good for them (Score:2, Interesting)
You're assuming an open-and-shut case. For open-and-shut cases, this is probably true. But most cases are not open-and-shut. Loser-pays tends to discourage lawsuits whose favorable outcomes are not assured - i.e. most of them. Which I'll grant you includes most frivolous lawsuits
Re:Good for them (Score:3, Interesting)
That's not the way it works in the UK. As a director of a small company that has taken a few larger businesses to court, I can tell you that most of the time, the smaller business wins. That's because most of the time, the smaller business is _right_, and that's what the court is interested in.
I'm convinced that the UK civil court
Re:Good for them (Score:2, Interesting)
Yeah, but knowing you're innocent and knowing you're gonna win are two different things.
Either way you are screwed.
Indeed. The law is a bear.
great news! (Score:2, Informative)
Where's the government for a change? (Score:5, Interesting)
Alternatively... (Score:5, Informative)
Here's a summary of a proposal I wrote for canadian provinces...
The Governor General's office acts as the root CA for Government Ministries & Crown Corporations and Professional Associations.
Any professional association (Bar Association, College of Physicians & Surgeons, Engineers, etc) acts as a CA for it's members and corporations working in their field (Law firms (lawyers, paralegals, legal secretaries), Medical Clinics (Doctors, Nurses, X-Ray Techs, Appointment Clerks), etc)
Certified Accountants act as a CA for Corporations, Societies, Partnerships, etc.
The Notaries public act as a CA for individuals.
Denmark has this... (Score:5, Informative)
URLs:
- http://www.digitalsignatur.dk/ [digitalsignatur.dk]
- http://privat.tdc.dk/digital/ [privat.tdc.dk]
(both in Danish, though...)
The technicalities are run by the largest phone company/ISP, TDC, but otherwise it's fully a government thing.
Re:Where's the government for a change? (Score:3, Insightful)
There are two problems with this. As another message pointed out, not all governments are equally trustworthy. Would you trust an ID issued by Nigeria? Or would you wonder how easy it is to bribe a Nigerian official to issue one in any name you wanted?
Now look at it from the viewpoint of a Nigerian citizen. How can he/she get acceptable ID? Clearly, not from the government.
The seco
Re:Where's the government for a change? (Score:5, Interesting)
In addition, an X.509 certificate can bind any number of attributes to that name, and it's up to the CA-- not you-- to decide what those are. Once they're in the certificate, *you cannot decide not to provide them*. Kinda takes away your control over your private information.
Look up the work of Carl Ellison & Ron Rivest and others on X.509 and privacy, particularly in contrast to how SPKI handles things.
Re:Where's the government for a change? (Score:4, Insightful)
Verisign/Thawte = mafia (Score:5, Interesting)
The Cert authorities are a joke. We registered one CA with Verisign with virtually no documentation, and another time, when renewing an existing, different cert, they demanded everything short of a blood test for "authentication." It's nothing short of criminal considering they charge $200+ for something that takes 10ms to generate that they make people wait weeks for, and in no way guarantees superior security, and they'll make certs for anyone with money so the identity checking is BS and moot.
I'm all for a free certifying agency, but you can also roll-your-own with OpenSSL.
Re:Verisign/Thawte = mafia (Score:5, Insightful)
The problem with rolling your own is when a browser hits it, it burps up an error saying it can't verify the validity of the cert. Depending on what you are using the cert for, who cares.
I have my webmail server forced through https with a self signed cert. If someone that uses my webmail server doesn't like it it's no skin off my butt (I provide free mail to a few friends).
For any business sites that I setup I suggest InstantSSL [instatntssl.com], they are cheap, fast and trusted by pretty much any browser around. And that is the important part when selling to the public, that they don't get some warning. Most of them will never even look to see if the page is encrypted but if they get some funky warning odds are they will leave.
Re:Verisign/Thawte = mafia (Score:2)
This is why I pay the "mafia" their protection money for our main e-commerce web servers. Most consumers just see the dialogue box and conjure up images of their credit card numbers showing up on billboards.
But we all know why we pay this fee: not to really provide more security or privacy for transactions; to merely keep that paranoia-inducing dialog box from appearing. And it's necessary for e-commerce web sites because most users don't know any better.
But for non-public sites, like
Re:Verisign/Thawte = mafia (Score:2)
Re:Verisign/Thawte = mafia (Score:2)
On my OS X install, I installed the cert so if someone tries a man-in-the-middle I'll know as the cert isn't going to match the one on my box.
I don't know how the browsers handle it but i can tell Mozilla (all variants I use) to allow the cert. The part I don't know is, do they cache a hash or the fingerprint or just ignore cert warnings for the domain.
I also provide the cert to anybody that needs it and wants to install it.
Re:Verisign/Thawte = mafia (Score:2)
Re:Verisign/Thawte = mafia (Score:3, Informative)
InstantSSL 1 yr $49
FreeSSL 1 yr $99
They claim 96% compatibility, InstantSSL claims 99.3% (love those numbers, WTF)
They do mention the "hassles" of chained certs. I know it was a huge pain to drop one more file on my box, but I don't see it being worth $50
If I did miss something, I apologize. Let me know I'll be checking them out again in the morning.
Re:Verisign/Thawte = mafia (Score:3, Insightful)
Note to users (from their website) (Score:3, Informative)
How? (Score:2)
Maybe. (Score:3, Insightful)
Stumbling blocks would be that Verisign would still be the expensive 'gold standard' for quite a while because its always been compatible from the earlydays in the most number of browsers, and another would be getting enough funding to pay for the identity check and other redtape that it takes to really be a 'trusted' cert authority.
I wonder what the cheaper CA's like thawte and geotrust think...
--
Re:Maybe. (Score:3, Informative)
Let's qualify this for people who may not understand.
This new certifying authority will be just as compatible as any other cert. It will still offer as much encryption protection as any cert provided by any authority.
The difference is that the browser may not be "pre programmed" to recognize the authority, and will th
Re:Maybe. (Score:2)
Re:Maybe. (Score:2)
Re:Maybe. (Score:2)
If someone is spoofing a web site, there are other more obvious signs.
IMO, anyone who is foolish enough to not pay attention to the URL they're connected to (or clicks on some goofy URL link in a spoofed e-mail) when they provide sensitive information, will not be likely to pay attention to whether or not their browser is in SSL mode either, so it's a lot more probable someo
Re:Maybe. (Score:5, Informative)
Re:Maybe. (Score:2)
If you want to have fun, contact one and rant and rave about the other. For example, contact Thawte and tell them you're sick of Verisign and want to switch to them. They'll play along and never tell you they're owned by the same company!
That slashdotting didn't take long (Score:5, Interesting)
Re:That slashdotting didn't take long (Score:3, Informative)
Re:That slashdotting didn't take long (Score:2)
Finally! :-) (Score:3, Insightful)
Invalid XHTMl, Invalid CSS, Default Index (Score:5, Interesting)
Even more oddly, for a brief instant when I went to their homepage, I got a default Apache index listing, rather than their homepage. It included links to things such as their PHP MyAdmin directory [cacert.org], a number of PHP files, and three zipfiles named Bruce-someversionnumbers.zip.
Re:Invalid XHTMl, Invalid CSS, Default Index (Score:2, Funny)
slashdotted (Score:2)
Cry cry cry, certs aren't free. (Score:5, Insightful)
Not just anyone can get a CA cert. You have to be a business, I know verisign wants a copy of your business license, ect before they even issue you a cert.
Now we got this "open CA". Who is going to check if these are legitimate businesses? Will there be any checks done at all, or will it just be "by the truckload" as the headline said?
I'm all for saving a buck as much as the next guy, but when I shop online, knowing that the cert came from a trusted source that actually checks if it's issuing a cert to a legitimate business like verisign or thawte puts my mind, as well as the minds of a lot of others.
Re:Cry cry cry, certs aren't free. (Score:2)
Re:Cry cry cry, certs aren't free. (Score:2)
Long before Verisign, PGP was offering a superior service for identity authentication for e-mail. If that's what you need, you're better off using open source PGP.
Re:Cry cry cry, certs aren't free. (Score:2)
Re:Cry cry cry, certs aren't free. (Score:5, Interesting)
It's not a big deal. It doesn't mean anything. It doesn't offer more security ultimately.
The majority of e-commerce sites on the Internet are NOT operating under their own certs. Many sites that offer hosted shopping carts use a central SSL server operating under an umbrella cert. Nobody really seems to have noticed, so what Verisign/Thawte are selling is not something consumers really seem to care about.
Re:Cry cry cry, certs aren't free. (Score:2)
Re:Cry cry cry, certs aren't free. (Score:5, Insightful)
First and foremost, the Fair Credit Billing Act of 1976 protects consumers against most credit card fraud, so the whole notion of fraud being a major issue is essentially blown out of preportion. If someone charges something to your credit card, you charge it back and the burden is on the merchant to prove the legitimacy of the transaction or they lose, so there's never been much of a threat for consumers anyway.
Second, the way things have been going, customers are likely to get better products and services from smaller companies, many of whom may not be that technically inclined but instead tend to spend their energy on providing their core products and services and not running their own web servers.
Our ISP handles more than US$5M/month in online transactions for many companies much larger than ourselves, and we operate most sites under our umbrella SSL Cert. Never had any complaints.
The issue is not unlike Paypal. People accept Paypal on their web sites. When you go to complete the transaction, you're switched to Paypal's servers - there's no easy way around that. Consumers are used to this and companies like mine go out of our way to establish our reputation as a trusted provider of solid, secure e-commerce. Clients that use our services benefit from our reputation and performance. Everything works fine.
Re:Cry cry cry, certs aren't free. (Score:2)
it would just be case by case for me: as long as the company/site all seemed to check out, i would be fine with it.
Re:Cry cry cry, certs aren't free. (Score:3, Interesting)
However, the most common usage of SSL cert's is simply to enable encryption between two points. For this, there's nothing wrong with even a home-brew cert - validation of the cert via it matching the domain should be sufficient. A SSL cert generated by a 3rd party adds absolutely nothing to
Re:Cry cry cry, certs aren't free. (Score:5, Interesting)
It prevents man-in-the-middle attacks. That's the most important reason for me to use a trusted CA.
Re:Cry cry cry, certs aren't free. (Score:3, Insightful)
A self-signed cert can prevent man-in-the-middle attacks if you have a copy of the cert downloaded.
Most CAs these days only verify that an e-mail they send to the domain in question is received by the applicant, the same as this lot. I got one from Equifax on this basis, and they're trusted by default in both IE and Mozilla.
Re:Cry cry cry, certs aren't free. (Score:2)
As for Verisign, remember when they'd just hand over any domain with one simple fax? [theregister.co.uk]
Question (Score:2, Interesting)
Re:Question (Score:3, Informative)
So what? (Score:2, Interesting)
It's that last thing that makes certs valuable, not the cert itself. A free cert is free because not many people are going to trust it, and with good cause.
What about the government? (Score:3, Interesting)
is it something different than wildid? (Score:4, Interesting)
Re:is it something different than wildid? (Score:3, Informative)
Caveat: what does it cost to be "trusted?" (Score:4, Insightful)
We know this ultimately comes down to how much Microsoft would charge for this certification. Does anyone have any idea what the costs are? I imagine it would be some sort of subscription arrangement where you have to pay in perpetuity to Microsoft in order to not have your trusted status revoked. But how much? And would Microsoft let an open CA even exist in the first place?
You know us Aussies (Score:3, Funny)
Most commercial certs are worthless (Score:5, Informative)
For example, see the TrueSite Relying Party Agreement. [geotrust.com] "The Service is provided on an as-is basis without warranties of any kind".
Even Verisign's Relying Party Agreement [verisign.com], while it does offer some warranties, has a complicated scheme for weaseling out of Verisign's obligation to verify the certificate holder's identity. The relying party agreement refers you to the CPS Section 11 [verisign.com], says "Issuing authorities (and VeriSign, to the extent specified in the referenced CPS sections) warrant and promise to ... perform the application validation procedures for the indicated class of certificate as set forth in CPS Section 5, Validation of Certificate Applications [verisign.com]." There, Verisign says "The IA shall confirm that ... the information to be listed in the certificate is accurate, except for nonverified subscriber information (NSI). [verisign.com]" The linked definition of "nonverified subscriber information" is "Information supplied to a certification authority as part of a certificate application". So Verisign doesn't actually stand behind any of the information in their certificates.
This is much weaker than a signature guarantee by a commercial bank, where the bank guarantees to other parties that the person was properly identified. But it costs more.
I'd like to see banks belonging to Visa International and MasterCard issue digital certificates, and require that their certificates had to be on a page that accepted their credit cards. Certificates from banks would actually be worth something.
There are two kinds of certs... (Score:4, Insightful)
Kjella
CAcert vs. Self-Signed Cert (Score:3, Interesting)
I don't see the big difference between a self-signed cert and a CAcert. It's going to be virtually impossible for web sites to get their users to install their root certificate. Users are stupid. Generally, I don't expect they can click a link, much less add a cert.
I've been looking into using SSL on http://freeinternetpress.com . We're not a registerd company, nor do we turn a profit, so it would be an extra cost and hassle to get a real certificate. For us, the only reason to do it is to make some of our users happy by letting them browse by https.
A self-signed cert isn't any sort of magic, the instructions are in the OpenSSL documentation. I made it a step easier for people we worth with, I have a web page that they submit their information to, and it generates everything including the self-signed cert. There's no real magic to it, anyone (err, anyone with a clue) should be able to write the same thing in about 10 minutes. I spent an extra 10 minutes making it pretty.
People I deal with never use the self-signed cert. They just take the CSR and get the cert signed by a regular signing authority. What's the big difference if I sign it, or if I call myself "Joe's cert company" and start automatically signing certs? It's not much different than what CAcert is doing, other than the fact that they have a donation button on their page. At least with the people I make CSR's and self-signed certs for, I know who they are, and that I'm not accidently signing a fake microsoft.com cert.
We want to believe in CACert... but ... (Score:5, Insightful)
But we have to be careful that we don't let our "wish to believe" blind us to the need for some caution here. Take at look at CACert's site. You'll find carelessness, spelling mistakes, pieces that have not been thought out. Running a CA properly requires meticulous attention to detail, and their site shows the opposite. On the very first page when you sign up, it asks for your name, date of birth, and "country". Is that country of citizenship, or country of residence?
Then there's the reliance on "government ID". If somebody presents Nigerian ID, or Dominican Republic ID, what exactly is that worth? It's not worth anything, you can bribe officials in those countries (and many others) to issue whatever official document you want. Does that mean that citizens of Nigeria can never be trusted? That's well over 100 million people in just that one country, most of whom are honest and trustworthy. It's ridiculous to exclude so many people from receiving certificates just because their bureaucrats are corrupt, and it's completely contrary to the transnational spirit of the Internet.
In conclusion, the idea behind CACert is a good one, but the people running it don't seem to be doing a good job. I hope that somebody else takes up the idea and does it better. There is no reason why there should not be more than one volunteer-based CA.
Re:We want to believe in CACert... but ... (Score:3, Insightful)
Take at look at CACert's site. You'll find carelessness, spelling mistakes, pieces that have not been thought out.
Yah, it's not a very professional looking site. That's just how it works when you have a limited budget. I think your expectations and standards are a bit to high for an organization that just started. If they still have the same problems in 6 months, I'd be a little worried.
It's ridiculous to exclude so many people from receiving certificates just because their bureaucrats are corrupt,
X.509 is the wrong technology. (Score:5, Interesting)
X.500 naming, however, presumes a single, global namespace. The X.500 directory was intended to be a single directory for the entire planet providing unique, inescapable names for everyone.
Yeah, right. Like that's going to happen.
As a result, X.509 is carved into literally hundreds of local namespaces. But since we're stuck with the *name* as the principal, we have to use that X.509 name *globally*. There are multiple ugly kludges to get around the name problems as a result.
This makes X.509 complex, fragile, and difficult to deploy correctly.
But everyone (potentially) has a globally unique identifier-- the public part of an RSA key. Randomly generated, 2^42 512-bit RSA keys have a probability of colliding on the order of 2^(-429); even the SHA-1 hashes have a collision chance of 2^(-77). Keep in mind that we use 1024-bits as the default nowadays.
So if you use the public key as a name, it solves a whole raft of problems.
This is what SPKI/SDSI does. SPKI is key-centric; names are a local convenience; keys are bound to names instead of the other way around, and all names are local to that key. Every participant has a key pair. The public part is the identifier for the keyholder, and the keyholder authenticates himself simply by proving that he has the private part.
Keep in mind that the whole issue of binding keys to actual people can't be addressed by a PKI, it has to be addressed by strong key storage and access controls and is the same across for X.509 and PGP/GPG as it is for SPKI.
This is similar to the web of trust, but I don't need introducers (well-connected keys) to make it work right.
SPKI goes on to recognize that since authentication is simple, what we really need from SPKI is authorization. The whole of SPKI is intended to define a flexible method of allowing authorization *and authorization delegation* in a simple, distributed fashion. SPKI defines an authorization *language* so that authorizations can be chained *without the SPKI library knowing what the tokens actually mean*. This means that a single library can handle the permission sets of all applications. In addition, the language rules prevent all entities in the chain of delegations from being able to exceed the permissions he was granted.
Achieving the same under X.509 (using attribute certificates, for example) is next to impossible. ACs don't delegate (well, the standard itself says technically you can but you *shouldn't*); aren't truly distributed (i.e., the AC acts as a single choke point in granting permissions, which SPKI avoids), and doesn't model the way trust naturally flows in an organization of people (whereas SPKI allows you to source and pass around trusts in more natural ways).
Very cool stuff. SPKI shows up in all kinds of places. Carl Ellison's homepage provides the best jumping-off point if you want to learn more:
http://world.std.com/~cme/html/spki.html
Why not Mozilla.org? (Score:3, Interesting)
Re:About time... (Score:5, Insightful)
Without CA's and revocation information, SSL-style (RSA) public key infrastructures are useless. That means every client needs access to recently updated and TRUSTED revocation lists to make sure that no cert's have been forged or stolen. Every meaningful SSL client should periodically verify that any server certificates it uses are and remain valid. Using the CA's public key is absolutely NOT sufficient.
Re:About time... (Score:5, Insightful)
-Mind
Re:About time... (Score:3, Informative)
Both IE and moz can use OCSP (Online Certificate Status Protocol) - if the cert containes OCSP information (basically a URL where you can check whether the cert is revoked) the browser can check against that. Fully up-to-date windows systems actually do this by defau
Re:About time... (Score:3, Insightful)
Re:About time... (Score:5, Insightful)
I think you're forgetting the part about actually verifying the authenticity of what they're signing.
IE, If I send them a certificate signing request with my public key and a name of George W Bush on the CSR, are they just gonna go ahead and sign it and give me a certificate stating that I'm George W Bush?
Certficate authorities usually require you to provide them with proof of your identity, like faxing you a driver's license, birth certificate, buisness license, trying to contact you at the stated address and phone number, etc... if they didn't do this, they wouldn't be very useful CAs... the certificates they issue would be meaningless.
Of course, this is not to say that the expensive commercial CAs are trustworthy simply because they charge money... not at all. But to be an useful CA you need to have the manpower to verify the stuff people ask you to sign. I wonder how this free CA will accomplish that.
Re:About time... (Score:3, Interesting)
This physical paper trail does nothing to increase the s
Re:About time... (Score:4, Insightful)
The thing is, a email / personal cert from Verisign etc. comes with no guarantees that the signer is actually who they say they are. You could impersonate someone quite easily just by typing in bogus details.
Verisign doesn't audit you or vouch for you, so the cert is essentially worthless. It's a few bits that say Verisign touched it but that's about all you get for your ten dollars or whatever it is these days. If you want Verisign to actually vouch for you, you're looking at paying hundreds or thousands for a cert.
And after a 6 months, a year or two the cert expires and you have to start the process all over again.
A free CA is a good thing, but again it says nothing about the authenticity of the site / person who obtained it. I think that in itself would be an extremely valid reason for Microsoft to refuse to acknowledge them for anything but email. i.e. recognize the cert for email addresses, but not for SSL or signed executables.
On the small scale, PGP is a much better model. Anyone can make a key and start passing it around. You can get other people to sign the key if you want, but it's perfectly usable for crypto from the get go. Not only usable but faster too - as anyone who's tried to encrypt something large with RSA already knows. In fact extensions such as Enigmail for Mozilla are arguably easier to use than the built-in S/MIME.
On the signing front, I really wish Mozilla / Firefox would use PGP certs too to sign their XPI files. At present no one signs XPI files (reason: they're too expensive). If an XPI file were signed with a PGP key, you could drill down through the signers and reasonablly gauge the trustworthiness of the author. Hell, PGP doesn't even preclude CAs from doing business since they can sign keys just as well as the next person and charge for it.
Re:About time... (Score:4, Interesting)
Re:About time... (Score:3, Informative)
1) You communications are encrypted and can't be interecepted in transit. These days this is a trivial thing and can easily be provided with a self-signed cert.
2) The identity of the site owner has been verified. The trusted certificate authority has taken some measures to assure that the site has been authorized by the entity named in the certificate. This is not trivial.
Without #2, it's not too hard to set up a fake site and hijack someone's traffic. You can t
Re:Australia sucks (Score:4, Funny)
Re:Australia sucks (Score:3, Informative)
In Australia, If we lock up an American no matter what we think they might have done we let them see a lawyer in less than two years. The USA is starting to become an America without the bill of rights. However, in Australia, 911 is being mentioned when talking about stricter control of wild parties (how's that for trivialising the dead - some people in power are just self serving idiots) - so maybe the sword ban thing is true in another part of the cou
Re:Australia sucks (Score:3, Informative)
http://www.bbc.co.uk/dna/h2g2/A53650 [bbc.co.uk]
And don't panic!