[Pine-info] getross - email privacy /security of system

[Curt Sampson]

On Sat, 11 Nov 2006, Ross wrote:


> You say "no added signatures are necessary" first. Yes, added signatures are 

> required for anything serious. Then it seems you say above "signatures on a 

> copy", more than yours?  That is good. Maybe we do not understand.

>

> I want a witness, maybe many, depending on what I would be dealing with for 

> info. I want to be sure it is you.....


My confusion was that I believed you said you wanted more signatures on
the document. I thought this becuase the <cjs at cynic.net> identity on the
key that signed that document already has 27 signatures on it, beyond my
own self-signings.

I see two levels of verification here. One is verifying that the key
that signed the document actually is associated with to "Curt J. Sampson
<cjs at cynic.net>". For that, we use the signatures on the key.

The second is proof that a particular person signed the document by
having a witness also sign the document--a notarization. That can be
done by having a trusted witness identify, in the document, how he
believes it was that person who signed it, and having him sign it too.

But this starts to get complex; I'd have to write pages to explain all the
little details and ramifications of this. One good paper to look at is

     http://www.nationalnotary.org/userimages/MIT-eNot0106.pdf

(particularly section 4).

This sort of issue is the primary difficulty. Most people have used
Notaries Public and still don't have a good understanding of what they
do, how they do it, and what level of verification this provides. Even
Notaries Public themselves need special training for this, because a
mistake on a Notary's part can invalidate the trust he's supposed to
provide. A look at various proposals for "electronic notarization" can
show how rare understanding of this is; some of these proposals entirely
break the notarization system.

For the UI stuff, yes, better interfaces can be programmed. But it's
been years, and they've not been yet. It's an easier problem (a *much*
easier problem), but still apparently difficult.


>> Unfortunately, the complexity cannot be eliminated. The one part you've

>> described is easy, but you've ignored the issues of how that person

>> sending the mail has managed his key and, more particularly for this one

>> exchange, how the receive verifies the identity of the sender.

>> Fact is, if people were generally good at that latter operation, we

>> wouldn't have phishing scams.

>

> You are not describing complexity to be eliminated, you are describing

> slobs, part of my argument that your key needs witnesses so I know you

> are not sloppy or compromised.


I personally wouldn't use the world "slobs," as it's somewhat
perjorative. That aside, a major issue that needs to be recognized is
that, in general, people *are* "slobs," and saying "people shouldn't be
slobs" will not change that situation. We need a system that deals with
this if it's to be effective.


> Sloppy key creation, management, distribution, handling, can only be

> eliminated by eliminating sloppy People.


That would leave very few people left to use the system. :-)


> Security starts with a major premise, that access to certain info is

> provided only to those that "need to know" & are trustworthy. Mouthy

> People do not get confidential info from me, so who cares about how

> they handle their keys.


Public key cryptosystems are used for far more than confidentiality,
and from a societal point of view, confidentiality is one of the less
important and less frequent needs.

At any rate, I'm going to leave this now, since it's getting far
off-topic from this list, I think....

cjs
-- 
Curt Sampson            <cjs at cynic.net>             +81 90 7737 2974
   The power of accurate observation is commonly called cynicism
   by those who have not got it.    --George Bernard Shaw