Feeds

Of Infocard: Who keeps an eye on the guardians?

Why not PGP keysigning?

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Nick Kew has raised an interesting point re: Mary Branscombe’s InfoCard piece.

It touches on “quis custodiet ipsos custodies” - who will keep an eye on the guardians? Do you have to have an unblemished reputation in order to manage identity and security? Probably not, in theory – but I bet you won’t get much buy-in from the general public (or, I hope, the press) if your past behaviour is dodgy.

So, some of the companies involved in dealing out identity/security have featured in anti-monopoly cases, have allegedly tricked people into changing their domain registration supplier by giving the impression they’re something they’re not and have failed in “due diligence” on identity generally (in one case, by giving a chancer a Bill Gates ID.

Also, the commercial concept of charging different rates for different “qualities” of identity (the cheapest needing little more than headed notepaper as “proof” of ID) seems to me to be a real gift for fraudsters – and Microsoft’s “do you want to trust all content from this provider” in IE seems fundamentally silly too (the only sensible answer is “sometimes”; not an option).

Personally, I see a need for “trusted third parties” in this space – regulated professionals similar to solicitors and “commissioners for oaths”, who can guarantee that a public key means what you think it does. But I have to admit that Pretty Good Privacy (PGP) trust seems to work well enough, although I’m not sure it will ever suit the technophobe masses.

Anyway, here’s what Nick says, and I obviously have some sympathy with it (although, in the context of the piece commented on, it raises issues rather outside the scope of what Mary was asked for: a developer’s heads-up on InfoCard technology):

“We have an established web-of-trust through PGP keysigning, that is (for end users) altogether preferable to certificate authorities. Why do initiatives like InfoCard not use this, at least as an option?

“Verisign's monopoly position seems to me altogether more damaging than Microsoft's, and I find it deeply depressing that they've been allowed to eliminate so much of the competition (e.g. buying Thawte - the other big name in the identity business) without regulatory scrutiny. And of course they are successor to Network Solutions, the worst monopoly nightmare I've ever had the misfortune to deal with in any 'net business.

“I have a great deal more trust in my colleagues whose PGP keys I've signed than I do in an industry dominated by companies with a very nasty track record.”

Internet Security Threat Report 2014

More from The Register

next story
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
Chrome 38's new HTML tag support makes fatties FIT and SKINNIER
First browser to protect networks' bandwith using official spec
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.