On Mon, Sep 21, 2009 at 08:41:36PM +0200, Robert Kisteleki wrote: > I'm sorry for pointing out the obvious, but in _any_ system where you > receive a certificate from someone else -- like it or not -- that someone > else will have the means of revoking your cert, or not renewing it. As > simple as that. It can be an error, a bug, and (horrible dictu) abuse of > power, the real cause ultimately doesn't really matter.
But in the currently deployed PKI for web certificates, you have a
choice of CA’s. If one is abusing you (makes too many errors, etc.)
you can switch to another. They are all “equal” in the end user’s
browser (I won’t go into EV certs here, that is a whole different
kettle of fish).
I believe the competition between CA’s helps level the playing field
between those issuing certificates and those purchasing them.
-Jeff
--
========================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email protected]
========================================================================
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
