On Tue, Mar 02, 2010 at 06:13:28AM +0900, Masataka Ohta wrote:
Phillip Hallam-Baker wrote:
Moving to DNSSEC, regardless of the technical model does not eliminate
the need for certificates or CAs. The purpose of EV certificates is to
re-establish the principle of accountability.
I don't know what EV means, but anything human, including CA, is not
infallible, which is why PKI is insecure.
"EV" = Extended Validation certificates.
Re-establishing (Establishing?) the concept of accountability, I think,
requires more than introduction of EV certificates. Assuming that there
is even agreement that they have a more accountable CPS, it also requires
removal of the allegedly non-accountable CAs from trust anchor lists.
This hasn't happened.
There is also the question of the actual effectiveness of EV
certificates. Do they really work? Can their indicators be spoofed?
And can normal users use their visual cues to actually make informed
security decisions? There appears to be a growing body of empirical
work that shows that the typical user is unable to make effective
security decisions based on certificates and their complex set of
indicators (whether they are EV branded or not).
Here are a few pointers, which I'm sure many folks on this list are
well aware of ..
* An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks
ISSN 0302-9743 (Print) 1611-3349 (Online)
Financial Cryptography and Data Security, 2007
http://www.adambarth.com/papers/2007/jackson-simon-tan-barth.pdf
* Why Phishing Works
http://people.seas.harvard.edu/~rachna/papers/why_phishing_works.pdf
2006
* The Emperor's New Security Indicators: An evaluation of website
authentication and the effect of role playing on usability studies.
http://www.usablesecurity.org/emperor/
May 2007
* Crying Wolf: An Empirical Study of SSL Warning Effectiveness
http://www.usenix.org/events/sec09/tech/full_papers/sunshine.pdf
July 2009
And the paper I know of that supports the effectiveness of EV:
* Extended Validation SSL: Green Address Bar Consumer Research
Verisign/Thawte/Tec-Ed study:
http://www.verisign.com.sg/guide/ssl-ev/EV-SSL-GreenBarResearch.pdf
There have been extensive discussions on this topic on various other
lists (cryptography, w3c, etc), and I'm not sure I look forward to
seeing all of it rehashed on the IETF list. But I would be interested
in pointers to other credible studies on this topic.
--Shumon.
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf