Subject: Re: On Subject Organization logotypes

From: "Jacoby, Jeffrey" <[email-masked]>
Date: Fri, 6 Dec 2002 11:58:11 -0800

Stephen Kent wrote:
> 
> Jeff,
> 
> The logotype extension is NOT intended to identify individuals with
> photos as suggested in your scenario, which is why it does not allow
> for an extension associated with a subject EE.
> 
> If Tom wants to have a gif of himself in a cert, then he can be a CA
> for an organization (Tom Clancy Inc), and issue certs only to
> himself. This would probably accomplish the same underlying goal of
> recognition that is the focus of your scenario, right?
> 
> Steve

Steve,

  Your solution does accomplish the goal, but it seems 
like a *really* clumsy way to do it! :)

Aside from original intent (which is fine with me), are
there other reason the logotype extension is precluded 
from using individual photos?  

And getting back to a more basic question, is my scenario 
even reasonable (on a broader scale than just a few well-known 
individuals)

Jeff

---

From: Stephen Kent <[email-masked]>
Date: Fri, 6 Dec 2002 15:37:13 -0500

>even reasonable (on a broader scale than just a few well-known

I think the answer is precisely because we approved this extension 
based on a well thought out use case that does not extend to 
individuals.

In general it would probably be very bad to put user photos in certs, 
because there would be few mechanisms to prevent bogus photos being 
included. In a number of contexts certs are issued remotely, with no 
face-to-face meetings that would allow for verification of a photo. 
If users come to rely on the photo to disambiguate among similarly 
named individuals, we set the stage for new fraid opportunities. Note 
the security considerations discussion in the current document.

With corporate logos, there is already a clear intent by companies to 
prosecute folks who infringe on trademarks, which helps mitigate the 
risk that RPs will be fooled for any extended period. And the 
scenarios in which we envision this being used will definitely 
involve folks who can be expected to "go after" anyone detected using 
a similar logo.

Steve