Subject: A random PKI question ... (philosophic)

From: Thierry Moreau <[email-masked]>
Date: Thu, 30 Oct 2008 10:41:25 -0500

OK, while off-topics discussions ae taking place, here is my question:

Do you really think a parent should train his/her 12 years old child to 
*sign* a form when a teacher requests so - e.g. an unspecified paper 
form that the child thinks is *acceptable* in his mind according to the 
influence present at the moment?

Please transpose this where the teacher is an IT support person, the 
child is an end-user, and the form signature is the ubiquitous 
client-side PKI signature technology that you, the PKI gurus as the 
parent above, think is good for the next generation of civilized 
(computer-literate) persons.

Not awaiting a response really, ...

R.i.p (rest in peace) PKI.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

---

From: Stephen Wilson <[email-masked]>
Date: Fri, 31 Oct 2008 05:41:15 +1100

I have no idea what the analogy is trying to say.  But I suspect you're 
barking up the wrong tree.  The idea of telling people to sign things 
like this just doesn't carry over into e-business.

If we could get everyone away from the utopian idea of a general all 
purpose ID certificate used to sign anything and everything -- like the 
ridiculous fountain pen still beloved by CAs in their marketing material 
-- and move on to practical use cases, then so much of this debate would 
evaporate.

Practical experience is that PKI works well in closed communities.  The 
lesson is not that closed communities are an early stage in the 
evolution of PKI to some general purpose end state.  Rather, the lesson 
is that PKI really is best suited to closed communities -- see trade 
documentation, e-prescribing, conveyancing, set top boxes, smartcards 
etc etc etc.  Closed PKI really is the general use case, and not a 
special use case!

Theoretical analysis leads to the conclusion that PKI is best for 
automating routine formal transactions between parties that already know 
each other (or know of each other's authorities) in a defined context. 
It is not much good at all for stranger-to-stranger context free 
e-business (and this is where I agree with Anders that e-mail is not 
much of a "business system").

Cheers,

Steve Wilson

Lockstep
www.lockstep.com.au

---

From: Scott Rea <[email-masked]>
Date: Thu, 30 Oct 2008 17:28:17 -0400

The idea of being able to sign in a browser would give it credence to 
being the ultimate UI tool to enable a lot more applications than it 
currently can without the kludgey add-ons. But what is proposed is 
ultimately just a tool - Thierry you seem to be referring to an 
implementation issue or how the "tool" might be used. A car is a great 
tool for moving people or cargo efficiently and speedily over vast 
distances, but if it is pointed at a person, or another car, it can kill 
or maim them - that doesn't make the car inherently bad - its just a bad 
use of a tool.
And as far as signatures go - they are just an artifact to prove intent 
of the signer  - it usually comes down to lawyers if there's a challenge 
anyway. Sign tags in a browser would just give applications better tools 
to implement their logic.
-Scott

Thierry Moreau wrote:
> Do you really think a parent should train his/her 12 years old child 
> to *sign* a form when a teacher requests so - e.g. an unspecified 
> paper form that the child thinks is *acceptable* in his mind according 
> to the influence present at the moment?
>

-- 
Scott Rea
Director, HEBCA Operating Authority
Dartmouth College Sr PKI Architect
Peter Kiewit Computing Services
Dartmouth College
HB 6238, #058 Sudikoff
Hanover, NH 03755

Em: [email-masked]
Ph#(603) 646-0968
Ot#(603) 646-9181
Ce#(603) 252-7339