Subject: Re: [pkix] WGLC for draft-ietf-pkix-certimage-06

From: Leonard Rosenthol <[email-masked]>
Date: Fri, 19 Mar 2010 01:14:45 -0700

I would like to voice support for publication of draft-ietf-pkix-certimage-06 as RFC.

This draft provides useful functionality for a better user interface and is
further considered as an important component in the ongoing effort to
standardize visible signatures in ETSI.

Leonard Rosenthol
PDF Standards Architect
Adobe Systems

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 19 Mar 2010 10:48:50 +0100

It doesn't really matter if this I-D passes WGLC or becomes an ETSI
standard because the browser PKI client (GUI included) haven't been upgraded
the last 10 years or so and this particular feature would be way down on the
priority list; if there actually was one.

Have you ever tried to issue a smart card using MSIE?  It's joke!
Hopefully Microsoft some day puts a little bit more work into *real* stuff
and leave "decoration" to the competition to cater for :-)

Anders

Leonard Rosenthol wrote:
> ------------------------------------------------------------------------
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: "Moudrick M. Dadashov" <[email-masked]>
Date: Fri, 19 Mar 2010 11:56:15 +0200

Anders,

> and leave "decoration" to the competition to cater for :-)

what is the problem here you are pointing at? Could you please be more
cpecific. We've been using browsers including MSIE to renew smart cards
and it works quite stable.

Thanks,
M.D.
cell: +370-699-26662

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 19 Mar 2010 14:27:04 +0100

Moudrick M. Dadashov wrote:
<snip>

> and it works quite stable.

This is long story that starts by the poor user trying to get the
enroll ActiveX object to run *by reducing security until it starts*.
Most people fail already at this stage.

Then we have the little "snag" that card initialization is not a part
of the enrollment making the whole idea of on-line rather half-baked
to say the least.

If you to that add that Microsoft et al do not use the secure
provisioning and management methods provided by the card vendors,
the only reasonable conclusion is that the whole thing is just a *toy*.

Microsoft's enrollment concept; exposing hordes of cryptographic methods
in a non-trusted browser window is also *severely broken* and a genuine
dead-end for future developments.

But sure, in a small and tech-savvy environment you can use this scheme
but I was referring to Internet scale deployment and there it doesn't
work at all.

Thanks,
Anders