Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.
David Schwartz wrote:
Wow. You just conceded that there is significant pressure on major
vendors to not counter the CA, and then claimed that some ethereal other
would magically be able to enforce it where Symantec couldn't.
What?! I did nothing of the sort. My "then" follows his "if". It does
not
concede that his "if" is true, in fact I think it's preposterous.
Refusing to address a point in an argument and responding with "then
someone else would have" is, by definition, conceding the point.
It's not a preposterous point. Why should Symantec use their AV product
to police the CA market? How about their other products? It would only
happen when it benefits them to do so, and that will only happen if the
CAs completely fail to do their duties.
Market demand sometimes does create solutions, however to claim that it
does without fail is a bit naive.
Didn't say that.
Yes, you did say that. Look back in the thread. You were saying "The
market will provide a solution". I said that that was naive. Your
retort was "didn't say that".
Are you conceding more points or just ignoring your own arguments?
So, if not Symantec, then who else do you propose would?
Lavasoft, Computer Associates, Bazooka, Webroot, Zone Labs, and pretty
much
every other computer security vendor.
The same pressures that affected Symantec would affect them.
History disagrees with you. So do a number of economists.
First of all, the unusual circumstances have occured in distorted
markets.
All markets have the potential to be distorted. And any sober review of
any market will find most of these practices in place to one degree or
another.
Second, it took awhile for people to learn that these strategies almost
never work and to figure out precisely under what circumstances they do
work.
Sure, they didn't know the best way to cheat people at first. All
solutions are better managed after trial and error. The problem with
your argument is that there is corruption in the markets, or are you
arguing that corruption is dead and all markets fix themselves? That
would seem a bit assinine to me. I guess you'll just respond with "I
never said that markets correct themselves..." :)
It would harm them, yes, but they very well can get away with it.
Right, until it harms the users.
Correction: until it materially harms the user enough to address the
issue. All decisions have a cost/benefit basis to them.
It's interesting how you cite market dynamics in your arguments, but
disregard them when they aren't favorable to your point.
How so?
Because you're neglecting to consider important factors in the markets
that are affected by this particular bug and, in fact, all CA root cert
revocations on the part of browser producers and when I bring them up,
you ignore them. Ignoring them makes it appear that you're being
selective in your positions.
Or people set up that CA to a lower level of trust where they know the
certificate has come from a CA they don't fully trust. Or maybe they
download a list of certificates manually from that CA and don't trust
unknown CAs without querying them with a third party. Or maybe, ...
You can't predict how the market will work.
Of course not - I can only speculate based on factors at work at the
time. The same goes for yourself.
There is a market in keeping users ignorant. So long as things "just
work"
users can stay ignorant, and I assure you, if CAs create a situation that
doesn't "just work", someone else will work hard to come up with a solution
to keep things that way.
Whoa whoa whoa. We're not talking about CAs creating a situation where
things don't "just work". Not in the least.
We're talking about the current IDN "bug" and the CAs dealing with
that. Someone else already answered that point by (correctly) stating
that it is not the responsibility of the CAs to protect people from
things like that.
My point is that even if it were their responsibility, you can't just
explicitely trust them to do so. Their accountability in dealing with
it is limited because as long as they are providing their service, they
won't be harmed.
If that situation became the norm, obviously - over time - that CA would
be obsoleted.
However, in the current context we're not talking about the CA system
failing.
There are millions of people out there who don't trust the MPAA or the
RIAA, for that matter. Not having the trust of the people hasn't
stopped them. Again, you've chosen a very poor example.
No, the issue (with the MPAA, I'm not sure how the RIAA got into this)
is
not that people trust or don't trust them, the issue is that all they have
to sell is their trust. For the vast majority of people, trusting the MPAA
has never caused them a problem. So the alternatives to the MPAA only target
very specialized markets.
The average person doesn't have a choice. The MPAA is, effectively, a
trust and a control for the movie industry. Looking through my own
movie collection, I don't have many movies that aren't associated with
the MPAA and I think I'd be hardpressed to find more than five.
The average person doesn't have a trust relationship with the MPAA.
It's more of a dictatorial relationship. People buy or go watch movies
and, if the product is defective, they return it. There's not much of a
trust relationship there to speak of.
Hell, most people don't even trust the MPAA to properly rate movies.
The market does not inherently protect people. Anyone who believes that
is reality impaired and doesn't have a very good understanding of
history nor economics.
That's not what I'm saying. I'm saying CAs have a huge interest in
making
sure their customers don't get harmed by their actions.
Yes, they have an interest in providing their services in the way that
is economically feasible to achieve their best goals. Obviously, they
don't want to see their customers harmed by their actions. However,
it's a leap of faith to go from that to "they will provide the best
service ever possible".
-Barry