Comment by cwillu
1 year ago
There is zero chance that a legally mandated certificate scheme won't require centrally-managed certificates to prevent the underage from loading illegally shared keys onto their devices.
1 year ago
There is zero chance that a legally mandated certificate scheme won't require centrally-managed certificates to prevent the underage from loading illegally shared keys onto their devices.
Certificates are not things that are centrally managed.
If you get a certificate from a CA (DigiCert, AWS,Google...etc), they hand you the certificate after necessary verification but otherwise have nothing to do with how you use (TLS traffic) it.
The same with something like age verification. Once you have a certificate that attests to your age (as of certificate issue date), the issuer has nothing to do with how you use it, the receiver of signatures generated from that certificate (via private key) can verify it without any interaction with issuer.
As for misuse, that's certainly a concern but it can be addressed via the issuing process. Certisfy does address this issue.
A fundamental requirement for making a certificate scheme work is that certificates are anchored to IRL identity via identity anchor certificates in a privacy preserving manner. You can read up on the approach here: https://cipheredtrust.com/doc/#pki-id-anchoring
> Certificates are not things that are centrally managed.
Of course they can be. That they aren't _necessarily_ centrally managed is a neat fact about the math, but has little bearing on what sort of system the political process will end up endorsing, and _that_ is what I'm saying has no chance of not being centrally managed.
The government will end up requiring that only Trusted Parties be permitted to handle loading the key material into Approved Devices, and that parties requiring age verification only permit use with Approved Devices. Mark my words, this is how it will hit the streets, if it ever does.
Did you just forget that CAs exist? They are centralized. You always have to trust SOMEONE. Even if it's the person that wrote the CA software being used, or the supply chain that provided the software to a vendor, or or or. See what I mean?
The CAs being centralized is not a problem. They do the verification and issue the certificate. The privacy concern stems from using the certificate and CAs are not involved in that process.
Yes you do have to trust someone and the CA is the trusted entity for doing the verification, but once they do the verification and in effect encode that verification onto a certificate, their role is done.
Meh, while I think he has some misunderstandings about the role of CA's, I'm not sure you're doing any better: you can certainly use certificates in a decentralized manner; I use them every day for ssh. No third parties are involved at all.
2 replies →