From: rajaram@morgan.com (P. Rajaram)
Date: Tue, 28 Nov 1995 23:39:54 +0800
To: Jeff Weinstein <jsw@netscape.com>
Subject: Re: Certificate Authorities?
In-Reply-To: <01BABCAF.9CDAE5C0@csasaki>
Message-ID: <9511281004.ZM4257@morgan.com>
MIME-Version: 1.0
Content-Type: text/plain


On Nov 27,  4:46pm, Jeff Weinstein wrote:
> Subject: Re: Certificate Authorities?

>   If you want a static list of CAs that netscape products
> will accept, you will be disappointed.  In the future
> there will be more commecial CAs, many companies will run
> their own internal CAs, and information providers will
> provide certs to their subscribers to handle access
> control to their sites.  It is a losing battle to try
> to maintain a static list of CAs.  IMHO, Going with a more
> dynamic, user configurable approach is the only way to
> keep up.

Yes.  But...
I deal with the security infrastructure for a large corporation.
I want only security administrators to configure the list of acceptable CAs.
I specifically do not want our users to be able to add new CAs
to the list of trusted "approved" CAs.

The concern is that some users who are not crypto enthusiasts may be
"social engineered" into adding a very liberal CA to their list.
Once this happens, the browser's signature verification capability
is totally compromised.

This is one of the reasons why PGP has not been adopted by many large
companies.  In response, Viacrypt now seems to have a product that
can restrict user modifications to the public keyring.

-raj