Slashdot Mirror

← Back to Stories (view on slashdot.org)

Free Certificate Authority Unveiled by Aussies

Posted by CowboyNeal on from the good-things-from-down-under dept.

SonOfGates writes "Well, the Aussies have invaded Boston but at least they're not throwing tea into the harbor. AU-based nonprofit CAcert Inc has spent the last few days at USENIX '04 registering new users by the truckload. They bill themselves as a 'Community-Based CA.' Could this be the begining of a true 'open' certificate authority? See the O'Reilly story and press release."

87 of 284 comments (clear)

  1. who else remmbers by ErichTheWebGuy · · Score: 5, Insightful

    when Microsoft released that update for IE that included lots of new CAs? Anyone think this one will be included in the next one? My guess is no, judging from Microsoft's general resistance to anything open.

    But, we might be surprised. Opinions anyone?

    ps. Maybe they should patch the browser first ;)

    --
    bash: rtfm: command not found
    1. Re:who else remmbers by mindmaster064 · · Score: 2, Informative

      Yea, I remember it... But, if you use anything mozilla like you can import the CA cert of any certificate authority you'd like. I am not sure how you do this with IE (since I wiped that right the hell off my boxes, my windows boxes don't even use it).

      Not as big an impact as you think..

      -Mind

    2. Re:who else remmbers by 0racle · · Score: 4, Insightful

      Microsoft has no resistance to *everything* open, despite what you read on Slashdot.

      --
      "I use a Mac because I'm just better than you are."
    3. Re:who else remmbers by ErichTheWebGuy · · Score: 4, Informative

      Yea, you can do it in IE too. The problem is that end-users do not know how to, and the whole concept is completely foreign to them.

      Sad as it may be, IE is still used by something like 85% of the world.

      --
      bash: rtfm: command not found
    4. Re:who else remmbers by ErichTheWebGuy · · Score: 2, Insightful

      It's actually quite simple to do this with Windows/IE as well

      Simple for people like you and me. Unfortunately, get your average end-user on the phone and ask them to go to https://www.cacert.org/ and install their certificate:

      "What? What's a certificate? What's this error message (about not having this certificate installed)? Ah, hell. An error. Time to reboot."

      --
      bash: rtfm: command not found
    5. Re:who else remmbers by mrchaotica · · Score: 3, Funny

      Considering all the malware windows accumulates, if people rebooted every time they got a weird popup/error they'd never get anything done.

      illustrative anecdote: Today, at my girlfriend's house, she was trying to use IE to check her webmail. Every time a new page loaded, a message popped up saying she needed activex (or something, she was so used to the messages that she clicked the close box really fast), and then another box popped up with something to the effect of "are you sure?".

      Anyway, I installed firefox for her before letting her finish checking her mail, but the point is that people get quite tolerant of popup crap.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    6. Re:who else remmbers by mrchaotica · · Score: 2, Interesting

      I'm curious (not trolling, despite my sig), could you name something that Microsoft has that's open, that they weren't forced to use in order to compete (e.g. "shared source")? I'm trying, but I can't think of any myself.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    7. Re:who else remmbers by Azari · · Score: 3, Funny

      MS has absolutely no opposition to open wallets.

    8. Re:who else remmbers by DNS-and-BIND · · Score: 5, Funny
      Just make an unsigned ActiveX control to import the cert. People click "yes" on those things all the freaking time.

      For that matter, just tell people to click "yes" to accept your uncertified cert...they'll do that too.

      --
      Shutting down free speech with violence isn't fighting fascism. It IS fascism!
    9. Re:who else remmbers by 0racle · · Score: 4, Informative

      Services for Unix is widely known to use BSD licensed code and utilities from the OpenBSD project. The TCP/IP stack in early NT products was BSD code, and its possible some of the utilities, the ftp client for example, is still BSD code.

      Microsoft doesn't like the GPL, but the GPL is not the be all and the end all of Free Software. Microsoft has no problems with other open licenses.

      --
      "I use a Mac because I'm just better than you are."
    10. Re:who else remmbers by julesh · · Score: 2, Informative

      This often happens if you've set scripting of ActiveX components in the Internet zone to 'prompt' (which is a good idea) and not set your webmail host to be a trusted site (which is also a good idea, imho - who knows how good they are at stripping out weird HTML?).

    11. Re:who else remmbers by VivianC · · Score: 3, Funny

      ...judging from Microsoft's general resistance to anything open.

      You are obviously one of those /. anti-Microsoft trolls. How could you accuse them of being against anything open? Outlook and IE are two of the most "open" programs I've ever seen. And don't even get me started on how "open" Windows is in general when you stick it on a broadband connection without a firewall. That was four hours of cleaning at my cousin's house last weekend.

      --
      Viv

      Gmail invites for ip
    12. Re:who else remmbers by SEWilco · · Score: 2, Funny

      It took you four hours to install Linux?

  2. But what browsers will support by Anonymous Coward · · Score: 3, Insightful

    I'm sure Mozilla/Opera might, but what about Microsoft? If Internet Explorer doesn't support it's unfortunately not very useful.

    1. Re:But what browsers will support by njdj · · Score: 4, Insightful
      If Internet Explorer doesn't support it's unfortunately not very useful.

      Translation: You still use Microsoft Internet Explorer.

      People who use MSIE obviously are not concerned about privacy or security, so CAs are irrelevant to them.

      Consequently, people who still use MSIE are irrelevant to those of us who are concerned about privacy and security. People who are concerned about privacy and security are a small minority of Internet users. That doesn't mean we shouldn't try to get the privacy and security we want.

  3. Sounds like... by kai5263499 · · Score: 4, Interesting

    The mythical "web of trust" we were supposed to have in Verisign/Thawte/etc... is finally comming true in a NON-PROFIT entity.

    Too bad this cert isn't defaultly trusted by IE/FireFox.

    Interesting side note: when I recieved the registration email from them, Outlook 2003 (yeah, I know...) marked it as "junk mail".

    --
    -Wes
    1. Re:Sounds like... by casuist99 · · Score: 5, Informative

      I know it's not non-profit, but Thawte does provide personal certificates for free. You can use them for email encryption and signing without any difficulty. As for server certificates (https, etc), I think you'd have to pay for, but for personal email usage, Thawte is a pretty good option.

    2. Re:Sounds like... by YOU+LIKEWISE+FAIL+IT · · Score: 4, Informative

      I use a Thawte p.cert to sign my email - there's a good writeup on configuring it to work with OSX's Mail.app here -- also a good example on how to provide visually appealing technical documentation that I can talk non-technically inclined people into reading.

      -- YLFI
      --
      One god, one market, one truth, one consumer.
  4. Good for them by A.+Pizmo+Clam · · Score: 5, Informative

    Many ISP's and low-budget group have self-signed certs. They're easy to make. Hopefully this project will make it easier. I have quite often seen sites with a self-signed cert and another page giving the fingerprint of the cert. Most vendors allow these, but they aren't "trusted".

    The only reason the big companies charge so much (their claim, not mine) is the insurance they provide, and the fact that they are "trusted" by the various vendors.

    Any new group wanting to be a trusted CA will face the liability issue -- if one of your customers sues you, even if you try to disclaim all liability up front, you will still face massive court fees. Even if you won in court, you would lose financially if not insured.

    There is no technical or logistical problem with setting up a Free (and free) common-geek's CA, the problems are entirely legal ones. I know because I looked into it right after SSL came out. It looks like a good business plan, right up until someone takes you to court.

    --

    Thank you for your support.
    1. Re:Good for them by RAMMS+EIN · · Score: 2, Interesting

      ``Even if you won in court, you would lose financially if not insured.''

      Unless you win the case, and the losing party pays for your court fees. This is common in countries employing civil law, as opposed to (mostly) former members of the Commonwealth that employ common law.

      Australia might not have been the best place to found this organization.

      --
      Please correct me if I got my facts wrong.
    2. Re:Good for them by A.+Pizmo+Clam · · Score: 3, Insightful

      If you, as a small corporation, non-profit or individual, go up in court against a large corporation or an ambulance-chasing shark, your chances or losing are better than not. Loser-pays systems therefore discourage discourage lawsuits by the little guy against the big guy, and make the little guy more likely to throw up his hands and settle when sued by the big guy.

      Although they certainly do make for litigation-happiness, overall the non-loser-pays system is healthier for democratic participation in the legal system.

      --

      Thank you for your support.
    3. Re:Good for them by mrchaotica · · Score: 2, Insightful

      The problem with non-loser-pays is that small organizations/individuals can't afford to fight at all, even with a rock-solid case, because they'll run out of money before it's over.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    4. Re:Good for them by joggle · · Score: 2, Interesting
      Although they certainly do make for litigation-happiness, overall the non-loser-pays system is healthier for democratic participation in the legal system.

      Very good point. It's a shame the same doesn't apply in criminal court. The accused (almost always a little guy) can be charged with virtually anything by the prosecution (ie, high potential cost), being coerced into accepting a plea-bargain for probation 90% of the time regardless of guilt (at least here in the US). So when it really counts litigation-happiness isn't an option. Go figure.

    5. Re:Good for them by RAMMS+EIN · · Score: 2, Interesting

      I see it rather the other way around.

      In a system where everyone pays their own legal fees, smaller parties are more likely to avoid lawsuits against bigger parties, because chances are the bigger party will continue the suit until the smaller one goes bankrupt.

      I observe this in the Real World, too. Many important court cases in the USA seem to get settled, even though in Europe, the smaller party would probably have continued and won. This fits my expectations. That said, I have not done any solid research. If you can up with some data that proves me wrong, please do. The fewer unfounded prejudices, the better.

      --
      Please correct me if I got my facts wrong.
    6. Re:Good for them by A.+Pizmo+Clam · · Score: 2, Interesting

      In a system where everyone pays their own legal fees, smaller parties are more likely to avoid lawsuits against bigger parties, because chances are the bigger party will continue the suit until the smaller one goes bankrupt.

      You're assuming an open-and-shut case. For open-and-shut cases, this is probably true. But most cases are not open-and-shut. Loser-pays tends to discourage lawsuits whose favorable outcomes are not assured - i.e. most of them. Which I'll grant you includes most frivolous lawsuits, but some legitimate ones as well.

      Case in point: guitar manufacturer Ernie Ball. When you get hit with a software EULA violation, you have to pay the SPA's legal fees if you fight it and lose. As Sterling Ball says in the linked interview, no one wants to fight it - everyone settles.

      In terms of statistics, just compare the total number of lawsuits in the US and Europe. We have more suits of every kind, including more David vs. Goliath ones. Whether that's worth the price of ubiquitous litigation is open to question, but it is the case.

      --

      Thank you for your support.
    7. Re:Good for them by A.+Pizmo+Clam · · Score: 2, Interesting

      Look at the folks settling up for the RIAA cases...granted most of these people were in the wrong and knew they were -- but some of the ones falsely accused also realized it would be cheaper just to pay up than deal with it.

      Yeah, but knowing you're innocent and knowing you're gonna win are two different things.

      Either way you are screwed.

      Indeed. The law is a bear.

      --

      Thank you for your support.
    8. Re:Good for them by ziplux · · Score: 2, Informative

      A cert from a CA tells you _for certain_ that "joeskillerdeals.com" is really the website for Joe's Killer Deals. Whether you trust Joe is up to you, but the cert ensures that Joe is getting your information, and not some random third party. Without the "web of trust" that the CA helps create, it is impossible to verify the identity of anyone on the Internet.

    9. Re:Good for them by julesh · · Score: 2, Interesting

      If you, as a small corporation, non-profit or individual, go up in court against a large corporation or an ambulance-chasing shark, your chances or losing are better than not.

      That's not the way it works in the UK. As a director of a small company that has taken a few larger businesses to court, I can tell you that most of the time, the smaller business wins. That's because most of the time, the smaller business is _right_, and that's what the court is interested in.

      I'm convinced that the UK civil court system (which is not entirely a loser-pays system, but similar -- it's a "loser pays winner's reasonable costs if loser's case was unlikely to win from the beginning" system) works, and would suggest to anyone not to knock it unless they've tried it.

  5. great news! by terrymaster69 · · Score: 2, Informative

    There is no reason to pay for certificates - initially the issue was about trust. The infrstructure to set up a cert authority is not complicated, as mentioned...you just need people to trust the certificates that you issue. God (and slashdotters) know the kind of crap that VeriSign has pulled before. It's good to see alternatives.

  6. Where's the government for a change? by Anonymous Coward · · Score: 5, Interesting

    While I normally think the government should keep its nose out of most places, I think this is one place where the goverment could actually do some good. Just like many states and goverments proved offically accepted picture IDs to individuals, I think they could easily set up a service to provide offical digital IDs to all the citizens. Companies like Verisign may still have a role in providing corporate certs, etc, but I think the goverment is the best way to provide a universally recoginized digital ID to everyone.

    1. Re:Where's the government for a change? by njdj · · Score: 2, Insightful
      I think this is one place where the goverment could actually do some good.(...) offically accepted picture IDs to individuals

      There are two problems with this. As another message pointed out, not all governments are equally trustworthy. Would you trust an ID issued by Nigeria? Or would you wonder how easy it is to bribe a Nigerian official to issue one in any name you wanted?

      Now look at it from the viewpoint of a Nigerian citizen. How can he/she get acceptable ID? Clearly, not from the government.

      The second problem is that some people are stateless, i.e. no government acknowledges them as its citizens. There are many countries which do not grant automatic citizenship to persons born there (Germany is one). And there are a few governments which give themselves the right to cancel the citizenship of one of their own citizens.

    2. Re:Where's the government for a change? by Cerebus · · Score: 4, Interesting

      There are privacy problems inherent in X.509 that should make you nervous. There is no way to do an anonymous transaction (say, via cash) secured with an X.509 certificate because your *name*, not the key, is the important part of X.509. That means you must always reveal your name.

      In addition, an X.509 certificate can bind any number of attributes to that name, and it's up to the CA-- not you-- to decide what those are. Once they're in the certificate, *you cannot decide not to provide them*. Kinda takes away your control over your private information.

      Look up the work of Carl Ellison & Ron Rivest and others on X.509 and privacy, particularly in contrast to how SPKI handles things.

      --
      -- Cerebus
    3. Re:Where's the government for a change? by cubic6 · · Score: 3, Insightful

      The whole point of X.509 certificates is that your name is attached. It's meant for verification of identity, not anonymous transactions. If you took away the name component, there would be no security because the other party has no guarentee that you are who you say you are. It'd be like having a driver's license with no name or picture, just a little notice saying that "someone" is licensed to drive. If you need some secure way of making anonymous transactions, I'd imagine a one-way auth system like SSL would work better.

      --
      Karma: Contrapositive
  7. Verisign/Thawte = mafia by mabu · · Score: 5, Interesting

    The whole notion that a Cert authority is needed is essentially bogus in my opinion. We've been rolling our own certs for years for all but the main e-commerce web servers. Who wants to pay the outrageous extortion fees Verisign/Thawte charge and jump through the goofy hoops? I bite my lip and do this every two years for the main web server just so my clients don't totally (unnecessarily) freak out at the prospect of a dialogue box popping up in SSL mode warning them that Microsoft's "paranoia-protection-money" wasn't paid-off.

    The Cert authorities are a joke. We registered one CA with Verisign with virtually no documentation, and another time, when renewing an existing, different cert, they demanded everything short of a blood test for "authentication." It's nothing short of criminal considering they charge $200+ for something that takes 10ms to generate that they make people wait weeks for, and in no way guarantees superior security, and they'll make certs for anyone with money so the identity checking is BS and moot.

    I'm all for a free certifying agency, but you can also roll-your-own with OpenSSL.

    1. Re:Verisign/Thawte = mafia by justMichael · · Score: 4, Insightful

      While I agree with you completely. It all depends on what you are using it for.

      The problem with rolling your own is when a browser hits it, it burps up an error saying it can't verify the validity of the cert. Depending on what you are using the cert for, who cares.

      I have my webmail server forced through https with a self signed cert. If someone that uses my webmail server doesn't like it it's no skin off my butt (I provide free mail to a few friends).

      For any business sites that I setup I suggest InstantSSL, they are cheap, fast and trusted by pretty much any browser around. And that is the important part when selling to the public, that they don't get some warning. Most of them will never even look to see if the page is encrypted but if they get some funky warning odds are they will leave.

    2. Re:Verisign/Thawte = mafia by justMichael · · Score: 2, Informative

      Did I miss something?

      InstantSSL 1 yr $49
      FreeSSL 1 yr $99

      They claim 96% compatibility, InstantSSL claims 99.3% (love those numbers, WTF)

      They do mention the "hassles" of chained certs. I know it was a huge pain to drop one more file on my box, but I don't see it being worth $50 ;)

      If I did miss something, I apologize. Let me know I'll be checking them out again in the morning.

    3. Re:Verisign/Thawte = mafia by schnarff · · Score: 2, Insightful

      Might want to update that potentially useful link to take the typo out of the URL: InstantSSL.

      --
      How To Get Humans To Mars
  8. Note to users (from their website) by kai5263499 · · Score: 3, Informative

    Note: If you plan to use these certificates with Internet Explorer, Outlook, or Outlook Express then generate the certificate from within Internet Explorer. They can't be sucessfully imported into Internet Explorer. Believe us, we've tried...

    --
    -Wes
  9. Maybe. by Saeger · · Score: 2, Insightful
    Could this be the begining of a true 'open' certificate authority?

    Stumbling blocks would be that Verisign would still be the expensive 'gold standard' for quite a while because its always been compatible from the earlydays in the most number of browsers, and another would be getting enough funding to pay for the identity check and other redtape that it takes to really be a 'trusted' cert authority.

    I wonder what the cheaper CA's like thawte and geotrust think...

    --

    --
    Power to the Peaceful
    1. Re:Maybe. by mabu · · Score: 2, Informative

      Stumbling blocks would be that Verisign would still be the expensive 'gold standard' for quite a while because its always been compatible from the earlydays in the most number of browsers,

      Let's qualify this for people who may not understand.

      This new certifying authority will be just as compatible as any other cert. It will still offer as much encryption protection as any cert provided by any authority.

      The difference is that the browser may not be "pre programmed" to recognize the authority, and will therefore pop up a "warning dialogue box" that says something like "Certificate is signed by an unknown authority". In reality the encryption and transaction is just as strong. It's just that the browser company hasn't been paid a fee to keep the dialogue box from popping up and scaring users into thinking that their transactions are not encrypted.

      So basically, those of us who have used CAs from Verisign are paying a fee to keep a dialogue box from popping up scaring our users, making them think their transaction isn't secure, when it is.

      There is this notion that companies like Verisign/Thawte are charging their outrageous fees for an intangible piece of digital information because they "verify" that the name on the certificate matches name of the web site you're dealing with. Most users wouldn't be conducting e-commerce or secure transactions with a web site unless they were fairly confident who they were dealing with in the first place, so the notion that a cert offers additional security is pretty superfluous.

    2. Re:Maybe. by nachoboy · · Score: 4, Informative

      Verisign acquired Thawte in late 1999. Though they acknowledge the fact on their corporate website, they don't exactly make it obvious they no longer compete with Verisign.

  10. That slashdotting didn't take long by Bodhammer · · Score: 4, Interesting

    Somehow I don't feel all that secure when the site went down in 3 minutes...

    --
    "I say we take off, nuke the site from orbit. It's the only way to be sure."
    1. Re:That slashdotting didn't take long by damiangerous · · Score: 2, Informative

      It's not down. They made a small change to protect themselves most likely. You'll have to manually alter links, but you can browse the site fine.

  11. The more non IE browsers have the better by dj42 · · Score: 4, Interesting

    I think the key to disrupting IE is by creating things it doesn't or won't support. It can't be done quickly, I don't think, but slowly, as the browsers merge in their usefull and techs that disdain MS help ignorant users to install and use them, MS can be made an equal player. Instead of a dominate force that will eventually control the US Media by holding the power of the infrastructure.

    --
    We are one consciousness experiencing itself subjectively. Back to you with the weather, Bob!
  12. Finally! :-) by hackel · · Score: 3, Insightful

    This is one of those things we all say to ourselves "they should do this," yet it never happens. I'm really glad to see this. I can't wait until I can start recommending clients to them and supporting them with large (yet still much cheaper than Verisign/Thawte!) donations. :)

  13. Invalid XHTMl, Invalid CSS, Default Index by NigritudeUltramarine · · Score: 4, Interesting

    Does anyone else find it somewhat offputting that they include links to both validate their XHTML and validate their CSS on the bottom of their homepage, yet both return a number of errors stating that their page is neither valid XHTML nor uses valid CSS?

    Even more oddly, for a brief instant when I went to their homepage, I got a default Apache index listing, rather than their homepage. It included links to things such as their PHP MyAdmin directory, a number of PHP files, and three zipfiles named Bruce-someversionnumbers.zip.

    1. Re:Invalid XHTMl, Invalid CSS, Default Index by Anonymous Coward · · Score: 2, Funny

      When they say they're open... they really mean they're open.

  14. Cry cry cry, certs aren't free. by t0qer · · Score: 4, Insightful

    I don't see what everyone is crying about certs costing money for. Seeing as how i've setup online shops for several people using certs, I think for what they do, the cost is justified.

    Not just anyone can get a CA cert. You have to be a business, I know verisign wants a copy of your business license, ect before they even issue you a cert.

    Now we got this "open CA". Who is going to check if these are legitimate businesses? Will there be any checks done at all, or will it just be "by the truckload" as the headline said?

    I'm all for saving a buck as much as the next guy, but when I shop online, knowing that the cert came from a trusted source that actually checks if it's issuing a cert to a legitimate business like verisign or thawte puts my mind, as well as the minds of a lot of others.

    1. Re:Cry cry cry, certs aren't free. by mabu · · Score: 4, Interesting

      Not just anyone can get a CA cert. You have to be a business, I know verisign wants a copy of your business license, ect before they even issue you a cert.

      It's not a big deal. It doesn't mean anything. It doesn't offer more security ultimately.

      The majority of e-commerce sites on the Internet are NOT operating under their own certs. Many sites that offer hosted shopping carts use a central SSL server operating under an umbrella cert. Nobody really seems to have noticed, so what Verisign/Thawte are selling is not something consumers really seem to care about.

    2. Re:Cry cry cry, certs aren't free. by coene · · Score: 2, Interesting

      When you need to verify the absolute identity of someone you're dealing with, these companies, with their background checks (which aren't strong by any stretch of the imagination), certs by Verisign/etc may make sense.

      However, the most common usage of SSL cert's is simply to enable encryption between two points. For this, there's nothing wrong with even a home-brew cert - validation of the cert via it matching the domain should be sufficient. A SSL cert generated by a 3rd party adds absolutely nothing to security, and it shouldn't do anything to reassure the customer/client that they're dealing with a legitimate operation.

      Encryption between a website and their visitor shouldn't cost anything, and having companies issuing these certificates will (er, has) lent itself to corruption.

      If we're going to have 3rd party CA's, it should be done by the government. These companies (i.e. Verisign) shouldn't have the right to monopolize this technology, which has become an absolute necessity for online commerce.

    3. Re:Cry cry cry, certs aren't free. by Leebert · · Score: 5, Interesting

      However, the most common usage of SSL cert's is simply to enable encryption between two points. For this, there's nothing wrong with even a home-brew cert - validation of the cert via it matching the domain should be sufficient. A SSL cert generated by a 3rd party adds absolutely nothing to security, and it shouldn't do anything to reassure the customer/client that they're dealing with a legitimate operation.

      It prevents man-in-the-middle attacks. That's the most important reason for me to use a trusted CA.

    4. Re:Cry cry cry, certs aren't free. by mabu · · Score: 4, Insightful

      hmmm depends. personally i usually wouldn't be handing my cc number to a company that won't pay for it's own cert and is using a shared hosting one, unless i already knew they were ok beforehand.

      First and foremost, the Fair Credit Billing Act of 1976 protects consumers against most credit card fraud, so the whole notion of fraud being a major issue is essentially blown out of preportion. If someone charges something to your credit card, you charge it back and the burden is on the merchant to prove the legitimacy of the transaction or they lose, so there's never been much of a threat for consumers anyway.

      Second, the way things have been going, customers are likely to get better products and services from smaller companies, many of whom may not be that technically inclined but instead tend to spend their energy on providing their core products and services and not running their own web servers.

      Our ISP handles more than US$5M/month in online transactions for many companies much larger than ourselves, and we operate most sites under our umbrella SSL Cert. Never had any complaints.

      The issue is not unlike Paypal. People accept Paypal on their web sites. When you go to complete the transaction, you're switched to Paypal's servers - there's no easy way around that. Consumers are used to this and companies like mine go out of our way to establish our reputation as a trusted provider of solid, secure e-commerce. Clients that use our services benefit from our reputation and performance. Everything works fine.

    5. Re:Cry cry cry, certs aren't free. by julesh · · Score: 2, Insightful

      It prevents man-in-the-middle attacks. That's the most important reason for me to use a trusted CA.

      A self-signed cert can prevent man-in-the-middle attacks if you have a copy of the cert downloaded.

      Most CAs these days only verify that an e-mail they send to the domain in question is received by the applicant, the same as this lot. I got one from Equifax on this basis, and they're trusted by default in both IE and Mozilla.

  15. Question by mzkhadir · · Score: 2, Interesting

    So, you install the master cert from their website and visit an anonymous website, when the anonymous website pops up a cert. Will it display on my screen to install or will it be automatically installed because I have installed and trusted the master/root cert.

    1. Re:Question by stoborrobots · · Score: 2, Informative

      There is no installation for the other certs... Once the master is trusted, then as long as there is a chain of trust down to the "anonymous website". The website provides the certificate to the browser, the browser checks the issuer, and as long as the issuer is trusted, the browser accepts the certificate. No display to screen, no installation, nothing...

      --
      "Go to CNN [for a] spell-checked, fact-checked summary" -- CmdrTaco
  16. So what? by Anonymous Coward · · Score: 2, Interesting

    So you can get a free cert. I can generate my own damned certs already. However, if I have a cert that I've paid for, then usually people will trust that, because the cert authority has taken steps to verify that I am who I say I am.

    It's that last thing that makes certs valuable, not the cert itself. A free cert is free because not many people are going to trust it, and with good cause.

  17. What about the government? by BrynM · · Score: 2, Interesting

    I think the government should sponsor a CA. Sure, their databases are screwy every so often and are the very model of bureaucracy. They are also one of the most "trusted" authorities to most of the neophite users a warning would scare. Besides, they couple probably keep up with Verisign's often weeks long turn around on certificates pretty well. There's some economy and small business stimulation! Unfortunately, maybe some fraud too, but it may also lead to hucksters getting stiffer punishments and/or penalties.

    --
    US Democracy:The best person for the job (among These pre-selected choices...)
  18. Re:About time... by torinth · · Score: 4, Insightful

    No infrastructure? No talking to servers? Que?

    Without CA's and revocation information, SSL-style (RSA) public key infrastructures are useless. That means every client needs access to recently updated and TRUSTED revocation lists to make sure that no cert's have been forged or stolen. Every meaningful SSL client should periodically verify that any server certificates it uses are and remain valid. Using the CA's public key is absolutely NOT sufficient.

  19. Re:About time... by asdfghjklqwertyuiop · · Score: 4, Insightful

    The servage is cheap since it doesn't even involve talking to their servers, just checking acceptance via a signing key... ANYONE can do that..! NO infrastructure!


    I think you're forgetting the part about actually verifying the authenticity of what they're signing.

    IE, If I send them a certificate signing request with my public key and a name of George W Bush on the CSR, are they just gonna go ahead and sign it and give me a certificate stating that I'm George W Bush?

    Certficate authorities usually require you to provide them with proof of your identity, like faxing you a driver's license, birth certificate, buisness license, trying to contact you at the stated address and phone number, etc... if they didn't do this, they wouldn't be very useful CAs... the certificates they issue would be meaningless.

    Of course, this is not to say that the expensive commercial CAs are trustworthy simply because they charge money... not at all. But to be an useful CA you need to have the manpower to verify the stuff people ask you to sign. I wonder how this free CA will accomplish that.
  20. Alternatively... by temojen · · Score: 4, Informative

    Here's a summary of a proposal I wrote for canadian provinces...

    The Governor General's office acts as the root CA for Government Ministries & Crown Corporations and Professional Associations.

    Any professional association (Bar Association, College of Physicians & Surgeons, Engineers, etc) acts as a CA for it's members and corporations working in their field (Law firms (lawyers, paralegals, legal secretaries), Medical Clinics (Doctors, Nurses, X-Ray Techs, Appointment Clerks), etc)

    Certified Accountants act as a CA for Corporations, Societies, Partnerships, etc.

    The Notaries public act as a CA for individuals.

  21. Denmark has this... by Jezral · · Score: 5, Informative

    Denmark has free digital signatures for all citizen, for use in email, to sign in on sites, etc...

    URLs:
    - http://www.digitalsignatur.dk/
    - http://privat.tdc.dk/digital/
    (both in Danish, though...)

    The technicalities are run by the largest phone company/ISP, TDC, but otherwise it's fully a government thing.

  22. Re:About time... by mindmaster064 · · Score: 5, Insightful

    Exactly how many certificates have you seen revoked? And how many of these revocation lists are going around? I agree that the implementation of the certs is screwy, since basically it means nothing at this point other than the fact that you are communicating over SSL. Basically from a browser standpoint the implementation of certificates is completely worthless since the authentication checking is just not there. The X.509 cert's were originally designed to completely authenticate that you are talking to the host/person you intended to. Since browsers currently do absolutely nothing but a check vs. the public CA key basically any cert the CA issued regardless of status (other that those that have expired with time) are complete valid certs. They could have been forged, stolen, or otherwise abused but we trust them anyway... Really a sad state of things.... X.509 revocations do exist, but since there really is no universal Public Key Infrastructure (for the non-security guru), or rather the browsers don't even TRY or HAVE A WAY to validate them in most cases they really don't mean much at all...

    -Mind

  23. Re:Australia sucks by mabu · · Score: 3, Funny

    Lucky for you America hasn't banned stupidity and ignorance.

  24. is it something different than wildid? by econfuzed · · Score: 4, Interesting

    Just a question, how much this is different than www.wildid.com

    1. Re:is it something different than wildid? by julesh · · Score: 2, Informative

      It seems wildid issues only S/MIME e-mail certificates. This company also offers SSL (https) secure server certificates, which is much more useful. They also seem to be significantly better at what they do. I wouldn't trust a certificate issuer who has an expired certificate on their own secure server. What's their excuse for having an expired self-signed cert???

  25. Re:Australia sucks by dbIII · · Score: 2, Informative
    It's what America would be without the bill of rights
    In Australia, If we lock up an American no matter what we think they might have done we let them see a lawyer in less than two years. The USA is starting to become an America without the bill of rights. However, in Australia, 911 is being mentioned when talking about stricter control of wild parties (how's that for trivialising the dead - some people in power are just self serving idiots) - so maybe the sword ban thing is true in another part of the country as another mindless backlash.
  26. Re:About time... by mindmaster064 · · Score: 3, Interesting

    They require paper proof which doesn't mean that the digital property hasn't been misappropriated from its true owner. As it stands now if someone stole your server key and you wanted to use it on their own box they can, and you cannot revoke it and have your CA reissue your cert the way it should work. Sure, the user of that site gets a browser message but big whoop... people are used to pop ups and just click shit away that they don't care to see.

    This physical paper trail does nothing to increase the security of the browser, it only works to increase the security of the information the CA has. Someone can forge documents and open up a site in your name and since you cannot "revoke" a cert there is no way for you to shut them down once the process is completed. All it takes it a little bit of letterhead, a borrowed ID, and some other (possibly faked) documentation. The last time I got a cert I lied about 90% of the information.. I think the only thing that was true was the phone number. Let's fact it... The CA has no authority to shut down your key once it is issued (since there is no revocation mechanism) and once you get past the screen it is game over. That basically means these certificates are worthless for identifying people since a particular cert doesn't identify a particular host or person since they are never EVER revoked... These companies are primarily concerned with making money rememeber.... Too much scrutiny is an empty wallet... It is not in their interest to turn you away... (you are a guarranteed $200 every 1-2 years, after all)

    If there was a good PKI that all the web browsers in the world could plug into this wouldn't be a problem at all. But these browser guys are competing and patenting, and I doubt it will ever happen.

    - Mind

  27. Re:About time... by SpecBear · · Score: 3, Informative

    SSL certificates assure two things:

    1) You communications are encrypted and can't be interecepted in transit. These days this is a trivial thing and can easily be provided with a self-signed cert.
    2) The identity of the site owner has been verified. The trusted certificate authority has taken some measures to assure that the site has been authorized by the entity named in the certificate. This is not trivial.

    Without #2, it's not too hard to set up a fake site and hijack someone's traffic. You can then collect usernames and passwords, or distribute false information. Imagine if someone uses a BIND exploit to take over your ISP's DNS servers and reroutes yourbank.com to a fake site. When you pay for a certificate from a trusted CA, you're paying for #2. If you don't care about #2 for your purposes, then you can act as your own certificate authority.

  28. Caveat: what does it cost to be "trusted?" by humankind · · Score: 3, Insightful

    My question is, since (currently) IE is the dominant browser, the value of this service is going to depend upon whether or not this new CA can be designated as "trusted" by Microsoft.

    We know this ultimately comes down to how much Microsoft would charge for this certification. Does anyone have any idea what the costs are? I imagine it would be some sort of subscription arrangement where you have to pay in perpetuity to Microsoft in order to not have your trusted status revoked. But how much? And would Microsoft let an open CA even exist in the first place?

    1. Re:Caveat: what does it cost to be "trusted?" by x509v3 · · Score: 2, Informative

      As someone who HAS gone through both of these processes (WebTrust, Microsoft), let me shed some truth on some of the speculations here.

      1) Microsoft doesn't charge anything to be "trusted"; they've primarily let the AICPA manage that through their "WebTrust for Certification Authorities" do that. (Microsoft will also allow the requestor to use another audit, but it's up to the CA to determine equivalency to WebTrust's audit.

      Microsoft posts their requirements to get included in their Trusted Root List here: microsoft.com

      Once you get a WebTrust audit seal and can prove to Microsoft that your CA will issue certs to something OTHER than your enterprise, you should be fine.

      The WebTrust CA criteria was designed to help CAs follow a set of standardized evaluation criteria. Like an RFC tries to enforce that protocols are standard. The WebTrust criteria is available for free at the AICPA website (AICPA). There are almost 400 criteria that a WebTrust auditor will use to evaluate your CA (not just the "host" but all your CA company's policies, practices, and processes).

      To the person who said that you could just "hire a bunch of lawyers" for $250,000 and pass, I say "I highly doubt that". The WebTrust audit requires their auditors to actually see and verify the CA complies with the requirements. A box of lawyers can't create CA issuance log files, show how you maintain your HSM, or prove that you keep your /etc/password file clean of employees who have left your company since the last audit.

      2) Once CAcert gets a WebTrust Seal, then they can fill out the application at Microsoft's site. If they're accepted, they get into the next quarterly Root List update issued by Microsoft (next update: this month).

      After they're "in the list", WinXP machines will automatically download the new root cert whenever IE/Outlook performs a certificate path validation operation and sees the CACert root. It's automagic. Older Windows OSes will need to get the new root list from the WindowsUpdate site.

  29. You know us Aussies by mister_tim · · Score: 2, Funny

    This coming from an Australian company? Hardly suprising: us Aussies are always happy to get something for nothing. Getting away with it is always a boasting point and something akin to a national sport/pastime.

  30. Re:Australia sucks by mister_tim · · Score: 2, Informative

    Yeah, but aside from the snakes, spiders, sharks, box jellyfish, blue ringed octopus, crocodiles (they're only up north so you don't need to worry about them too much - but snakes and spiders are everywhere), etc. Aside from all those things, or in spite of all those things, Australia is the best place on earth. Don't believe me? Check the guide:
    http://www.bbc.co.uk/dna/h2g2/A53650

    And don't panic!

  31. Most commercial certs are worthless by Animats · · Score: 4, Informative
    Most certificates certify nothing. The issuer guarantees nothing, and the "relying party agreement", if you can find it, promises very little, if anything.

    For example, see the TrueSite Relying Party Agreement. "The Service is provided on an as-is basis without warranties of any kind".

    Even Verisign's Relying Party Agreement, while it does offer some warranties, has a complicated scheme for weaseling out of Verisign's obligation to verify the certificate holder's identity. The relying party agreement refers you to the CPS Section 11, says "Issuing authorities (and VeriSign, to the extent specified in the referenced CPS sections) warrant and promise to ... perform the application validation procedures for the indicated class of certificate as set forth in CPS Section 5, Validation of Certificate Applications." There, Verisign says "The IA shall confirm that ... the information to be listed in the certificate is accurate, except for nonverified subscriber information (NSI)." The linked definition of "nonverified subscriber information" is "Information supplied to a certification authority as part of a certificate application". So Verisign doesn't actually stand behind any of the information in their certificates.

    This is much weaker than a signature guarantee by a commercial bank, where the bank guarantees to other parties that the person was properly identified. But it costs more.

    I'd like to see banks belonging to Visa International and MasterCard issue digital certificates, and require that their certificates had to be on a page that accepted their credit cards. Certificates from banks would actually be worth something.

  32. CAcert vs. Self-Signed Cert by JWSmythe · · Score: 2, Interesting


    I don't see the big difference between a self-signed cert and a CAcert. It's going to be virtually impossible for web sites to get their users to install their root certificate. Users are stupid. Generally, I don't expect they can click a link, much less add a cert.

    I've been looking into using SSL on http://freeinternetpress.com . We're not a registerd company, nor do we turn a profit, so it would be an extra cost and hassle to get a real certificate. For us, the only reason to do it is to make some of our users happy by letting them browse by https.

    A self-signed cert isn't any sort of magic, the instructions are in the OpenSSL documentation. I made it a step easier for people we worth with, I have a web page that they submit their information to, and it generates everything including the self-signed cert. There's no real magic to it, anyone (err, anyone with a clue) should be able to write the same thing in about 10 minutes. I spent an extra 10 minutes making it pretty.

    People I deal with never use the self-signed cert. They just take the CSR and get the cert signed by a regular signing authority. What's the big difference if I sign it, or if I call myself "Joe's cert company" and start automatically signing certs? It's not much different than what CAcert is doing, other than the fact that they have a donation button on their page. At least with the people I make CSR's and self-signed certs for, I know who they are, and that I'm not accidently signing a fake microsoft.com cert.

    --
    Serious? Seriousness is well above my pay grade.
  33. Re:About time... by DrXym · · Score: 3, Insightful
    I think you're forgetting the part about actually verifying the authenticity of what they're signing.

    The thing is, a email / personal cert from Verisign etc. comes with no guarantees that the signer is actually who they say they are. You could impersonate someone quite easily just by typing in bogus details.

    Verisign doesn't audit you or vouch for you, so the cert is essentially worthless. It's a few bits that say Verisign touched it but that's about all you get for your ten dollars or whatever it is these days. If you want Verisign to actually vouch for you, you're looking at paying hundreds or thousands for a cert.

    And after a 6 months, a year or two the cert expires and you have to start the process all over again.

    A free CA is a good thing, but again it says nothing about the authenticity of the site / person who obtained it. I think that in itself would be an extremely valid reason for Microsoft to refuse to acknowledge them for anything but email. i.e. recognize the cert for email addresses, but not for SSL or signed executables.

    On the small scale, PGP is a much better model. Anyone can make a key and start passing it around. You can get other people to sign the key if you want, but it's perfectly usable for crypto from the get go. Not only usable but faster too - as anyone who's tried to encrypt something large with RSA already knows. In fact extensions such as Enigmail for Mozilla are arguably easier to use than the built-in S/MIME.

    On the signing front, I really wish Mozilla / Firefox would use PGP certs too to sign their XPI files. At present no one signs XPI files (reason: they're too expensive). If an XPI file were signed with a PGP key, you could drill down through the signers and reasonablly gauge the trustworthiness of the author. Hell, PGP doesn't even preclude CAs from doing business since they can sign keys just as well as the next person and charge for it.

  34. We want to believe in CACert... but ... by njdj · · Score: 4, Insightful
    When I saw this news, my reaction was that it's great and I want to support it. Verisign et al have been too greedy for too long.

    But we have to be careful that we don't let our "wish to believe" blind us to the need for some caution here. Take at look at CACert's site. You'll find carelessness, spelling mistakes, pieces that have not been thought out. Running a CA properly requires meticulous attention to detail, and their site shows the opposite. On the very first page when you sign up, it asks for your name, date of birth, and "country". Is that country of citizenship, or country of residence?

    Then there's the reliance on "government ID". If somebody presents Nigerian ID, or Dominican Republic ID, what exactly is that worth? It's not worth anything, you can bribe officials in those countries (and many others) to issue whatever official document you want. Does that mean that citizens of Nigeria can never be trusted? That's well over 100 million people in just that one country, most of whom are honest and trustworthy. It's ridiculous to exclude so many people from receiving certificates just because their bureaucrats are corrupt, and it's completely contrary to the transnational spirit of the Internet.

    In conclusion, the idea behind CACert is a good one, but the people running it don't seem to be doing a good job. I hope that somebody else takes up the idea and does it better. There is no reason why there should not be more than one volunteer-based CA.

    1. Re:We want to believe in CACert... but ... by UABHPstudent2069 · · Score: 2, Interesting

      I have to agree, the website was designed badly. However, I'm sure that with increased interest and support, the website can and will be improved.

      I have been a CAcert user since last November and an Assurer since March. I know the Marketing/PR director for CAcert has just had published an article about CAcert (once in an Aussie-Linux-type journal and, more recently, in ;Login: , the official magazine of USENIX, I believe). The article addresses several issues concerning the actual security, benefit, etc. of having a free certification authority. While I'm not sure when/where/if his article will be available in the states, I do know that the article has but to rest many fears about CAcert and (from what he tells me) has even converted some people over to the CAcert philosophy... Privacy is a Right!

    2. Re:We want to believe in CACert... but ... by Vellmont · · Score: 2, Insightful


      Take at look at CACert's site. You'll find carelessness, spelling mistakes, pieces that have not been thought out.
      Yah, it's not a very professional looking site. That's just how it works when you have a limited budget. I think your expectations and standards are a bit to high for an organization that just started. If they still have the same problems in 6 months, I'd be a little worried.

      It's ridiculous to exclude so many people from receiving certificates just because their bureaucrats are corrupt, and it's completely contrary to the transnational spirit of the Internet.
      Whoa.. hold on their chief. Who ever said there would be one policy for identify verification for EVERYONE? If you live in a kleptocracy, gov. issued ID could be considered a joke and there would be other means to verify yourself. I'm sure (or at least I hope) that Verisign and Thawte have tackled this problem, there's no reason that CAcert can't do the same thing.

      --
      AccountKiller
    3. Re:We want to believe in CACert... but ... by wabewalker · · Score: 2, Insightful

      I poked around on their site looking for a CP/CPS (Certificate Policy and Certification Practices Statement) but didn't find one.

      So why should I trust them? How is the root key protected? How is it backed up? How is the CA audited? Who audits it? What are auditor's qualifications? Which information is logged? How long are the logs kept? Under which legal framework do they run the CA, under Australian?

      To evaluate the trust I need something structured according to RFC2527 (or RFC3647). (There is so much information they have to provide that it has to be structured or relying parties cannot find the bits they need).

      People often forget that there is a lot more to running a CA than issuing certificates. Anyone can run a simple CA with OpenSSL, but such a CA is nothing without a trustworthy CP/CPS. And an audit trail that ensures they stick to their CPS.

      --
      --- Premature complacency is the evil of all roots
  35. There are two kinds of certs... by Kjella · · Score: 3, Insightful

    ...those that produce a warning in browsers, and those that don't. Most everything else, is all the same to 99,99% of the people.

    Kjella

    --
    Live today, because you never know what tomorrow brings
  36. Re:About time... by wfberg · · Score: 2, Informative

    X.509 revocations do exist, but since there really is no universal Public Key Infrastructure (for the non-security guru), or rather the browsers don't even TRY or HAVE A WAY to validate them in most cases they really don't mean much at all...

    Both IE and moz can use OCSP (Online Certificate Status Protocol) - if the cert containes OCSP information (basically a URL where you can check whether the cert is revoked) the browser can check against that. Fully up-to-date windows systems actually do this by default, it's in the crypto libraries. Which caused some problems for Norton Antivirus earlier this year when their cert expired, their OCSP server wouldn't hand out an updated cert, and their liveupdate application silently(!) failed.

    Why they were even using a public CA's cert, when there's no way for the end user to look at is, is another matter..

    --
    SCO employee? Check out the bounty
  37. Root certificate for Redhat, Opera, Mozilla by stray · · Score: 5, Informative
    In the June edition of ;login: (the Usenix Association's magazine), there is an article by Adam Butler (of CAcert) describing the project and shedding some light on the process of getting a CA root certificate included into various browsers:

    Quote from the article:

    "In true Microsoft style, Redmond adopted a new metric for determining whether a CA's root certificate is to be included with its browser/OS/kitchen-sink product: In order for a CA's root certificate to be accepted - I swear I'm not making this up - Redmond said CA must pay a WebTrust-licensed member of the American Institute of Certified Public Accountants up to $250,000 for an initial evaluation/inspection, plus additional tens of thousands of dollars in fees on a periodic "follow-up" basis.

    The makers of the Opera Web browser did not respond to email queries regarding their inclusion policies/requirements; however, a Bermuda-based CA representative stated in the netscape.public.mozilla.crypto newsgroup that "as of [his] last contact in 2003, Opera wanted cash to add a CA [root certificate]. They did not appear to have a standards policy.".


    He goes on to describe the process of getting the root cert, hopefully, included into the Mozilla project through a Bugzilla feature enhancement request. From what I read from the article, the discussion about this is still going on.

  38. X.509 is the wrong technology. by Cerebus · · Score: 4, Interesting

    X.509 binds names to keys; it's the name that matters in an X.509 system. But because there aren't enough bits in the human-language name to uniquely identify every entity of interest in the network, X.509 is based on X.500 naming, which mates the human-language name (common name, or CN) with that name's position in the global directory. Together they form the distinguished name, or DN.

    X.500 naming, however, presumes a single, global namespace. The X.500 directory was intended to be a single directory for the entire planet providing unique, inescapable names for everyone.

    Yeah, right. Like that's going to happen.

    As a result, X.509 is carved into literally hundreds of local namespaces. But since we're stuck with the *name* as the principal, we have to use that X.509 name *globally*. There are multiple ugly kludges to get around the name problems as a result.

    This makes X.509 complex, fragile, and difficult to deploy correctly.

    But everyone (potentially) has a globally unique identifier-- the public part of an RSA key. Randomly generated, 2^42 512-bit RSA keys have a probability of colliding on the order of 2^(-429); even the SHA-1 hashes have a collision chance of 2^(-77). Keep in mind that we use 1024-bits as the default nowadays.

    So if you use the public key as a name, it solves a whole raft of problems.

    This is what SPKI/SDSI does. SPKI is key-centric; names are a local convenience; keys are bound to names instead of the other way around, and all names are local to that key. Every participant has a key pair. The public part is the identifier for the keyholder, and the keyholder authenticates himself simply by proving that he has the private part.

    Keep in mind that the whole issue of binding keys to actual people can't be addressed by a PKI, it has to be addressed by strong key storage and access controls and is the same across for X.509 and PGP/GPG as it is for SPKI.

    This is similar to the web of trust, but I don't need introducers (well-connected keys) to make it work right.

    SPKI goes on to recognize that since authentication is simple, what we really need from SPKI is authorization. The whole of SPKI is intended to define a flexible method of allowing authorization *and authorization delegation* in a simple, distributed fashion. SPKI defines an authorization *language* so that authorizations can be chained *without the SPKI library knowing what the tokens actually mean*. This means that a single library can handle the permission sets of all applications. In addition, the language rules prevent all entities in the chain of delegations from being able to exceed the permissions he was granted.

    Achieving the same under X.509 (using attribute certificates, for example) is next to impossible. ACs don't delegate (well, the standard itself says technically you can but you *shouldn't*); aren't truly distributed (i.e., the AC acts as a single choke point in granting permissions, which SPKI avoids), and doesn't model the way trust naturally flows in an organization of people (whereas SPKI allows you to source and pass around trusts in more natural ways).

    Very cool stuff. SPKI shows up in all kinds of places. Carl Ellison's homepage provides the best jumping-off point if you want to learn more:

    http://world.std.com/~cme/html/spki.html

    --
    -- Cerebus
  39. Re:About time... by shokk · · Score: 2, Insightful

    Some time this past year, Sun revoked their cert they use for the PatchPro automated patch system. I use the system so infrequently (as opposed to the monthly use of Microsoft's SUS) that when it was revoked I had to look up how to get the new cert onto all the Sun systems (update the SUNWcert package).

    --
    "Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
  40. Re:About time... by shokk · · Score: 3, Interesting

    How is this different from the Web of Trust free cert service that Thawte provides? Same notarization scheme.

    --
    "Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
  41. Why not Mozilla.org? by Can · · Score: 2, Interesting

    I'e often wondered why mozilla.org doesn't start their own CA. Sell certs for a reasonable price like $50, and people would probably happily pay that price to know that they are also support browser development. Plus, mozilla.org can be sure that their CA will be included in at least one browser... :-)

  42. Re:MAJOR OBJECTION by ankhank · · Score: 2, Informative

    Hmm, I'm a notary in California, and the standard notary journal here, at least, have a place in which your identification is recorded (and if it's a real estate transaction, your thumbprint is mandatory now). The notary organizations have manuals dedicated to helping notaries around the country recognize real and forged state driver's licenses and other official identification that contains both a picture, a physical description and a signature.

    If a notary knows you personally, the notary can in most situations simply note that you were personally recognized in the journal.

    I used my ham radio call sign for the 'national ID' -- seemed an ideal choice for this situation.