Slashdot Mirror
Thawte Will End "Web of Trust" On November 16
An anonymous reader writes "Thawte is ending their Web of Trust, including their free Personal Email Certificates, in less than 2 weeks' time. This hasn't been picked up by the media yet. Seems to me a lot of people, including myself, are hurt by this." Thawte is offering a 1-year free VeriSign cert to those holding valid Personal Email Certificates; after that you pay.
I knew I should not have trusted them and their web!
Ask Slashdot: Where bad ideas meet poor googling skills.
This saddens me but I understand it. Adoption of PKI for email in this multi-standard, multi-client fashion was just too difficult for the average email user. Yes, I usually have one or two accounts for secure messaging and I do use Thawte (I am a Notary) but it just doesn't work for most unless there is someone to walk them through. As much as I am aggravated by Lotus Notes, they self contained system (part of my aggravation) was able to pull this off 10 years ago and is still really the only app that I have seen do PKI well. Unfortunately it doesn't do a lot of other things very well.
Magic Eight Ball: Outlook not so good., Hmmm, how about Excel and Word?
Can some other trusted company, like Google, step in?
In theory there is no difference between theory and practice. In practice there is. - Yogi Berra
I did not get any email from Thawte about this issue. How do I get my token then?
I gave up with the idea of an useful sig...
Don't forget where the "web of trust" came from.
Thawte had been hurt so many times and it's going to take a long time before Thawte can learn to trust again.
What were you thinking?
If you really want to do something worthwhile campaign the browser makers to change their browsers. The whole "encryption = authentication" idea is stupid and wrong. The scary warnings when someone wants to encrypt the traffic between you and their website using their own certificate is commercialism at it's worst.
-- Programming with boost is like building a house with lego. It's a cool but I wouldn't want to live in it
of personal digital certificates on the Linux desktop, over IPv6.
I was a member of the WoT back in '99. It took several weeks (nearly a month) to find accessible notaries, and their method of meeting was suspect to say the least. For one I had to travel 30 miles to another town and meet in a supermarket car park. After I got my cert. no-one I sent signed messages to knew how to handle it - encryption was pointless. I let it lapse after about a year, and haven't bothered since.
Unfortunately, unless the govt. mandates personal electronic signatures, it ain't going to happen. And no-one will want to use it under govt. mandate anyway. This stuff is geek only territory.
I never thawte this would happen.
I have seen many Java signed opensource/freeware coming with that Thawte free mail certificate. I hope they won't be effected with it and if brain dead Sun offers some kind of special treatment to those, it won't be any matter.
Of course, it is Sun we talk about and even Oracle couldn't still change anything.
90% of reason Thawte brand was known among professional users was "Thawte free certificate" which was supported perfectly by mail clients. Thawte has no clue what kind of harm they did to brand value/recognition to save couple of CPU cycles and couple of gigabytes.
People thinking GNU PG or free PGP will be implemented by those: No, they will simply move to another way of pkcs signing their mails or buy commercial PGP.
...they would first have to start one. Since Thawte is part of Verisign and Verisign is not worthy of trust...
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Any reason not to use Comodo's equivalent?
One thing that a lot of people are ignoring is that Thawte FreeMail certs are used by a lot of small developers to publish Java apps, and this would kill off that ability quite quickly.
That said, I have not seen a word of this on the Thawte web site, which makes me wonder if the submitter is trying to perform a DoS on Thawte for some reason, and are tricking the slashdotters into being that DoS. The page linked takes an enormous amount of time to decide that there is nothing to return, meanwhile slashdotters are beating on the server over and over. Sorry for the OP, though. The rest of their site still seems to be just fine.
That's the second source that's telling me the Free e-mail certs/WOT program is coming to an end..
However, looking at http://www.thawte.com/ doesn't reveal anything as such..
But I can't say I'm *that* surprised..
--Ivan
Because this is not make for good news. The majority of webans don't use certs. Also things are heading in the other direction ... for example I can log into facebook and see who just took a shit, who's dog pissed on the rug, etc. They install apps with access to all there personal data. People give up privacy and security every 10 seconds for a free hand job it seems. I could get 99% of webans to send me something secure over plain open email and they would do it without question.
Since people are quite adamant about adding each other as 'friends' on social networking sites like Facebook etc., why can't something like the Web-of-Trust be riding along somehow? Or at minimum a GPG key exchange requiring no further steps? There's gotta be a way! Firefox/Thunderbird Plugin that has access to all keys of your 'friends' and uses them automatically? Something like that.
Thawte's FAQ on the matter:
https://search.thawte.com/support/ssl-digital-certificates/index?page=content&id=SO12658
This is the perfect realm for someone like Google to change the space...
As of now PKI for email is just too much work for a normal user, and single emails, or single users, using encryption stand out as people to monitor, anomalous activity.
Someone like Google could add a checkbox in their Labs features that automatically encrypts email between users who have the feature enabled on their system, and publicizes the spec so others can implement on the server side. It doesn't address the authentication side of the equation, but at least could raise the traffic level of encrypted email enough to make purposely encrypted emails noise instead of signal.
Authentication can still be handled by other means, including SSI and self-signed keys.
Submitter might want to recheck their calendar. They must have gotten some weird looks when they were trick-or-treating this weekend.
That Verisign acquired Thawte 10 years ago in a deal that made Mark Shuttleworth a brazillionaire capable of sustaining a swell OSS project. Are they then just shuffling people from a free product to a for-pay model, or is there a significant advantage to the Verisign product? It seems they are replacing a whole community of users and trust with email certs that offer none of that extended web of trust.
I like music
Do we have any options now? Do I need to self generate cert's and email them to people I wish to send encrypted email to?
Putting up scary warnings when all that is required is an encrypted connection is silly.
Without some sort of authentication, you don't know that a man in the middle isn't proxying and decrypting your encrypted connection. These man in the middle attacks are happening. Self-signed certs are good for verifying that the proxy hasn't been added between connections, but that doesn't help if you've got a proxy and have always had it.
You know, the one where November 16 is two weeks after October 6th.
What if I do the same thing, and I do get different results?
The last official email I've recieved from Thwate was a year ago when my certs expired. As to whether this is actually happening, I simply have to say it's a bogus message put out by someone who's got an axe to grind with Thwate. As to Verisign purchasing thwate 10 years ago, I wasn't aware of that as there was and is no information about such a purchase on their website, which is a critical piece of information that must be provided (of course I've not looked at their SEC filings to okay/deny).
Mod me up/Mod me down: I wont frown as I've no crown
It seems the post has been removed at the moment... Was it a fake one?
I now get:
Article is unavailable or has been removed, please try a new search.
The article was not found, or is no longer available. Please try a new search..
I gave up with the idea of an useful sig...
$20/yr is not an onerous fee, big deal. I'm surprised it's gone free this long. If you really can't stand to pay for the service you're using, go to cacert.org.
Does this strategy sound familiar? It should... it's the same business strategy practiced by drug pushers: get 'em dependent and addicted, and then start demanding money. Make 'em an offer they can't refuse.
So is Thawte run by former drug pushers?
(Yes, I know the same question could be asked of Comcast and thousands of other companies. I'm singling Thawte out because of that word "trust" being involved here.)
Maybe now that Thawte is making email certification less useful (and more expensive), clients like Thunderbird and Mail.app will start to prefer GPG/PGP. That's all I can hope for anyway, since GPGMail for Mail.app is now broken under Snow Leopard for the foreseeable future.
Although I'm familiar with Thawte, I hadn't heard of its "Web of Trust" prior to this article. However, there's a popular browser add-on with the same name, so I thought I should point that out to avoid any confusion, especially since both products are related to Internet security in some way.
Web of Trust is also the name of a Firefox and Internet Explorer plug-in from a company called WOT Services Ltd. (until recently known as Against Intuition Inc.). It helps protect users from harmful Web sites and puts safety rating badges in search results on Google, Bing, Yahoo!, and other search engines, similar to McAfee SiteAdvisor and Symantec's Norton Safe Web (although in my experience, WOT is much more effective). This completely unrelated Web of Trust is not being killed off.
I hope that clears up any potential confusion.
the JoshMeister on Security
My company was a company that used Thawte. Then they started demanding that we prove who we are, despite the fact we already had an existing 2 year relationship with them. How do we prove who we are? By going to some anonymous person I've never heard of (and that Thawte have never heard of), paying them money to tell Thawte I am who I say I am. Well surely the fact that the credit card payments already made the previous two years confirm that (its not as if the payments were revoked). But no, I have to go to a "notary public" or equivalent and present myself to them. Even though that person doesn't know me from their arse or their elbow.
Thawte's tag line is/was "because trust matters", except that they don't even trust customers they have existing relationships with.
After arguing with them for days about this, I pulled the plug and went with a better provider. GeoTrust. I suggest you do the same.
No stupid going to an anonymous someone to tell them I am who I am and paying for the privilege - how on earth does that prove I am who I say I am? That anonymous someone knows me no more than the person at the end of the email in Thawte HQ, in fact I claim they know me less - I have an existing credit/purchase audit trail with Thawte and the credit card company but that counts for nothing.
No time wasting getting it done. None of that crap. And a better attitude, despite being smaller.
Thawte. Just say NO! Spend your money with people that know how to do business.
So open an Open ID account from Verisign and use their Personal Identity Portal (PIP)
I use them for my OpenPGP encryption and digital signature. Certainly just as good if not better than Web-of-Trust
A company who would cancel such a basic service would cancel OpenID in no matter of time. As it is offered free, you wouldn't have anything to say against it.
I stick with Yahoo in OpenID department, not some "side project" which has "beta" written all over the place.