Really, the only root cert that comes in a browsers should be the browser maker's own, and then the browser maker would sign, using the private half of this cert, the CA certificates, which should be obtained dynamically via HTTP. Then new CAs can be added more readily.
The problem with this is that the browser producers key becomes a link in the security chain. At least CAs have a big incentive to keep there root keys very secure - their whole business depends upon it. Would you trust MS to keep their key for IE6 securely.
Maybe someone like AOL/MS could afford to hire the expertise to check that they are doing things securily (whether they would bother is a different question), but would Opera, or any other potential competitor, have the resources to keep there keys in guarded safes in the way that the CAs do.
If you look at this further BBC article, linked from the first one, you'll see the researchers developing this system say:
The researchers originally thought electronic signals from speed signs would do the same job as GPS. But Mr Fowkes said: "There are an awful lot of speed limit signs, so that would have been very expensive. "With GPS becoming more widely available, it seemed an obvious step to make."
The researchers also talk in this article about the need for an override system.
I think that it's worth remembering that this is just something the government considering the options. John Prescott is very keen to be seen to be "doing something" about transport, but so far this government have actually done very little (although they have covered strips of the road outside my office with green gravel - this will supposedly encourage us all to cycle - which is nice).
This is a very long way from actually becoming law. There have been many suggestions of systems to limit/detect speeding cars. I remember the previous government talking about toll roads with an electronic system to keep track of cars for billing which automagically fined you 50p per 10mph per mile which you were over the speed limit, but nothing came of it.
Slashdot Mirror
The problem with this is that the browser producers key becomes a link in the security chain. At least CAs have a big incentive to keep there root keys very secure - their whole business depends upon it. Would you trust MS to keep their key for IE6 securely.
Maybe someone like AOL/MS could afford to hire the expertise to check that they are doing things securily (whether they would bother is a different question), but would Opera, or any other potential competitor, have the resources to keep there keys in guarded safes in the way that the CAs do.
The researchers also talk in this article about the need for an override system.
I think that it's worth remembering that this is just something the government considering the options. John Prescott is very keen to be seen to be "doing something" about transport, but so far this government have actually done very little (although they have covered strips of the road outside my office with green gravel - this will supposedly encourage us all to cycle - which is nice).
This is a very long way from actually becoming law. There have been many suggestions of systems to limit/detect speeding cars. I remember the previous government talking about toll roads with an electronic system to keep track of cars for billing which automagically fined you 50p per 10mph per mile which you were over the speed limit, but nothing came of it.
John Pybus