<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Martin,<br>
<br>
Martin Paljak wrote:
<blockquote
cite="mid:831FF4FB-3A1F-4A9E-A561-72FBDD926219@paljak.pri.ee"
type="cite">
<pre wrap="">
In Estonia, when people say they don't trust the smart card technology
which the national eID is based upon or they don't trust the
government issuing them</pre>
</blockquote>
Doesn't the government knows best about who you are? I mean, they issue
all the other documents too, like IDs, passports and driving
licenses...I guess it can't get better than that. This is what CAs rely
upon usually...<br>
<br>
...except in case the government also creates the private keys for its
citizens, which would be indeed a reason not to trust such cards for
encrypted data exchange (and authentication).
<blockquote
cite="mid:831FF4FB-3A1F-4A9E-A561-72FBDD926219@paljak.pri.ee"
type="cite">
<pre wrap="">
For me, all technologies that imply some kind of universal built in
trust (like PKI)</pre>
</blockquote>
This is for what standards and definitions are here for....or for that
matter policies which govern CAs in software like browsers?! Nothing is
perfect, but is it broken by design?<br>
<blockquote
cite="mid:831FF4FB-3A1F-4A9E-A561-72FBDD926219@paljak.pri.ee"
type="cite">
<pre wrap="">
So instead of building a uniform trust model into OpenID, lets give
all parties (users, consumers, providers) means to make a good trust
*decision* based on different inputs. Like PAPE.
</pre>
</blockquote>
Muhhhaaahaha....And who confirms to you (the RP) that the OP indeed
implements the PAPE assertions? What refrains an OP from returning
Physical Multi-Factor and NIST level 4 no matter what? That's like hot
air...The assertions made by both our OpenID providers (*) are
worthless because anybody can claim the same....it devalues our efforts
and gives to the RP (and user) at best a wrong sense of trust and
security...<br>
<br>
(* I know Martin from a different mailing list not related to OpenID
and happen to know about the OpenID provider he operates)<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>