Policy-Discussion

[Ian G <iang AT systemics.com>]

(all mild observations that can be ignored...)


Sven Anderson wrote:
> Duane, 12.01.2007 13:32:
> > Bernhard Froehlich wrote:
> >
> > > So I'd vote for the policy "Disclose all user provided information if a
> > > user's certificate is involved in a civil or criminal lawsuite". But I
> > > have been criticised for this opinion before... ;)
> > I strongly disagree with this, why should we hand over data liberally
> > without a valid court order in a jurisdiction that we do actually have
> > to adhere to?
>
> I'm a little radical in this aspect. Either nobody or everybody should be
> able to access an information. Because I think that the real problem about
>  privacy is the _difference_ in information access, that is that
> information is available only _about_ or _for_ certain groups.


Right.  That's the weakness in many security proposals. 
"Oh, we secure this data and don't give it out, so you're 
safe...."  Until you aren't.

CAcert is tending towards a viewpoint that nobody has 
permission to access the data, as a baseline.  If a need is 
found, then an Arbitrator has to write an instruction to a 
system administrator (who has the power).  In this way there 
is 4 eyes on the question of access, and the system 
administrator is protected, it makes that job much easier.


> So here's my proposal: Why not make CAcert to a public space? All
> information in the CAcert databases is declared as public, who wants to be
> part of it, has to agree with that. I see clear advantages in this
> approach. I would like to see, who assured whom. The whole web-of-trust
> would get transparent and therefore easier to trust (or not). There just
> has to be a protection against spammers to download all the
> email-adresses, like in other "e-communities" too. I mean, what
> information does CAcert have about me anyway? My real name, my
> email-address (both in my certificates and therefor public anyway), and
> whom I gave and from whom I got how many assurance points and where. (Many
> e-community sites do something very similar with their web-of-contacts,
> where you can traceroute an arbitrary person by the established contacts
> in the community.)


Some people don't like their names being anywhere on the 
net.  Twice I've had to go through legal documents and 
psuedoanonymise certain names in documents filed in court so 
that their names don't turn up in google searches (and wait 
for google to roll over its versions).

In both cases these were women who didn't want people 
knowing they existed ... and they find the ability for 
others to browse their history rather spooky.  If CAcert 
were start publishing names in the WoT, it would probably 
scare this group away...

Just an observation ... I don't have any easy answers, and 
can argue both sides of the question, depending on which 
side of the bed I get up from in the morning ... the debate 
is valuable!


> For the rest (logfiles and stuff like that) the question about giving out
> data is the same as for every webservice with useraccounts, which is
> answered by the local authorities of where ever the servers are located
> at. CAcert is not in the position to "handle" something here, I guess.
>
> As I stated several month ago, IMO CAcert should be just a framework for a
> community, helping their members to check the identities of each other,
> and therefore should take as less responsibility as possible.


At a broad level, I suspect this is going to happen ... due 
to simple efficiency considerations.


> BTW: why not putting a certain assurance-level into the certificates,
> going away from that binary "certified-or-not" principle? We shoudn't run
> after the "big" CAs, we should just make it better, with new ideas. I
> guess, if we get popular, just because it works and it's better/more
> trustful/more transparent than the rest, we will be "in the browsers"
> faster than we'd prefer.


I would prefer to have that info on the website.  I can't 
see the point of putting any info in the cert at all, it 
would be much nicer just to pop over to 
https://cacert/get_points?id=123456 and get the current 
situation.


iang