Policy-Discussion

[Ian G <iang AT systemics.com>]

Lambert.Hofstra AT ins.com
 wrote:
> You asked:
>
>                 Audit Question:  do we care if CAcert "Assurer" mugs and 
> t-shirts are widely distributed?  In my kitchen I have all sorts of mugs, and in my 
> cupboard all sorts of t-shirts.
>                 
>                 Normally I give them away or borrow/beg/steal them from 
> others.
>                 
>                 But if something purports to be "CAcert Assurer" grade and 
> that might help me pretend to be a CAcert Assurer, does that
>                 raise a security question?
>                 
>                 
>                 iang
>                 
>
> If I would wear a shirt with "Police" printed on it, would you really believe 
> i was working for the police?


The reason I wouldn't believe is that pretending to be a 
Policeman is a *crime* ... and in many western societies, 
this would be an unheard of thing to do.  (Note that it is 
on the uprise in Iraq these days, and has been common in 
Latin American drugs actions, as has been pretending to be 
the army.)

But ... there is a big difference between "using a logo" and 
"pretending to be a Policeman."  Perhaps we need something 
that says "you can use the logo as long as you are careful 
not to contribute to a potential fraud of role."

E.g., use the logo in a way that does not add to any role 
fraud.  So perhaps a logo:

   if only I was a
   C A c e r t
   assurer

Or some such humour that at least raises the question in the 
viewer's mind.


(Certainly I think a Mug is innocent ... but it is an 
interesting though experiment.  Closer to home, what happens 
when we produce badges that say:

   CAcert
   assurer

And someone who is not an assurer wears them?

> I would say wearing a t-shirt with the logo is no proof that someone is an 
> assurer so I don't see a problem here.


OK, I'm sold, as long as I can get a t-shirt saying in big 
letters

    C A c e r t
    P o l i c e

:)


> But you can always add a disclaimer "Please ask for credentials before getting 
> assured" :-)


Yup !  So the question is ... is there anything to be gained 
from a "false assurance" ?

And what are these credentials you speak of ;)

And, what positive check is there?

Just some musings on a slow Friday....

iang