Re: [9fans] offered without comment or judgement

["Devon H. O'Dell" <devon.odell@gmail.com>]

2010/6/29 Wes Kussmaul <wes@authentrus.com>:
> Stanley Lieber wrote:
>>
>> Anywhere legitimate identification is used, legitimate identification can
>> be purchased.
>
> There are imperfect but very good ways to protect against that
> vulnerability. They vary with the needs (and budgets) of relying parties.

I'm pretty sure you can't solve the problem. At the end of the day, it
boils down to client-side security and what a person is willing to
defend with their life. It's perfectly feasible to assume that
identity information in a PKI world can be coerced and stolen as
easily as physical identity information such as drivers licenses and
social security cards. The security always breaks down at the personal
level, and most private individuals aren't willing to die to protect
this information.

But you can do at least as good as these forms of ID. PKI requires
knowledge of some sort of passkey. (I just worry about identification
for people who are not smart enough to pick a good key. Which,
unfortunately, is also most people.

--dho