Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.219.48 as permitted sender)
	client-ip=209.85.219.48; envelope-from=melvincarvalho@gmail.com;
	helo=mail-oa0-f48.google.com; 
MIME-Version: 1.0
In-Reply-To: <CANEZrP3fWbGAO3MSvAzicjPmPzUGVfSgxk_MnZNUhHzE7_9drg@mail.gmail.com>
References: <CANEZrP3w+pGVJijxLr1N6wQiqg4U=RUP3Mrph2=fwF+Ga_U9sQ@mail.gmail.com>
	<CAKaEYhLftC67Lrinc2yF0coqhJi_DpM4XvoXfBwJBGv=hFi3yQ@mail.gmail.com>
	<CANEZrP3fWbGAO3MSvAzicjPmPzUGVfSgxk_MnZNUhHzE7_9drg@mail.gmail.com>
Date: Fri, 9 Aug 2013 14:17:10 +0200
Message-ID: <CAKaEYhJSf7vt8WzBBY=qZhTNhdWeWu5kjyhcyidVfFUV1vxp-g@mail.gmail.com>
From: Melvin Carvalho <melvincarvalho@gmail.com>
To: Mike Hearn <mike@plan99.net>
Content-Type: multipart/alternative; boundary=e89a8ff2485502911004e382c1a3
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Idea for new payment protocol PKI
Precedence: list

--e89a8ff2485502911004e382c1a3
Content-Type: text/plain; charset=ISO-8859-1

On 9 August 2013 14:08, Mike Hearn <mike@plan99.net> wrote:

> Bitcoin sought to reduce dependence on trusted third parties, where as,
>> persona is increasing the reach of trusted third parties.  The keys and
>> passwords are stored on mozilla's servers, sometimes on your email
>> providers.  Persona, is however, a progression and will hopefully improve
>> its security and decentralization as it goes along.
>>
>
> When Persona is supported by all the key players in a transaction Mozilla
> doesn't get anything, do they? You can easily run your own IDP on a
> personal server if you're the kind of person who likes to do that, then run
> Firefox so you have a native implementation and the Mozilla servers aren't
> involved. The keys never leave your computers.
>

You'd need to run your own email server and/or change email address, which
is not in the reach of the average user, and maybe not even of some
businesses.


>
> Whilst X.509 certs can indeed be issued for any arbitrary string, you
> still need a CA that will do it for you, and that's typically not so
> trivial. CAs aren't meant for widespread end user adoption, really, whereas
> Persona is.
>

You can self sign X.509 certificates quite easily (e.g. one click via
<KEYGEN>), then rely on a decentralized web of trust to remove browser
warnings.  A few people are working on this.


>
> I don't think Persona is any more or less centralised than other PKIs,
> really, just easier to use. Ultimately the string you're verifying is a
> user@host pair, so the host is centralised via DNS and to verify the
> assertions it vends, you must use SSL to connect to it, so under the hood
> the regular SSL PKI is still there.
>
>
>
It is easier to use, that's a great plus.  But convenience is often a trade
off with security.

I dont user user@host, I use my home page because it's easy to dereference
and get a public key.  Email is hard to dereference.

Yes, there is a reliance on DNS, which Tim calls the 'Achilles heel' of the
web, but it's held up quite well so far (fortunately for us).

Mozilla also have a master key to most email accounts, so if anyone got
access to that they could impersonate the vast majority of users that have
not opted in.  I would not use persona for financial stuff, but if I made a
casual app with non sensitive information it would be one of the top
choices, imho

--e89a8ff2485502911004e382c1a3
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><br><div class=3D"gmail=
_quote">On 9 August 2013 14:08, Mike Hearn <span dir=3D"ltr">&lt;<a href=3D=
"mailto:mike@plan99.net" target=3D"_blank">mike@plan99.net</a>&gt;</span> w=
rote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_extra">=
<div class=3D"gmail_quote"><div class=3D"im"><blockquote class=3D"gmail_quo=
te" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"=
>
<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">
<div>Bitcoin sought to reduce dependence on trusted third parties, where as=
, persona is increasing the reach of trusted third parties.=A0 The keys and=
 passwords are stored on mozilla&#39;s servers, sometimes on your email pro=
viders.=A0 Persona, is however, a progression and will hopefully improve it=
s security and decentralization as it goes along.<br>

</div></div></div></div></blockquote><div><br></div></div><div>When Persona=
 is supported by all the key players in a transaction Mozilla doesn&#39;t g=
et anything, do they? You can easily run your own IDP on a personal server =
if you&#39;re the kind of person who likes to do that, then run Firefox so =
you have a native implementation and the Mozilla servers aren&#39;t involve=
d. The keys never leave your computers.</div>
</div></div></div></blockquote><div><br></div><div>You&#39;d need to run yo=
ur own email server and/or change email address, which is not in the reach =
of the average user, and maybe not even of some businesses.<br></div><div>
=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmai=
l_extra"><div class=3D"gmail_quote">
<div><br></div><div>Whilst X.509 certs can indeed be issued for any arbitra=
ry string, you still need a CA that will do it for you, and that&#39;s typi=
cally not so trivial. CAs aren&#39;t meant for widespread end user adoption=
, really, whereas Persona is.</div>
</div></div></div></blockquote><div><br></div><div>You can self sign X.509 =
certificates quite easily (e.g. one click via &lt;KEYGEN&gt;), then rely on=
 a decentralized web of trust to remove browser warnings.=A0 A few people a=
re working on this.<br>
</div><div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0=
 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div cl=
ass=3D"gmail_extra"><div class=3D"gmail_quote">
<div><br></div><div>I don&#39;t think Persona is any more or less centralis=
ed than other PKIs, really, just easier to use. Ultimately the string you&#=
39;re verifying is a user@host pair, so the host is centralised via DNS and=
 to verify the assertions it vends, you must use SSL to connect to it, so u=
nder the hood the regular SSL PKI is still there.</div>

<div><br></div><div><br></div></div></div></div>
</blockquote></div><br></div><div class=3D"gmail_extra">It is easier to use=
, that&#39;s a great plus.=A0 But convenience is often a trade off with sec=
urity.=A0 <br><br></div><div class=3D"gmail_extra">I dont user user@host, I=
 use my home page because it&#39;s easy to dereference and get a public key=
.=A0 Email is hard to dereference.<br>
</div><div class=3D"gmail_extra"><br>Yes, there is a reliance on DNS, which=
 Tim calls the &#39;Achilles heel&#39; of the web, but it&#39;s held up qui=
te well so far (fortunately for us).=A0 <br><br>Mozilla also have a master =
key to most email accounts, so if anyone got access to that they could impe=
rsonate the vast majority of users that have not opted in.=A0 I would not u=
se persona for financial stuff, but if I made a casual app with non sensiti=
ve information it would be one of the top choices, imho<br>
</div></div>

--e89a8ff2485502911004e382c1a3--