On Mon, Nov 20, 2000 at 02:18:42PM -0600, Jim Choate wrote:
Real-To: Jim Choate <ravage@ssz.com>
On Mon, 20 Nov 2000, R. A. Hettinga wrote:
At 12:10 PM -0500 on 11/20/00, Arnold G. Reinhold wrote:
If CAs included a financial guarantee of whatever it is they are asserting when they issue a certificate, then all these problems would go away.
Right.
Bonding would not fix this problem. It only moves the question of identity and responsibility to the bonding agency. You've still solved nothing.
It's not a bond; and it doesn't solve the problem directly, but moves responsibility for solving the problem out of the end users' domain and into the CA's (or guarantor's) domain, where their greater resources and experience (and liability) will help them solve the problem in the most efficient and economic fashion. It's like putting prices on corporate or government bonds - you can look at the price of the bond to get an idea of the confidence people have in the likelihood that the underlying obligation will be repaid. Certificates which are priced on a risk-sensitive basis - or whose face value (or guarantee value, or whatever) is risk-sensitive allow people (and their computers) to immediately see both their own risk exposure in concrete terms, and to have an idea of what the market (including sophisticated participants) thinks about the risk. -- Greg Broiles gbroiles@netbox.com PO Box 897 Oakland CA 94604