Re: [Auth]Re: What I percieve is wrong with IDsec (was IDsec specification draft)

[Mike Warren]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rhys Weatherley <address@hidden> writes:

> If IDsec defaults to remote profiles, then the user has to take
> some action to make it more private.  But if IDsec defaults to
> local profiles, with every conceivable encryption and anti-
> correllation option enabled, then the user has to take some
> action to make it less private.

I fail to see the point of IDsec if it's just a glorified form-filling
solution with the possibility of storing the data elsewhere; what
about the *real* problem of *trustworthy* identity information.

If you tell me you're ``Rhys Weatherley'', that is probably perfectly
fine for an email conversation about a project (and I don't need IDsec
to tell me this) but what about when you're selling me a car and tell
me via the Internet that you're ``Rhys Weatherley''. In that case, I
want proof. I want some mutually trustworthy third party to say,
``yes, Mike, he's really called Rhys Weatherley''.

Isn't *that* the real use of an Identity system? If it's just to fill
in forms on the Web, Mozilla already does that.

- -- 
address@hidden
<URL:http://www.mike-warren.com>
GPG: 0x579911BD :: 87F2 4D98 BDB0 0E90 EE2A  0CF9 1087 0884 5799 11BD



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.5 and Gnu Privacy Guard 
<http://www.gnupg.org/>

iD8DBQE8PNkcEIcIhFeZEb0RAh8/AJ9w3GhUCLcPz+2qiac6ch5UJsVrcgCeMYgU
XPRdUd4wPTzNmcVANum8V/g=
=5ZzT
-----END PGP SIGNATURE-----