Re: [photo-3d] Paypal and non-USA-creditcard

[Brian Reynolds <reynolds@xxxxxxxxx>]

Eddie Bowers wrote:
> That's not entirely true. If they run a secure site they must
> register and pay for a certificate from a valid authority (typically
> Verisign). To do this they must supply lots of information to prove
> they are legit. You can't just turn on SSL security, you have to
> have a valid certificate from a certificate authority.  If they
> start ripping people off they can can also get their certificate
> revoked.
> 
> This actually a very good system that works well.
> 

Actually that's not really the case.  Once you get through to the
bottom line in their paperwork all Verisign will verify is that the
entity (person or company) who holds a certificate is the entity that
paid them for that certificate.  Verisign does not make any statement
about how the certificate is used, the identity of the certificate
holder or the trustworthiness of the certificate holder.

By the way, you can just turn on SSL security.  There's nothing
stopping me from building a webserver with SSL and also building my
own certificate server for use with connections to my server.  You
might not want to accept certificates from my certificate server, but
that wouldn't prevent me from doing it.

Public Key Interchange (PKI) is a tricky problem, and the current
solutions are pretty brittle.

-- 
Brian Reynolds                  | "Dee Dee!  Don't touch that button!"
reynolds@xxxxxxxxx              | "Oooh!"
http://www.panix.com/~reynolds  |    -- Dexter and Dee Dee
NAR# 54438                      |       "Dexter's Laboratory"

------------------------------------------------------------------------
Whatever happened to the class clown?  Find out at Classmates.com,
your online high school class reunion. With 4.4 million alumni
already registered, there's a good chance you'll find him here:
http://click.egroups.com/1/3140/5/_/160438/_/956165726/
------------------------------------------------------------------------