Recently, the Shmoo Group discovered that Firefox is vulnerable to precisely the exploit that i predicted in my 2002 paper—Ping

➡

The central point of my essay on the petname toolbar is that phishing is the result of name conflation.—Tyler

➡

So how, in this system, does the user come to trust Paypal (as opposed to someone pretending to be Paypal)?—Ben

➡

If I’m understanding the discussion so far, I think the answer is that the issue of trust is separate from the issue of identity.—Jed

➡

Indeed, but I am no closer to understanding how the user ever gets to a state where they can do anything useful.—Ben

➡

I gave some examples in my next message on this topic. Perhaps you could address them.—Jed

➡

I agree it solves the problem of confusable URLs.—Ben

➡

What don’t you believe is practical?—Jed

➡

Let’s say I start with actually visiting my bank, and getting the fingerprint of their cert. I then tediously type that into my machine.—Ben

➡

Forget the tedious typing. You give them your smart card (or something like) and they add a Petname binding to it.—Jed

➡

I’m sorry to be such a curmudgeon here, but-- this doesn’t sound like a solution I can get terribly excited about.—David

➡

To communicate about third parties, we need to first securely agree on a common semantics. The problem of secure general agreement is a property rights problem, and particular a property titles problem. It’s like agreeing on who owns the land, and what are its boundaries. I’ve tackled this problem in depth at <szabo.best.vwh.net> More information on the distributed database system that the secure title system is based on can be found at <szabo.best.vwh.net>—szabo

➡

In this case, the user’s trust is placed in the legal system.—Sandro

➡

Yet people are giving away credit card and other personal information quite freely. —szabo

Because all the information the user needs to make informed decisions is hidden behind the impenetrable "little black box" that is the user interface (or isn’t even there in the first place). If presented the proper information, the user can make more intelligent decisions. They will be able to distinguish the online equivalent of buying something off a truck in an alleyway, versus buying it at Walmart. They will then, hopefully, be a little more discriminating with their information.

The current situation of "personal info free-for-all" is akin to those annoying dialog boxes to which the user simply clicks "ok"; they can’t tell a bad online decision from a good one because they either have insufficient information, or it’s represented in such a way that they cannot understand it, but they need to get stuff done, so onward they go.—Sandro