Apple Reminds Us of Trusting, Verifying

edward (apparently) - 01:19pm May 23, 2006 PST
via email



> I do have one rather off-beat suggestion. Provide an automated
> fingerprint reader by phone. Offer a telephone number that's
> clearly within Apple's known phone range and have a voice that

Excellent article here. But I would comment on the recommendations to use
phone or fax as alternate channels to retrieve a key. Already, these travel
over the same physical media as email and web. More and more, the protocols
are converging. How long will it be before intercepting a fax or phone call
is little different from intercepting email or a web connection? I'm no
alarmist here -- even the latter aren't exactly easy -- but the difference
is getting smaller. My faxes already arrive wrapped within email, and many
people are making their phone calls via the net.

The only channel that's really remaining separate is mail -- the paper
kind. Of course, the objection to this is that it costs serious money
compared with any electronic communication. But probably many of the people
who are taking the trouble to independently verify keys -- and I offer them
my thanks, because I think it's important that some people do it even
though most people won't and needn't -- would happily pay the cost of
postage to verify high-profile keys such as Apple's. After all, the idea of
paying Apple 99 cents for some bits is no longer foreign. And just one
trusted key could be used as the bootstrap to reload the trusted
certificate list.

Edward
Art works by Melynda Reid: http://paleo.org