Subject: Re: [Spasm] CAB Forum efforts on S/MIME and client certs

From: Wei Chuang <[email-masked]>
Date: Fri, 4 Nov 2016 07:25:37 -0700

I was wondering if S/MIME EV-like certificate was discussed before?  The
closest was this:
https://www.ietf.org/mail-archive/web/smime/current/msg18970.html
FWIW the combination of EV like profile and UI behavior (logo + other
visual designator), and organizational level attestation with CT is what I
think is a good direction as well.

Going back to the IETF and CABF discussion.  Presumably having discussions
in both forums is fine as this type of proposal would overlaps different
parts of what both organizations seem to be interested in.  As only a
recent participant in the IETF, it seems that the IETF is mostly interested
in standards, security and infrastructure and probably policy but less so
for UI and UX work.  Where as the CABF is very much interested in the UI,
UX and policy aspects.  It seems like there's overlap in people, so at
least to me, it seems like such a discussion could work.  Perhaps cross
posting common relevant discussions would help too.  I bring this up,
because it might be helpful to figure this out in advance to prevent
confusion.

-Wei

On Fri, Oct 28, 2016 at 7:12 AM, Phillip Hallam-Baker <[email-masked]
> wrote:

> Just a heads up for people in this group that there is a working group
> starting in CABForum looking at client certificate validation processes.
>
> One point that it might be useful to work on jointly would be ways of
> making use of organization level certificates in S/MIME systems. The WebPKI
> works well at what it is designed to do. The problem with the WebPKI is
> that is a subset of people want it to do.
>
>
> By 2030 I would love to see secure email to have got to the point where
> there is something like 'booths in shopping malls' where professionals,
> doctors, lawyers, etc. go to get their credentials notarized. But we aren't
> close to that yet and we won't ever get there unless we have another way to
> get to critical mass.
>
> Making use of EV guidelines or some variant thereof to jumpstart the
> process of issue seems like it could be a way to get to deployment of
> S/MIME in the public space.
>
>
> Right now we have a perfect storm as far as end to end email security is
> concerned. Snowden has got the tech community worked up on the issue. And
> email security is currently the top issue in the US Presidential election.
> I think that is a ludicrous situation but whoever wins is very likely to
> make fixing email insecurity a priority.
>
> And no, I don't think the opponents of strong crypto are going to stand in
> the way this time. In fact I think they will soon be looking for new jobs.
> Yes, even the one who thinks he has tenure.
>
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>
>