Subject: QC biometrics needs re-engineering NOW!

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 7 Dec 1999 22:48:07 -0000

Stephen,

>I suggested that it was silly to present a digest
>without being able to point at something that allows you 
>to verify the digest

It sure is silly!  Interoperability=ZERO

>as you should be able to see from 
>the archive (but its so long ago I forget, maybe it was
>a private posting). I think Steve K. addressed the issue
>when he said that handing over a URL says nothing about
>who can gets a 404 vs. a 200 when they ask for the content.

That is REALLY silly!  The RP is authenticating to the CA-server.......
I.e. all RPs must be "known" in advance by the CA?  Should I laugh  :-) :-) :-) . Or should I cry? :-( :-(

Compare that to the simple, interoperable, universal trick invented by Netscape(?)
some 3-4 years ago called user certificate selection.  Like getting a list like:

    - Standard QC
    - Photo ID
    - e-mail cert
    - SSN cert

Anders

---

From: Ed Gerck <[email-masked]>
Date: Tue, 07 Dec 1999 14:29:08 -0800

Anders Rundgren wrote:

> ...
> That is REALLY silly!

No, it is not. It means that the biometric data can be denied to
you, even though it is available.  You may need a client certificate
to get it, or a password, or be in an IP range  You don't get it just
because it is in the certificate.

BTW, I may suggest that including identifying biometric data in
certificates is unconstitutional in the entire EC, where countries
have harmonized their constitutions to directly *forbid* any
initiative which may allow the creation of a unique indentifier,
a national ID.  Please verify in the current Swedish Carta Magna,
or German, etc.

Cheers,

Ed Gerck