Re: SSL Certificate - Self-Generated vs 3rd Party ?

From: Dimitri Maziuk (dima@127.0.0.1)
Date: 03/10/03

  • Next message: J George M: "dq3hf5k" 
    From: Dimitri Maziuk <dima@127.0.0.1>
Date: Mon, 10 Mar 2003 06:57:34 +0000 (UTC)

    Dan sez:
    > My company is going to use SSL to communicate with a business partner;
    > that is we are trusted parties. I realize that the only way to
    > guarantee true identity is to use a 3rd party certificate manager like
    > Verisign.

    Why? Verisign tells you that "someone who claims to be such-and-such
    paid us to tell everyone that this particular key belongs to them".
    Your business partner, OTOH, can write their key fingerprint on a
    piece of paper and bring it to your office. Why would anyone rather
    trust Verisign than people they know and work with?

    Dima 

    -- 
Yes, Java is so bulletproofed that to a C programmer it feels like being in a
straightjacket, but it's a really comfy and warm straightjacket, and the world
would be a safer place if everyone was straightjacketed most of the time.
                                                      -- Mark 'Kamikaze' Hughes
  • Next message: J George M: "dq3hf5k"