StartCom Web of Trust

September 20, 2006

Point Systems for Persona Validations

Filed under: Digital Identity, Uncategorized — startssl @ 5:24 pm

Other CAs, that use a WoT, use a point system to show your validation status. Points that are able to be assigned ranging from 5 to 35 points.  With 50 points being the standard before you are “trusted” and you get to have your name in your certificate.

This is to get around the fact that most people don’t know how to check the class level of a certificate, and even if they did its not represented uniformly, because there is no data in the certificate that tells you what class level it is.  The “Best practices” say that the CA should issue different class levels from different Intermediate Authorities, but not everyone does.

Back to the point…

In the context of a persona validation, is it valid to say “I have a 14% level of belief that this person is who they say they are”? In the context of a Notary Public the answer is “no”.  Either you believe this person and their ID or you don’t.  You countersign their document or you don’t.  Yes yes I know, the Notary System for the web isn’t that exact, and you can’t trust that people are doing their job, so you counteract their inexperience, by not allowing them to assign as many points. But does this thought pattern really hold water?  Especially if there is no legal ramification for a Notary, if nobody is held liable for these assertions, who cares if they are assigning 5 points or 150 points.

In my opinion, the only sane way to handle persona validations is in a boolean fashion, you believe the person, or you don’t. It should be looked at the same way as a Notary Public (or at least the way Notary Publics SHOULD be looking at their job) “this is a legal document, if there is fraud I am liable, do I believe this person, and do I believe that they are not under duress”.  If you don’t, then don’t make the assertion.

No Comments Yet »

No comments yet.

RSS feed for comments on this post. TrackBack URI

Leave a comment

Blog at WordPress.com.