> On Sat, Feb 12, 2005 at 04:32:26PM -0800, David Schwartz wrote: > > > As a user of a browser I am not a customer of the CA, and it isn't > > > evident why the CA should be under any obligation to me. They surely > > > are under an obligation to their shareholders and their customers. > > Nonsense. The CA is asking for your trust and can only earn > > revenue based > > upon the number of people who trust it. > Wrong. The CA gains trust because it manages to get its > certificate included > with the default package for major browsers. Correct. And the browser vendors gain trust because they only include reputable CAs. > It then has to persuade its customers (the server operators) to buy a > certificate. It does not have to persuade any user: trust is already > implied by the bundling. How do you think you get the bundling? To put it another way, what would happen if a CA violated the trust? If the vendors didn't immediately ship patches to remove the untrustworthy CA, there would be a great oppurtunity for third parties to do so, and rest assured they would. Immediately. This is no different than the case of Burger King buying inferior beef. While it's true the beef vendor only has to convince Burger King to buy the beef, not Burger King's customers, there wouldn't be any customers as soon as they found out that Burger King was reselling food made from inferior beef. This is just like any other indirect relationship. Buyers never want poor quality raw materials because they result in poor quality finished goods. DS
