Re: Draft Charter

[Cat Okita <cat@xxxxxxxxxxxx>]

On Thu, 16 Aug 2007, Stephen Kent wrote:
> > I think what's typical for an Enterprise depends on the application. If 
> > we're talking about browsers, then I think it's perfectly acceptable to 
> > have two TAAs - one from the browser vendor (it shouldn't be my employer's 
> > task to tell me that Verisign has a new root CA certificate - that's 
> > Microsoft's job) and the other being the corporate IT department. That's 
> > why I think each TAA should be able to manage its own (and only its own) 
> > trust anchors.
>
> Even in this case I can see problems, I think several folks have noted that 
> the default TAs currently installed in browsers ought to be subject to local 
> management, especially deletion! So, as a browser user in an enterprise 
> context, I would not want a TAA installed by MS (or, in my case, Apple) to be 
> able to maintain the presence of TAs even if my IT dept wants to remove them.

Agreed - we've already discussed the current problem of unwanted TAs being 
silently put back into browsers.  It's also much easier to move from a
point of less privledge to granting more, rather than the other way around.

> > In your consumer space example, I again don't think SalesForce.com should 
> > be able to delete bankofamerica.com's trust anchor. Perhaps there should be 
> > exception, such as if Microsoft learns that the bankofamerica.com TA really 
> > belongs to a phishing company, but I think each TAA should manage its own 
> > as a general rule, and this should be enforced.
>
> This example seems to suggest that a home user might have lots of TAAs, not 
> just a lot of TAs. I'd worry that the result would be unmanageable for most 
> home users. Did I misunderstand your example?

If I recall correctly, the expectation was that home users might have 
lots of TAAs, but the likely situation would be that they'd take a
default trust set, and only dive down into the fine bits in a limited
number of circumstances (namely users like us...)

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."