Encryption – What's it mean in the real world?

PKI Problems

PKI desgined to be ultimately perfect, falls short of it's goal

It's snake oil -- It's not usually attacked, actively or passively, the end points are an easier target

Not always secure -- it's potentially trivial to be attacked by Governments or some well positioned companies

Questions!

Why are people still using digital postcards?

Why are people still using passwords, and sending them in clear text?

What can I do to protect me and my privacy?

Strategic goals

Privacy through encryption

Security through authentication

Identity verification for the Internet

Solution for the catch 22 problem: Certificates and applications

Why use encryption specifically?

To protect yourself from:

competitors

your ISP and your recipients ISP

governments

Wi-fi

family members, etc... well .... most of the time...

Applications

Signing and encrypting Emails

Securing a Server

SSL/TLS (web/smtp/imap/pop3)

Authentication with client certificates

Authentication for VPNs

Code Signing

Technology

X.509 certificates

server certificates

client certificates

code-signing certificates (Java, Active-X, Cellular phones, ...)

IDN-Domains

OpenPGP Signatures

CAcert Specifics

Building up a Web of Trust and Critical mass

Getting closer to being included by at least mozilla

People rebuilding Mozilla apps to include our cert

CAcert is currently under going a WebTrust compatible audit

Open and transparent structure

Sourcecode is available for audits

Instant revocation lists

2005-04-12T08:49:29