Opinons on Thawte's Web of Trust? - PGP

This is a discussion on Opinons on Thawte's Web of Trust? - PGP ; I recently thought I'd sign up for a Thawte personal email certificate, which is free so what the hell. They appear, however, to have withdrawn support for PGP, so it's not that interesting to me really. Not even all versions ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: Opinons on Thawte's Web of Trust?

  1. Opinons on Thawte's Web of Trust?

    I recently thought I'd sign up for a Thawte personal email certificate,
    which is free so what the hell. They appear, however, to have withdrawn
    support for PGP, so it's not that interesting to me really. Not even all
    versions of Outlook seem to support their certs properly either.

    What I thought was interesting though is their Web of Trust PKI system that
    they encourage you to participate in:

    http://www.thawte.com/html/COMMUNITY/wot/index.html

    There are some "notaries" near me that I could get to authorise me, but it
    all seems a bit half-baked somehow, mainly I suppose because it doesn't
    generate any direct revenue for Thawte.

    What do people here think about Thawte's system?

    Jonathan




  2. Re: Opinons on Thawte's Web of Trust?

    > What I thought was interesting though is their Web of Trust PKI system
    > that they encourage you to participate in:
    >
    > http://www.thawte.com/html/COMMUNITY/wot/index.html
    >
    > There are some "notaries" near me that I could get to authorise me,
    > but it all seems a bit half-baked somehow, mainly I suppose because it
    > doesn't generate any direct revenue for Thawte.


    You don't need Thawte to set up a web of trust.

    Plus, why should I go and have my identity 'confirmed' by Thawte (or
    Verisign ) when any random can come along, pay $25, and get
    Thawte's thumbs-up?

    This bugs me in the same way as 'root authorities' wrt SSL X509s. We all
    know that Verisign/Thawte/whoever are not much of a reliable authority,
    they will sign anyone that gives them money.

  3. Re: Opinons on Thawte's Web of Trust?

    On 24 Sep 2003, Jem Berkes wrote:
    >> What I thought was interesting though is their Web of Trust PKI
    >> system that they encourage you to participate in:
    >>
    >> http://www.thawte.com/html/COMMUNITY/wot/index.html
    >>
    >> There are some "notaries" near me that I could get to authorise me,
    >> but it all seems a bit half-baked somehow, mainly I suppose because
    >> it doesn't generate any direct revenue for Thawte.

    >
    > You don't need Thawte to set up a web of trust.
    >
    > Plus, why should I go and have my identity 'confirmed' by Thawte (or
    > Verisign ) when any random can come along, pay $25, and get
    > Thawte's thumbs-up?
    >
    > This bugs me in the same way as 'root authorities' wrt SSL X509s. We
    > all know that Verisign/Thawte/whoever are not much of a reliable
    > authority, they will sign anyone that gives them money.


    The free certs from Thawthe have a web-of-trust mechanism of
    notaries. Without being signed by a certain number of notaries, you
    can't even get your email name in your cert. So, I think that their
    web has value. However, even without using their web, the free cert
    has value for communications between entities that already know each
    other through other channels, or as an adjunct to known PGP
    communications.
    --
    Clay Haapala
    From the Well There Ya Have It Department:
    "If (punch cards) were good enough to elect our president..."
    -- CA recall attorney Charles Diamond

+ Reply to Thread