🚀 go-pugleaf

In article <2qhds8$i9l@smart1.svi.org>, Harry Saal  <HSaal@svi.org> wrote:
>
>In article <CpD9rx.D9w@nbn.com>, <booker@next.sdsc.edu> writes:
[ My comments about CommerceNet deleted ]
>> 
>> - Given all these good things, I think their goals are a bit
>> short-sited. All they are putting in place is the structure to
>> duplicate an 1-800 number advert from a computer rag. There is 
>> no authentication of the user inherent in their setup. The possibility
>> is definitely available, but they don't seem to be very concerned
>> about it.
>> 
>
>I think you must have totally missed quite a bit about what CommerceNet is 
>doing. The issues of authentication and privacy are very high on their agenda, 
>and in fact at their recent press conference they demonstrated a prototype 
>extension of Mosaic using RSA RIPEM which provides for authentication, using 
>Public Key algorithms. I think you should read all the information on their Web 
>pages (www.commerce.net) or get them to mail you printed information before you 
>make silly statements like "all they are putting in place...." above. 
>
>For those who need their US Mail address, use
>

- Yes, I have seen their prototype and I have talked with the authors
about this very issue. EVEN the FANCY version of their software DOES
NOT DO USER AUTHENTICATION, it does "server authentication". It allows
you to believe what you receive from a web server and to establish a
private communication channel with that server. It does not let the
"server" believe what it receives from the client.

 Given the current structure of the internet this is perhaps more
important than I indicated. User authentication on the phone has not
been very important for commerce. The potential for user
"authentication" is available in their system, it however requires a
trusted third party for key verification or out of band
communication. If you think their system is ready for delivery of
goods over the internet, please go ahead and set up shop...I can't
wait.  If you don't understand the issues, please read the
documentation on pgp and understand the issues of both server
and user authentication.

- I don't mean to denigrate the efforts of CommerceNet. I just want to
cut through the HYPE to the kinds of things that can and cannot be
done given the current state of the internet. What CommerceNet is
doing is not trivial in any sense, however it is limited and does not
extend beyond current metaphors. We waste the potential of electronic
interaction if we only attempt to duplicate systems that already exist
in the world of analog communications. There is nothing technically
limiting CommerceNet's system for achieving these kinds of
interactions. The real limitation is the "Trusted Third Party", every
scheme that I am currently aware of requires this. Who should we
trust? Clipper? The FBI? The PostOffice? Who should be the "keeper
of the keys"? Who are you willing to trust the entire balance of your
various banking accounts to.....?

- The banking network (ATM) seems to have solved some of these problems,
however not every hacker with a modem can connect to the ATM network. 
I'll be interested to learn how they have done it.... 

- Booker C. Bense: bbense@pcbense.epri.com