Re: PKI is the pits?

[Bennett Todd <bet () rahul net>]

I've been around many deployments, some were fine successes, others
were nasty.

I like to sum up the problem as "trust doesn't scale".

If you've got a specific problem to address, you understand the
clients and servers and how they work, you take care to deploy,
test, and maintain a good working CRL, and your expectations don't
run away from you, PKI can work fine. Note that the security of
the resulting system, no matter how well designed and deployed, is
strictly limited by the security of the keystores. More secure ==
harder to deploy and maintain, scaling up steeply.

But too many people get carried away, believe PKI will give them a
complete single-signon solution and solve all their authentication
concerns; they come away burnt.

-Bennett

Attachment: _bin
Description: