[cap-talk] Firefox breaks the principle of identifiability

[Jed at Webstart]

At 06:54 PM 2/7/2005, Ben Laurie wrote:
>Tyler Close wrote:
>>Petnames solve this problem by eliminating the name conflation. A
>>separate namespace is used to identify trust relationships. This
>>namespace is managed solely by the user's browser, thus eliminating the
>>potential attacker from the name recognition process. That's how the
>>petname toolbar solves the phishing problem, both in theory and in
>>practice.
>
>So how, in this system, does the user come to trust Paypal (as opposed to 
>someone pretending to be Paypal)?

If I'm understanding the discussion so far, I think the answer is that
the issue of trust is separate from the issue of identity.  When the
Petname is set up, the name "Paypal" is bound to an identity.  Any
trust is independent of that identity.  In an effort to pretend to
be Paypal, "someone" would have to establish another identity.  Of
course the identity Paypal is already taken.  Whatever identity
the user set up for this someone, it would be different from "Paypal".
This seems to make "trying to pretend" inherently difficult.  What
would induce a user to use a Petname like Paypa1 that could
be easily confused with Paypal?

How much the user chooses to trust either the Paypal identity/Petname
or this other non-Paypal identity/Petname is of course up to the
user with input from others such as friends, authorities, etc.

I hope I'm close to the base issue.

--Jed http://www.webstart.com/jed/