[117307] in Cypherpunks
TRUSTe doesn't verify (was Re: Hotmail Accounts Exposed to All)
daemon@ATHENA.MIT.EDU (Robert Hettinga)
Tue Aug 31 10:16:05 1999
Mime-Version: 1.0
Message-Id: <v0421011fb3f184689c55@[204.167.100.181]>
In-Reply-To: <7qf0sa$gum$1@blowfish.isaac.cs.berkeley.edu>
Date: Tue, 31 Aug 1999 09:40:53 -0400
To: daw@cs.berkeley.edu (David Wagner), cypherpunks@cyberpass.net,
cryptography@c2.net, <CYBERIA-L@LISTSERV.AOL.COM>, dcsb@ai.mit.edu
From: Robert Hettinga <rah@shipwright.com>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Reply-To: Robert Hettinga <rah@shipwright.com>
At 3:33 PM -0700 on 8/30/99, David Wagner wrote on cypherpunks:
> 2. Hotmail was certified by the TRUSTe privacy program. I think
> this really demonstrates the limitations of these privacy certification
> programs -- if they will certify a site that has such obvious
> security holes, if they will certify a site that isn't using a
> firewall, if they will certify a site that exposes all their
> user's email to outsiders, who won't they certify?
Right.
Not to put too fine a point on it, but TRUSTe is so much
cryptopolitical (as in cryptofascist), well, bullshit.
Note that EFF, or whoever it is who's promoting TRUSTe, isn't in the
insurance business, it's a lobbying organization. Which is fine, I
guess, if you have to lobby for what you need, but it certainly
doesn't matter a hoot if you're counting on the EFF, or whoever, to
vouch the security of a website.
The moral here, boys and girls, is never to trust *any*
"certification" that doesn't have *money* behind it, and, the more
valuable something is that *anyone* claims to "certify", like
"TRUSTe" seems to be asserting that they do, the more actual *money*
that "certifier", "certification authority", whatever, should be on
the hook for.
I expect that some smart Son of Ralph in the plaintiff bar will make
considerable hay on this with an Alabama jury some day.
(No offense to Alabamians, of course. It's just that Alabama juries
are notorious for astonishingly high damage awards, though Florida's
giving them a, um, run for the money, these days. Particularly in
one Alabamian county, I can't remember which one, which has an
abnormally large, and apparently wealthy, population of plaintiff
attorneys. Sort of the Branson Missouri of the suing class.)
Cheers,
RAH
-----------------
Robert A. Hettinga <mailto: rah@ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
