Re "digital-imprimatur" text -- I am sorry, I could not get through it. The first part of it seems to be boring explanation of basic internet concepts; the seco

Re "digital-imprimatur" text -- I am sorry, I could not get through it. The first part of it seems to be boring explanation of basic internet concepts; the second part seems to be full of wild predictions which do not seem to be coming true (I have been hearing about personal certificates for the web since passport.com introduction in 1999) Re proving to X that you are Y: there is a well known difference between authentication vs authorization that is easy to overlook. In case of domain names, "authentication" roughly means "same entity owns the name", and "authorization" means "I know something about the entity". Having readable domain names is critical to linking things to the real world. For example: - I wrote my email on (paper) new patient form. Doctor now can send me messages and know they will get to me and not someone else. - I was visiting my favorite food store and saw a sign saying "Visit www.LATastyMarket.com for coupons". I can now go to that site and expect to get to the right store. - My friend told me that Ubuntu is a well known organization and does not distribute malware. I can go to ubuntu.com and download software from that site. In all of those cases, I do not care about "Claims by Z to find out facts about Y". The collection of facts about ubuntu.com is useless to me (unless it says "it is that thing you were talking with your friend about yesterday during lunch"). I need an identity -- short string which I can remember and recognize again. If there is a mechanism which prevents typos for high value targets, this is even better. > When you lose control of a private key for your stuff [...] you can have eg Shamir Secret Sharing with 5 other people. You could have part of a backup key derived from a known passphrase or biometrics. Yes I could, but why would I do this? I have seen (and designed) a security process for my work. It is a complex process, with separated servers, restricted privileges, detailed logs, automated alerting. It takes a significant amount of stuff to maintain. I could do the same for my home computer, but it is significant amount of work and time, and I have more interesting ways to spend my time. A human has a limited amount of time in their life. While I can bake my own bread (for example), I buy it from the bakery instead, and spend my time on more interesting things. Same is with security -- I do not want to mess with Shamir Secret Sharing, I am happy to delegate it to someone else. (And do not say "it is easy" or "it just needs a good UI". Storing secrets is inherently hard, and any easy solution is likely insecure)