4 ms·

> USPS staff scans barcode, requests identity documents, performs proofing, and upon approval, the exception flow completes and whatever action you requested pr

> USPS staff scans barcode, requests identity documents, performs proofing, and upon approval, the exception flow completes and whatever action you requested proceeds. In and out in 5 minutes. This is how code signing certificates should work. Better yet, let them be issued with a simple OAuth flow through sites like login.gov where people have already been verified. The current system is the worst of everything. It's a convoluted process with geographically and culturally disconnected people doing verification for (primarily) businesses that don't even need to be tied back to a natural person or beneficial owner. To top it off, it's ridiculously expensive for an individual or open source project. Microsoft also plays a huge role in propping up the currently broken system by trusting EV certificates more than personal certificates even though the identity of a natural person is far more valuable than the identity of a shell company that can easily be used by bad actors. In one way I dislike identity verification systems like this because I think it's going to increasingly disadvantage people that are already less fortunate, but in another way I hope that it can be used to improve some of the terrible processes we have to endure when it comes to identity and trust.

KennyBlanken 3y ago
The reason cert and signing costs are expensive is to discourage random people from signing up for accounts they don't need, or uploading useless apps. This sort of "price people out of being annoying or doing things they don't remotely need" technique is extremely common in society. EV certs involve a pretty lengthy number of checks, by the way. Having a PO box isn't enough.
- donmcronald 3y ago
  I don't have a huge issue with the expense, but I don't think it should be a requirement. I think it should be more of an upgrade. For example, let me get a personal code signing certificate for $50 per year and then treat an organizational cert as an upgrade where I pay $500 to have my business name on the cert. I could even see a case for having $5000+ high value certificates. The problem with that is the way companies like Microsoft handle them. Instead of telling the user "this is a low value cert", they put up a massive warning telling the user their computer is going to melt down if they trust it. It makes the decision of whether or not to run something binary and it's not. I think a system where I could sign things as trivial as PowerShell scripts would be better than what we have now. Anyone I give something like that to is going to know me personally and can easily judge the trustworthiness of what they're running by seeing my name. > This sort of "price people out of being annoying or doing things they don't remotely need" technique is extremely common in society. From what I see, it makes things difficult for someone trying to provide fair value and favors anyone willing to price gouge their customers. Even worse, criminal activity is extremely high margin and industrial scale bad actors have no problem paying for things like EV code signing certificates. > EV certs involve a pretty lengthy number of checks, by the way. Having a PO box isn't enough. And, based on my experience, it's all a big clown show. The people doing the verification are at a huge informational disadvantage because (I'm assuming) they're in a processing somewhere with minimal training and are expected to verify identities for every jurisdiction in the world. It's like me trying to verify the identity of someone in China. No matter how much training you give me, I'm probably never going to be as good at it as a local would be. The whole system could be better. I would prefer to see something where everything starts with a personal code signing certificate for a natural person and where getting an EV certificate requires an attestation from someone with a personal certificate. My identity is more valuable than a shell company. There's no incentive for anyone to fix it either. The platform owners benefit immensely if people abandon a standardized code signing system in favor of the signing certificates they issue for their app stores. IMO that's half the reason Microsoft abused their market position to kill AppGet. Anything that improves competition for app distribution isn't going to be allowed.
  - gopher_space 3y ago
    > The people doing the verification are at a huge informational disadvantage because (I'm assuming) they're in a processing somewhere with minimal training and are expected to verify identities for every jurisdiction in the world. It's like me trying to verify the identity of someone in China. No matter how much training you give me, I'm probably never going to be as good at it as a local would be. The USPS is in an ideal and probably unique position to implement verification. Each office already has a handful of people who know you, personally, by name and location. They could pre-verify a large number of people without collecting or distributing additional info.

KennyBlanken 3y ago

The reason cert and signing costs are expensive is to discourage random people from signing up for accounts they don't need, or uploading useless apps. This sort of "price people out of being annoying or doing things they don't remotely need" technique is extremely common in society. EV certs involve a pretty lengthy number of checks, by the way. Having a PO box isn't enough.

donmcronald 3y ago
I don't have a huge issue with the expense, but I don't think it should be a requirement. I think it should be more of an upgrade. For example, let me get a personal code signing certificate for $50 per year and then treat an organizational cert as an upgrade where I pay $500 to have my business name on the cert. I could even see a case for having $5000+ high value certificates. The problem with that is the way companies like Microsoft handle them. Instead of telling the user "this is a low value cert", they put up a massive warning telling the user their computer is going to melt down if they trust it. It makes the decision of whether or not to run something binary and it's not. I think a system where I could sign things as trivial as PowerShell scripts would be better than what we have now. Anyone I give something like that to is going to know me personally and can easily judge the trustworthiness of what they're running by seeing my name. > This sort of "price people out of being annoying or doing things they don't remotely need" technique is extremely common in society. From what I see, it makes things difficult for someone trying to provide fair value and favors anyone willing to price gouge their customers. Even worse, criminal activity is extremely high margin and industrial scale bad actors have no problem paying for things like EV code signing certificates. > EV certs involve a pretty lengthy number of checks, by the way. Having a PO box isn't enough. And, based on my experience, it's all a big clown show. The people doing the verification are at a huge informational disadvantage because (I'm assuming) they're in a processing somewhere with minimal training and are expected to verify identities for every jurisdiction in the world. It's like me trying to verify the identity of someone in China. No matter how much training you give me, I'm probably never going to be as good at it as a local would be. The whole system could be better. I would prefer to see something where everything starts with a personal code signing certificate for a natural person and where getting an EV certificate requires an attestation from someone with a personal certificate. My identity is more valuable than a shell company. There's no incentive for anyone to fix it either. The platform owners benefit immensely if people abandon a standardized code signing system in favor of the signing certificates they issue for their app stores. IMO that's half the reason Microsoft abused their market position to kill AppGet. Anything that improves competition for app distribution isn't going to be allowed.
- gopher_space 3y ago
  > The people doing the verification are at a huge informational disadvantage because (I'm assuming) they're in a processing somewhere with minimal training and are expected to verify identities for every jurisdiction in the world. It's like me trying to verify the identity of someone in China. No matter how much training you give me, I'm probably never going to be as good at it as a local would be. The USPS is in an ideal and probably unique position to implement verification. Each office already has a handful of people who know you, personally, by name and location. They could pre-verify a large number of people without collecting or distributing additional info.