The Many Faces of Identity
summary
Claim: blockchain only replaces certificate authorities for one tiny function—storing a name-to-key binding—but it fails to fix DNS lookups, phishing from search results, key loss or revocation, UX of passwords and biometrics, or the fact browsers ship trusting ~500 CAs. Demonstrates how X.509’s name encodings and unused DNSSEC name constraints break real verification, explains CRL/OCSP revocation needs, criticizes 90-day expiration policies, and shows that a public ledger alone doesn’t solve human or deployment problems.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:46What is "identity"?
- 1:56Names
- 7:47DNS name
- 13:23User authentication
- 18:18PKI: Public Key Infrastructure
- 20:01Standards
- 24:58Trust models for PKI
- 39:45Certificate expiration rant
- 41:55Blockchain to the rescue?
- 47:09Final rant
- 49:24Outro
related talks
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
43mSelf Sovereign Identity
56mIoT: Taking PKI Where No PKI Has Gone Before
41mVerifiable Credentials and the Future of Enterprise Security
17mIs Blockchain The Solution For The Digital Identity Hurdle?
40mIdentity Resilience: What Doesn’t Kill You Makes You Stronger
27mAddressing the growing threat of non-human identities with PKI
13mThe humanized internet