Pourquoi les intermédiaires de paiements sont amenés à disparaître (et c'est très bien) lorsqu'un réseau permettra l'échange de valeur sans attribuer de confiance préalable :
http://nakamotoinstitute.org/trusted-third-parties/The invocation or assumption in a security protocol design of a "trusted third party" (TTP) or a "trusted computing base" (TCB) controlled by a third party constitutes the introduction of a security hole into that design. The security hole will then need to be plugged by other means.
Les trous de sécurités, c'est eux.
The earliest and most popular of these has been Verisign. It has been able to charge several hundred dollars for end user certificates – far outstripping the few dollars charged (implicitly in the cost of end user software) for the security protocol code itself. The bureaucratic process of applying for and renewing certificates takes up far more time than configuring the SSL options, and the CA's identification process is subject to far greater exposure than the SSL protocol itself. Verisign amassed a stock market valuation in the 10's of billions of U.S. dollars
Les trous dans les frais d'utilisation, c'est eux.
Large numbers of articulate professionals make their living using the skills necessary in TTP organizations. For example, the legions of auditors and lawyers who create and operate traditional control structures and legal protections. They naturally favor security models that assume they must step in and implement the real security. In new areas like e-commerce they favor new business models based on TTPs (e.g. Application Service Providers) rather than taking the time to learn new practices that may threaten their old skills.
Les trous dans les lois pour les protéger, c'est eux.
Currently, security designers usually invoke or assume TTPs to suit the most elegant and secure or least computationally costly security protocol. These naive TTPs are then used in a proof of concept of an overall protocol architecture. But this does not discover the important things that need to be discovered. Once a security protocol is implemented the code itself costs very little, and exponential cost functions such as Moore's law keep reducing computational, bandwidth, and many other technological costs. The costs of the security protocol itself (except for the costs of message rounds, limited by the speed of light, and the costs of the user interface, limited by mental transaction costs) approach zero. By far the largest long-term cost of the system (as we learned with PKI) is the cost of implementing the TTPs.
L'inefficacité des protections (à court ou moyen terme), c'est eux.
Traditional security is costly and risky. Digital security when designed well diminishes dramatically in cost over time. When a protocol designer invokes or assumes a TTP, (s)he is creating the need for a novel organization to try to solve an unsolved security problem via traditional security and control methods. Especially in a digital context these methods require continuing high expenditures by the TTP and the TTP creates a bottleneck which imposes continuing high costs and risks on the end user.
La conclusion.
Ce document existe depuis 2001.