Verisign to run National RFID Directory

JamesD_UK writes "Verisign has been given the contract to develop a national RFID directory by EPCGlobal. Under the directory scheme each company will maintain an Object Name Service analogous to DNS with Verisign running the root server. Verisign has already setup the infrastructure at six different global sites."

Re:Verisign & code signing

[BenBenBen]

One of the grand-daddy certs expired. [theregister.co.uk] Screwed everything from websites to Norton Antivirus

Re:Verisign & code signing

[PaschalNee]

Seek [google.ie] and ye shall receive [slashdot.org]

As much as I hate VeriSign...

[Shoten]

I have to say that they've proven that they're a good choice for this. Keep in mind what the #1 priority is for maintaining TLDs, particularly the big ones (.com, .net, .org) that Network Solutions/VeriSign handled for most of their lives. VeriSign's idiocy and abuse with regards to non-existent domain handling and misleading 'renewal' notices are despicable for sure, but while all that was going on, they also kept things up and running quite well, even weathering out the largest DDoS on record without going down.

Re:Verisign & code signing

[jrumney]

Yes, but isn't it Microsoft's job to renew their certificate with Verisign?

Microsoft's certificate wasn't expired. The problem stems from the fact that Verisign sign third party certificates with a certificate which has an expiry date (for safety, to limit the effects in the unlikely event that the private key is stolen from the secure facility it is kept in). The Verisign certificate is not part of the server certificate (otherwise people could make their own "Verisign" certs), it is distributed with tools and browsers etc.

Now a few years ago, Verisign realised that one of their Root Certificates was about to reach the point where it would expire within the lifetime of the certificates they were issuing. The sensible thing to do would be to create a new Root Certificate, and start using that, but then everyone using existing browsers and other tools would need to install the new certificate to continue working smoothly. Instead, they decided to extend the expiry date of the existing certificate, and reissue it. This meant that existing tools could keep working for a while without installing new certificates, and as newer updates replaced them, the new certificates would filter through.

The problem with this approach is that people became complacent and it was just delaying the problem. Some certificate stores ended up with both new and old certificates, and bugs in software (some MS software from what I've heard) meant that the old certificate was still being used, the new one was ignored. Other software (Java) continued being released with the old certificate and noone noticed until about a month ago. And then there's all the installations of Netscape Enterprise Server, Netscape 4.7, even IE 4 and 5.0 that are still out there with old certificates.

Re:Too much control by one company?

[TopShelf]

Sounds like you need to crawl back under a rock and hide from the future, then!

EPC is simply a reference for finding the producer of a given item - you pick up an RFID tag with the appropriate data, it refers you to Gillette, where you can use more specific information to find that it's a case of Mach 3 razor blades, shipped from such-and-such warehouse on such-and-such date. What exactly are you afraid of???

It disappoints me to see how many supposedly tech-savvy readers around here react with such fear...

WoW, its incredible to find...

[0nl00ker]

...so many 'technical people', so little real understanding. To the peeps who think RFID is 1984 "20 yrs late" - you are soo joking, give this technology another 10yrs minimum Before it gets anywhere NEAR the kind o0f FUD I'm seeing on this thread. Even more to the point, Y oh Y do people seem to swallow the Corporate-bilge when it suits their paranoia??? Figure it out - more importantly, do some reading, I work with RFID and half of what I read on this thread is applicable only in a SciFi novel. Ho hum.

who makes these decisions?

[__aaitqo8496]

who makes these decisions? given verisign's past, what novice decided this would be best? how about we start polling the slashdot community, or at very least, asking someone with some computer expertise. .com, .net, and RFID. what next?

Re:ASN.1 vulnerabilities?

[jan de bont]

Uh, No, not ASN like at all. RFID tags respond with EPC codes. Once you read the EPC, you take it to the ONS (Object Naming System). The EPC has a header (fixed length), Manufacturer Code (fixed length), product code (fixed), and a serial number. The ONS works by taking the Manufacuring Code ONLY and going to a "root" ONS server. This points at that manufacturer's ONS... which is then queried to see what the product code means, is that serial number valid and if so for what object, etc. Verisign is running the ROOT only... no walking trees, no ASN vulnerabilities.

Re:Verisign & code signing

[Reziac]

I remember a few years ago, when everyone not using the Very Latest Browser[tm] had to go fetch and install some new certificates. It wasn't too much of a big deal, just follow-link, click-OK a few times, done. Any reason Verisign can't do this again??