Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Source Mage Developer Key Signing

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: Wyatt Draggoo <wyatt AT draggoo.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Source Mage Developer Key Signing
  • Date: Wed, 2 Apr 2003 23:32:00 -0800 (PST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IMHO, driver's licenses and passports are merely government
certifications of identity for government purposes only. If somebody
calls themselves something, and they are on IRC, and they use the same key
to sign their emails and they have a registered nick and they have an AIM
account and an email account setup and have a definite online presense,
that is more important to me than if somebody can forge a driver's
license or form of ID. My level of trust of the validity of a signature
is based on the evidence, not some cancnical, easily falsified document.

It is how consistently somebody presents themselves as an individual and
has historically established their pgp identity to their online presence
that the question of "identity" is meaninful in the pgp system.

When we hear of "identity theft" this has to do with the relationship
between the social security number (or equivalent number) with the record
that corresponds to the number which pgp vitually eliminates by putting
the private key into the hands of the individual for their own creation,
and the propagation of their public key in their own hands as well.

With a properly publicized public key and a sufficiently private private
key, signing mistakes are less important. By propagating signing on the
chat room, using identified nicks, using signed emails, and in general,
using the system more and more, each individual chink becomes less and
less important (which is usually not the case with other aspects of
security -- a single broken link in security usually spells disaster). My
point is that if we were to limit signing to driver's license ID checks,
the small number of signatures being limited to that SINGLE method of
establishing identity makes it a less secure system. All it requires is a
driver's license or fake passport to infiltrate the PGP system and fool
everybody. Obviously a diversity of identity methods is needed. The
verification that comes from an online presense using multiple
verification methods -- virtually as well as in-person (the only person
I've met so far is Eric Schabell, and I never asked for his ID or
fingerprint -- what he knew and how he talked was more important than a
forgable ID) -- allows a more thorough and better system of identity
and trust than the standard single-point of failure system that we need
to get away from. Identity means identity -- it doesn't mean having
government sanctioned and enforced ID cards or being physically present.

In all honesty -- it would be insulting if I assumed Wyatt didn't exist or
have an identity just because I hadn't met him in person or seen "proper
ID". Even if somebody else named Wyatt Draggoo came along acting like he
was Wyatt, the fact that Original Wyatt had a different public key would
be the marker, not whether or not the Second Wyatt had proper ID saying
his name was something else. We're also not checking only names -- we
check email addresses and other setups, too, and standard ID says nothing
about who has the correct email address -- in fact probably the best and
only way to confirm an email address IS virtually -- I believe there are
no physical means accessible to the everyday Joe (subpoena doesn't count)
to confirm an email address. Consistent signed use of a certain public
key is orders of magnatude more appropriate than "ID cards" that don't
even mention the email address.

Moreover, if somebody new to pgp has an email address and they decide to
start using it, and they send me a public key and it has their email
address on it -- of course I will sign it even with no history of a
public key assigned to that email address -- the point of the signing is
to prevent intrustion into an already established public key with the
same address and/or identity. if the public key has no
email/identity history to it, there is nothing to steal. The thing to
make sure is that you're sure that the key comes from the address where it
claims to have originated -- in that case, it's probably best to wait for
a bit before signing it until an identity correspondence has been
established to the email address so as to make it even more impossible
that there is a temporary forgery of a certain email address or other
identity system linked to the public key. If somebody's been using their
same key for three months and has been carrying on normal business with
it, signing their messages with it and displaying a consistent identity,
that is, again I repeat myself, better than physically meeting the person
for a day at a keysigning party where you really don't know the person.
The establishment of identity is a slow process of consistent use, not
some one-time "smoking gun identification system" like a federal ID card
that doesn't even establish an association to an online presense.

This is an online community at its core -- physical verification _cannot_
be as good as online verification. It's about as relevent as somebody in
an online community claiming to be somebody that you knew for years in a
physical community -- all the physical tells (birth marks, facial
features, voice) are useles online. All the online tells like signed
emails to even unverified and unsigned keys (who cares what the person's
physical name if you know the person under a different name online using
consistent keys?) won't work if you meet them physically. Probably the
only way that physical verification would help is if while they were
online, they showed you pictures of themselves and their families and you
could see videos of them and how they acted and that was associated to
their virtual digital signatures -- in that case, then the confirmation is
from multiple signatures -- some digital others physical, with them
related to each other. Identity fraud is easiest when you have single
points of attack and canonical identification schemes that can act as the
holy grail. If everybody depended on a single system like that, then you
lose all the benefits of a diversity of identification and signature
systems. If you've read this far, I should remind you that you should
probably be doing something else and you have way too much time on your
hands and get back to work before your boss sees you reading this! It was
mostly redundant anyways and I'm surprised you didn't stop reading after
the second paragraph where my point was explained.

Seth

On Tue, 1 Apr 2003, Wyatt Draggoo wrote:

> > I have setup a channel (not very well, never done that before) for Source
> > Mage developers (and users, if they want) to have a virtual key signing
> > party! This way, we can develop a trust network through GPG, and also to
> > have fun. I will provide virtual cake and virtual punch (if you're
> > allergice to any of the virtual ingredients, I can conjure up something
> > you're not virtually allergic to).
> >
> > Join #smgl-keysigning on irc.freenode.net and have your key signed today!
>
> Not that I'm opposed to key-signing, but isn't the point of a key-signing
> party to physically presesnt some sort of evidence you are who you are? We
> has one at a local LUG where everyone brought their passports and drivers'
> licenses, and each verified the others, and *then* signed their keys.
>
> I'm going to start preparing my virtual passport and license now... :)
>
> Wyatt (1 of 1, that I know of...)
>
> --
> Wyatt Draggoo
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+i+Ny7fQ833vqzH0RArw+AJ9JYyBxCDikYSDcZwYIF99NE6aCAACgm9Fy
GR+ZaAyvvLIF6ZUZsrpzSvg=
=mIoF
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page