Public SourceMage Discussion List

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

As I was saying before, the fact that your email has consistently said
"Good signature from Geoffrey Derber <Geoffrey.Derber AT Trinity.edu>" is
more important to me than your possession of a passport which doesn't say
that your email address is Geoffrey.Derber AT Trinity.edu or that you go to
Trinity.edu.  Just that somebody named you Geoffrey Derber and you managed
to not change your name to that for some reason.  Nothing stops me from
changing my name to Geoffrey Derber and getting a passport or even forging
a passport (your standard individual would not know how to conform a
passport as true anyways -- I don't know the seals or the materials of a
passport, for example.  The strength of a passport is that it is not legal
to do such falsification -- but that doesn't make it any less difficult to
obtain a fake one or even to fool somebody into thinking that you possess
a valid passport when they have no experience (such as me) dealing with
them.

Sergey's comment that it was an unrealistic request to have multiple
strong signatures was more on the spot than anything else said so far,
IMHO.

For some reason, people here trust emails that aren't even signed!  That
in itself is a hundred times more of a weakness than this debate over
canonical identification verification.  The fact that some random person
can go into the chat room and become a guru with very little involvement
is probably the easiest attack vector.  The theoretical nature of
continued man-in-the-middle attacks and a massive network conspiracy to
masquerade as somebody else is less plausible than somebody infiltrating
from obvious social mechanisms.  If somebody sent an email address as me
and I didn't sign my emails digitally, I would just call them out and say
that they were acting as me, and then the point of the whole ruse would
be over.  I'm not as much a verification nihilist as the mathematicians
who write books on pgp theory, I guess.  In fact, if one is a nominalist,
in the classical sense, then identity (in terms of a label) is only
determined by the grouping/classification of arbitrary commonalities --
most proponents of systems of mathematical verification like pgp rarely
understand this.  I support it as one method among many in a systematic,
decentralized approach to identity and security that presumes that all
systems have flaws and that the prevention of single points of failure is
the most important aspect of robustness.  Clustering, RAID, exception
handling, and distributed systems are all areas in computer science that
have been successful with this philosophy.

Seth

On Wed, 2 Apr 2003, Geoffrey Derber wrote:

> | Not that I'm opposed to key-signing, but isn't the point of a key-signing
> | party to physically presesnt some sort of evidence you are who you
> are?  We
> | has one at a local LUG where everyone brought their passports and drivers'
> | licenses, and each verified the others, and *then* signed their keys.
> |
> That's why when you sign it you indicate how much checking you did, for
> this you could leave it at 0 which is pretty much a 'no comment' answer,
> more appropriate might be a 1, for no checking at all, or if you manage
> to figure out some method for verification, a 2 for casual checking but
> not very rigorous might be appropriate.
>
> The 3 level would be for the passport, drivers license, etc, which we
> would never have.
>
> Geoff
>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> ------------ Output from gpg ------------
> gpg: Signature made Wed Apr  2 06:45:33 2003 PST using DSA key ID 8C55BB9F
> gpg: Good signature from "Geoffrey Derber <Geoffrey.Derber AT Trinity.edu>"
>
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+i+jD7fQ833vqzH0RAp1AAJ0TyjYsq9Yw5mWvMmlForrB7R7rNQCeOQGr
0biS0M7+xJP7fURFWgzHKFA=
=hpsX
-----END PGP SIGNATURE-----