3 ms·

You wouldn't trust a chain that long with something that sensitive. WOT gives you the ability to have different tiers of trust. If you verified the identity you

You wouldn't trust a chain that long with something that sensitive. WOT gives you the ability to have different tiers of trust. If you verified the identity yourself then you can trust it completely. If you accept people verifiying identities on your behalf then you can choose exactly who you trust (ie. not everyone). It not only makes the delegation explicit, it gives you much more fine grained control about how much you can trust a given identity. I'm not saying WOT solves all of our problems. It only makes it slightly better than verifying every key yourself. But it's better than the CA model because you can make it work for you.

dpark 9y ago
Yeah, web of trust gives me the option to manually decide, every time, if the chain(s) of trust looks "good enough" for me to trust the other party. There are two problems with this: 1. This is a ton of work and a lot of guesswork even for educated individuals. I end up looking at either explicit chains of trust (I trust Bob and he trusts Alice and she says that this is definitely my bank's website) or some random value an algorithm spits out that tries to convey how "trusted" an entity is based on how many paths there are to it and how short they are. In either case, it's a manual decision that will often feel arbitrary. 2. Laypersons are completely fucked. No way my grandmother can reasonably decide who to trust this way. If web of trust ever becomes widespread somehow, I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs because everyone will just look to them in the web of trust and see if one of them vouches for their banking website.
- u801e 9y ago
  > I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs Except that none of those companies bother verifying one's identity if you're not actually paying for their services. > and see if one of them vouches for their banking website. In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with.
  - dpark 9y ago
    > Except that none of those companies bother verifying one's identity if you're not actually paying for their services. I'm sure in this scenario, those companies will be delighted to step fully into the role of CA including accepting money for identity vouching. > In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. No. The same couldn't apply to any company. My primary bank is online only. And how many times have you actually walked into an Amazon office? Or Paypal? Are people in Ohio supposed to fly to San Jose to get Paypal's public key when they create an account? Or are we going to wait for the post office to deliver a physical copy of Paypal's public key (and we'll just trust that whole transaction couldn't be compromised). Physical key exchange is simply not practical in most cases.
    - u801e 9y ago
      It probably could apply to some that I locally deal with. But you're correct in saying that it's not practical for companies that don't have local branches.
  - greenhouse_gas 9y ago
    >In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. You could? Would your grandmother? Would you fly to Mountain View to get Google's? And then turn around and fly to Washington DC to get the IRS's? And then turn around and fly to who knows where to get HN's? And then tell them to keep customer staff ready to assist you to install their public keys? And what about personal blogs that don't want to be MITM?
- cup-of-tea 9y ago
  > Laypersons are completely fucked. No way my grandmother can reasonably decide who to trust this way. Can your grandmother trust you? Or maybe you're not prepared to keep her secure so you just tell her "trust Google, grandma".
  - dpark 9y ago
    No, my grandmother cannot trust me to verify every site she might want to visit. How am I supposed to know if random blog is legit? Or for that matter random bank? The fact that I have to answer this tells me that you haven't though through the implications of web of trust very far.

dpark 9y ago

Yeah, web of trust gives me the option to manually decide, every time, if the chain(s) of trust looks "good enough" for me to trust the other party. There are two problems with this: 1. This is a ton of work and a lot of guesswork even for educated individuals. I end up looking at either explicit chains of trust (I trust Bob and he trusts Alice and she says that this is definitely my bank's website) or some random value an algorithm spits out that tries to convey how "trusted" an entity is based on how many paths there are to it and how short they are. In either case, it's a manual decision that will often feel arbitrary. 2. Laypersons are completely fucked. No way my grandmother can reasonably decide who to trust this way. If web of trust ever becomes widespread somehow, I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs because everyone will just look to them in the web of trust and see if one of them vouches for their banking website.

u801e 9y ago
> I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs Except that none of those companies bother verifying one's identity if you're not actually paying for their services. > and see if one of them vouches for their banking website. In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with.
- dpark 9y ago
  > Except that none of those companies bother verifying one's identity if you're not actually paying for their services. I'm sure in this scenario, those companies will be delighted to step fully into the role of CA including accepting money for identity vouching. > In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. No. The same couldn't apply to any company. My primary bank is online only. And how many times have you actually walked into an Amazon office? Or Paypal? Are people in Ohio supposed to fly to San Jose to get Paypal's public key when they create an account? Or are we going to wait for the post office to deliver a physical copy of Paypal's public key (and we'll just trust that whole transaction couldn't be compromised). Physical key exchange is simply not practical in most cases.
  - u801e 9y ago
    It probably could apply to some that I locally deal with. But you're correct in saying that it's not practical for companies that don't have local branches.
- greenhouse_gas 9y ago
  >In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. You could? Would your grandmother? Would you fly to Mountain View to get Google's? And then turn around and fly to Washington DC to get the IRS's? And then turn around and fly to who knows where to get HN's? And then tell them to keep customer staff ready to assist you to install their public keys? And what about personal blogs that don't want to be MITM?
cup-of-tea 9y ago
> Laypersons are completely fucked. No way my grandmother can reasonably decide who to trust this way. Can your grandmother trust you? Or maybe you're not prepared to keep her secure so you just tell her "trust Google, grandma".
- dpark 9y ago
  No, my grandmother cannot trust me to verify every site she might want to visit. How am I supposed to know if random blog is legit? Or for that matter random bank? The fact that I have to answer this tells me that you haven't though through the implications of web of trust very far.