5 ms·
For authenticating multiple users, I wonder if you can do something GPG like where you generate a web of trust?
by qqii 8y ago
For authenticating multiple users, I wonder if you can do something GPG like where you generate a web of trust?
- Arathorn 8y agocurrently we're aiming for a web of trust between your own devices, and then transitively trusting other's devices once you've verified that user. however, a GPG-style web of trust which lets transitive trust span over users is a bit questionable: all it needs is one party to be sloppy with keysigning and the whole things falls apart. It also leaks metadata in terms of who knows who like a sieve. So we're going to see how far we can get without it :)
- rwmj 8y agoI think I mentioned this before, but I think you should allow for the case where all participants in the virtual room physically meet. Think conference, or a meeting on business premises. They should be able to swap keys with each other efficiently, perhaps using NFC, and without having to have O(n^2) interactions. Yes it may not be super-secure but you can assume the security is already taken care of by the physical security of the meeting.
- Arathorn 8y agoyeah, this is a good example where a temporary(?) web-of-trust could work. in retrospect, i think the cross-signing proposal (https://github.com/uhoreg/matrix-doc/blob/cross-signing2/proposals/1756-cross-signing.md https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro...) has some thoughts about how transitive trust between users could work, but i'm failing to find it now. I've raised a bug to track: https://github.com/matrix-org/matrix-doc/issues/1886 https://github.com/matrix-org/matrix-doc/issues/1886 - thanks!