4 ms·

The problem with a decentralized web of trust isn’t that CAs are too entrenched to be replaced. It’s that there’s no such thing as an alternative decentralized

The problem with a decentralized web of trust isn’t that CAs are too entrenched to be replaced. It’s that there’s no such thing as an alternative decentralized web of trust solution, and no reasonable idea about how one could be created. Amazon reviews work on a decentralized web of trust model, and any PKI attempting to implement one is going to run into exactly the same issues that those have. The trust has to be put somewhere. It’s not realistic to expect the users to validate trust themselves, if you establish an authority to trust, then it can abuse its power, and if anonymous participants can abuse your model, then anonymous participants will abuse your model. All decentralized web of trust models lean towards one of those problem categories. They can be too onerous to be usable (like the original PGP proposal), easily abused, or simply create even more dubious shadow authorities. There is no known PKI model that solves all of those problems at once, and not really any basis for even presuming it’s possible.

Silhouette 6y ago
Just to be clear, the problem I think we're trying to solve with a web of trust is the authentication one, not the encryption one. Several existing systems such as GPG demonstrate the viability of a web of trust solution in principle. What is currently missing is a practical method of scaling up. Yes, any such method would inevitably require a different process to how things work today, most likely including some sort of administrative action to get a new domain recognised when setting up a new site. Still, if you'd suggested seven or even six years ago that anyone would be able to set up effective HTTPS hosting with relatively little effort and without paying for an expensive certificate from some big name CA, you'd probably have been laughed out of the building. Five years ago, Let's Encrypt was starting its rapid rise to dominance, and as the various limitations in the original scheme have been removed, that rise has shown no sign of slowing down.
- bmm6o 6y ago
  Encryption without authentication is meaningless, and it's no accident that https has them so tightly linked. If you can't tell that you are securely communicating with mitm, what's the point?
  - Silhouette 6y ago
    Sorry, I'm not sure what point you're trying to make here. Authentication without encryption is not meaningless, and if you can authenticate then there are multiple possibilities for setting up encryption for the subsequent communication. Tightly linking the two is not necessary, and not necessarily desirable.
- AmericanChopper 6y ago
  The basis of the PGP/GPG approach is in-person key signing. It can only work if you're willing to authenticate somebody's identity with them face-to-face (keep in mind that publishing your public key online is currently only possible because of CAs). The web of trust model is an improvement to this, because it allows you to choose people that you trust to also perform this ritual properly. But to say all you need to do it figure out how to scale this up is a flawed premise. The PKI you choose for the internet needs to work for all internet users. The web of trust model only works for highly motivated and technically competent users, and even then, such a user cannot possibly authenticate all of the identities they need to for typical internet use. They end up with a small group of people they can communicate with more securely. They aren't heading off the google HQ to sign their TLS keys, and if they discover a new web service they want to use, they're not going to hold off on using it until a proper key signing ceremony can take place. Such a system is not fit for the purpose of securing internet communication, and it's not fit for use amongst the majority of web users. Your options for improving those shortcomings is to either create a system that can easily be gamed, by requiring users to trust some sort of community consensus, or to establish trusted authorities (which is just reinventing CAs, and probably in a way that's worse than the current CA system). The web of trust model simply cannot work for this purpose, there's currently no plausible approach for improving it, and it's not obvious that such an approach is even possible.
  - Silhouette 6y ago
    The basis of the PGP/GPG approach is in-person key signing. It can only work if you're willing to authenticate somebody's identity with them face-to-face (keep in mind that publishing your public key online is currently only possible because of CAs). That depends on what you're trying to prove. At the moment, CAs typically accept that someone attempting to create a certificate for a certain domain is the legitimate owner if that person can demonstrate immediate control over something like the content of the website or the DNS. Attempts to enforce stronger verification, such as EV certificates, have largely fallen flat. An equivalent standard would be no worse as the basis for a web of trust system than it is as a basis for major CAs issuing certificates today. The biggest problem with today's CA system isn't that there are trusted authorities, it's that for any given cert there is one and only one ultimate trusted authority and if there are further certs involved then the dependency chain is strictly linear. This creates both gatekeepers and single points of failure. A system where multiple reputable sources could indicate their trust in a certain identity and where authentication was based on looking for multiple trusted paths to verify a claimed identity would address several of the practical weaknesses of our current CA-based infrastructure.

Silhouette 6y ago

Just to be clear, the problem I think we're trying to solve with a web of trust is the authentication one, not the encryption one. Several existing systems such as GPG demonstrate the viability of a web of trust solution in principle. What is currently missing is a practical method of scaling up. Yes, any such method would inevitably require a different process to how things work today, most likely including some sort of administrative action to get a new domain recognised when setting up a new site. Still, if you'd suggested seven or even six years ago that anyone would be able to set up effective HTTPS hosting with relatively little effort and without paying for an expensive certificate from some big name CA, you'd probably have been laughed out of the building. Five years ago, Let's Encrypt was starting its rapid rise to dominance, and as the various limitations in the original scheme have been removed, that rise has shown no sign of slowing down.

bmm6o 6y ago
Encryption without authentication is meaningless, and it's no accident that https has them so tightly linked. If you can't tell that you are securely communicating with mitm, what's the point?
- Silhouette 6y ago
  Sorry, I'm not sure what point you're trying to make here. Authentication without encryption is not meaningless, and if you can authenticate then there are multiple possibilities for setting up encryption for the subsequent communication. Tightly linking the two is not necessary, and not necessarily desirable.
AmericanChopper 6y ago
The basis of the PGP/GPG approach is in-person key signing. It can only work if you're willing to authenticate somebody's identity with them face-to-face (keep in mind that publishing your public key online is currently only possible because of CAs). The web of trust model is an improvement to this, because it allows you to choose people that you trust to also perform this ritual properly. But to say all you need to do it figure out how to scale this up is a flawed premise. The PKI you choose for the internet needs to work for all internet users. The web of trust model only works for highly motivated and technically competent users, and even then, such a user cannot possibly authenticate all of the identities they need to for typical internet use. They end up with a small group of people they can communicate with more securely. They aren't heading off the google HQ to sign their TLS keys, and if they discover a new web service they want to use, they're not going to hold off on using it until a proper key signing ceremony can take place. Such a system is not fit for the purpose of securing internet communication, and it's not fit for use amongst the majority of web users. Your options for improving those shortcomings is to either create a system that can easily be gamed, by requiring users to trust some sort of community consensus, or to establish trusted authorities (which is just reinventing CAs, and probably in a way that's worse than the current CA system). The web of trust model simply cannot work for this purpose, there's currently no plausible approach for improving it, and it's not obvious that such an approach is even possible.
- Silhouette 6y ago
  The basis of the PGP/GPG approach is in-person key signing. It can only work if you're willing to authenticate somebody's identity with them face-to-face (keep in mind that publishing your public key online is currently only possible because of CAs). That depends on what you're trying to prove. At the moment, CAs typically accept that someone attempting to create a certificate for a certain domain is the legitimate owner if that person can demonstrate immediate control over something like the content of the website or the DNS. Attempts to enforce stronger verification, such as EV certificates, have largely fallen flat. An equivalent standard would be no worse as the basis for a web of trust system than it is as a basis for major CAs issuing certificates today. The biggest problem with today's CA system isn't that there are trusted authorities, it's that for any given cert there is one and only one ultimate trusted authority and if there are further certs involved then the dependency chain is strictly linear. This creates both gatekeepers and single points of failure. A system where multiple reputable sources could indicate their trust in a certain identity and where authentication was based on looking for multiple trusted paths to verify a claimed identity would address several of the practical weaknesses of our current CA-based infrastructure.