3 ms·

Similar setup here. Even my ssh key is a subkey of my pgp key. Pgp’s most valuable use case is still establishing a digital identity toehold. The PGP key that

Similar setup here. Even my ssh key is a subkey of my pgp key. Pgp’s most valuable use case is still establishing a digital identity toehold. The PGP key that is used to sign the commit, is also used to SSH to git server, is also used to sign the code review comments, is also used to sign the build binaries. I’m hoping some day there is website authentication integration via passkey or the like.

woodruffw 4y ago
Digital identities are useful insofar as they're (1) binding, and (2) actually easy for others to verify, neither of which is particularly true for PGP (especially given the WoT/strong set's demise). The closest thing to a binding identity in the PGP ecosystem is OpenPGP's "verifying keyserver," which issues a challenge to a submitted PGP key's claimed email address. But that isn't a very strong proof of identity, and it doesn't prevent anybody from claiming to be anybody else in the broader PGP ecosystem.
- upofadown 4y ago
  These days people tend to have multiple aspects to their identity that they keep separate. You probably want to have a Github identity separate from, say, a social media identity or, say, your legal identity. Verifying such identities is heavily contextual. So a system that lets you generate your own identities in a well standardized way is useful.
  - deleted 4y ago
    [deleted]
  - gabereiser 4y ago
    This. Because people have their personal identity, their work identity, maybe a corporate identity if they run a company. It's too complex a concept to codify into an Uber-identity.
  - wkat4242 4y ago
    This is the problem though, social media and advertising companies try to break this barrier so they can data mine you better. This is why Facebook has a real name policy for example. With the move to federated systems in commercial hands (log in with Facebook, Google etc) this only becomes harder to escape.
  - woodruffw 4y ago
    Sure. But none of that requires or even particularly recommends PGP. In one sense it even discourages PGP, since PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key.
    - upofadown 4y ago
      >...PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key. I am quite knowledgeable about PGP but I have no idea what this means.
woile 4y ago
Is there some kind of tutorial as of how to control one's identity with PGP or other tools?

woodruffw 4y ago

Digital identities are useful insofar as they're (1) binding, and (2) actually easy for others to verify, neither of which is particularly true for PGP (especially given the WoT/strong set's demise). The closest thing to a binding identity in the PGP ecosystem is OpenPGP's "verifying keyserver," which issues a challenge to a submitted PGP key's claimed email address. But that isn't a very strong proof of identity, and it doesn't prevent anybody from claiming to be anybody else in the broader PGP ecosystem.

upofadown 4y ago
These days people tend to have multiple aspects to their identity that they keep separate. You probably want to have a Github identity separate from, say, a social media identity or, say, your legal identity. Verifying such identities is heavily contextual. So a system that lets you generate your own identities in a well standardized way is useful.
- deleted 4y ago
  [deleted]
- gabereiser 4y ago
  This. Because people have their personal identity, their work identity, maybe a corporate identity if they run a company. It's too complex a concept to codify into an Uber-identity.
- wkat4242 4y ago
  This is the problem though, social media and advertising companies try to break this barrier so they can data mine you better. This is why Facebook has a real name policy for example. With the move to federated systems in commercial hands (log in with Facebook, Google etc) this only becomes harder to escape.
- woodruffw 4y ago
  Sure. But none of that requires or even particularly recommends PGP. In one sense it even discourages PGP, since PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key.
  - upofadown 4y ago
    >...PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key. I am quite knowledgeable about PGP but I have no idea what this means.

woile 4y ago

Is there some kind of tutorial as of how to control one's identity with PGP or other tools?