4 ms·

Digital identities are useful insofar as they're (1) binding, and (2) actually easy for others to verify, neither of which is particularly true for PGP (especia

Digital identities are useful insofar as they're (1) binding, and (2) actually easy for others to verify, neither of which is particularly true for PGP (especially given the WoT/strong set's demise). The closest thing to a binding identity in the PGP ecosystem is OpenPGP's "verifying keyserver," which issues a challenge to a submitted PGP key's claimed email address. But that isn't a very strong proof of identity, and it doesn't prevent anybody from claiming to be anybody else in the broader PGP ecosystem.

upofadown 4y ago
These days people tend to have multiple aspects to their identity that they keep separate. You probably want to have a Github identity separate from, say, a social media identity or, say, your legal identity. Verifying such identities is heavily contextual. So a system that lets you generate your own identities in a well standardized way is useful.
- deleted 4y ago
  [deleted]
- gabereiser 4y ago
  This. Because people have their personal identity, their work identity, maybe a corporate identity if they run a company. It's too complex a concept to codify into an Uber-identity.
- wkat4242 4y ago
  This is the problem though, social media and advertising companies try to break this barrier so they can data mine you better. This is why Facebook has a real name policy for example. With the move to federated systems in commercial hands (log in with Facebook, Google etc) this only becomes harder to escape.
- woodruffw 4y ago
  Sure. But none of that requires or even particularly recommends PGP. In one sense it even discourages PGP, since PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key.
  - upofadown 4y ago
    >...PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key. I am quite knowledgeable about PGP but I have no idea what this means.

upofadown 4y ago

These days people tend to have multiple aspects to their identity that they keep separate. You probably want to have a Github identity separate from, say, a social media identity or, say, your legal identity. Verifying such identities is heavily contextual. So a system that lets you generate your own identities in a well standardized way is useful.

deleted 4y ago
[deleted]
gabereiser 4y ago
This. Because people have their personal identity, their work identity, maybe a corporate identity if they run a company. It's too complex a concept to codify into an Uber-identity.
wkat4242 4y ago
This is the problem though, social media and advertising companies try to break this barrier so they can data mine you better. This is why Facebook has a real name policy for example. With the move to federated systems in commercial hands (log in with Facebook, Google etc) this only becomes harder to escape.
woodruffw 4y ago
Sure. But none of that requires or even particularly recommends PGP. In one sense it even discourages PGP, since PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key.
- upofadown 4y ago
  >...PGP's "normal" identity devolution pattern is subkeys bound back to the top-level user key. I am quite knowledgeable about PGP but I have no idea what this means.