2 ms·

Web of Trust failed because it lacked motivating reasons to use it, and had a very weird idea about how trust is represented (i.e. the idea of partial trust key

by XorNot 3y ago

Web of Trust failed because it lacked motivating reasons to use it, and had a very weird idea about how trust is represented (i.e. the idea of partial trust keys meaning... What exactly?) What was missing was a role/application based idea of trust chains. i.e. what I trust to do my banking is quite different to what I trust for software reputation. Because ultimately we're operating a web of trust system now on the internet, it's just informally specified.

woodruffw 3y ago
> Web of Trust failed because it lacked motivating reasons to use it, and had a very weird idea about how trust is represented (i.e. the idea of partial trust keys meaning... What exactly?) This is true, but it's also just one among several reasons that the PGP WoT failed. Some are purely implementation and design failures that wouldn't imply to a better scheme than PGP, but others are still intractable in the general case (like timely revocations and "strong set" maintenance). > Because ultimately we're operating a web of trust system now on the internet, it's just informally specified. Could you elaborate on what you mean by this? The trust scheme that the modern web is built on is a well-specified hierarchical PKI, i.e. the exact opposite of a web of trust. But it's possible I'm misunderstanding what you mean.
taeric 3y ago
I don't know that I agree with this framing. Pgp could support multiple keyrings, for one. Bigger, though, is that the internet isn't a web of trust in the same vein? Take out the CA chain, and websites fail trust pretty hard. Even adding them, we wind up accepting certificate pinning on browsers, as nobody has a better option, yet. And that is building trust to web sites. The stick houses we have to trust communication is basically, "you always call us." Edit: forgot to say that partial trust is pretty close to "believed, but I wouldn't bank with this identity."

by XorNot 3y ago

woodruffw 3y ago

> Web of Trust failed because it lacked motivating reasons to use it, and had a very weird idea about how trust is represented (i.e. the idea of partial trust keys meaning... What exactly?) This is true, but it's also just one among several reasons that the PGP WoT failed. Some are purely implementation and design failures that wouldn't imply to a better scheme than PGP, but others are still intractable in the general case (like timely revocations and "strong set" maintenance). > Because ultimately we're operating a web of trust system now on the internet, it's just informally specified. Could you elaborate on what you mean by this? The trust scheme that the modern web is built on is a well-specified hierarchical PKI, i.e. the exact opposite of a web of trust. But it's possible I'm misunderstanding what you mean.

taeric 3y ago

I don't know that I agree with this framing. Pgp could support multiple keyrings, for one. Bigger, though, is that the internet isn't a web of trust in the same vein? Take out the CA chain, and websites fail trust pretty hard. Even adding them, we wind up accepting certificate pinning on browsers, as nobody has a better option, yet. And that is building trust to web sites. The stick houses we have to trust communication is basically, "you always call us." Edit: forgot to say that partial trust is pretty close to "believed, but I wouldn't bank with this identity."