3 ms·
A service that measured "credibility" or "activity" of a username/email could be really useful here. At least, it would be a leading indicator that something _m
by mattxxx 3y ago
A service that measured "credibility" or "activity" of a username/email could be really useful here. At least, it would be a leading indicator that something _might_ be up. In particular the aside here about the email addresses are suspect:
https://research.swtch.com/xz-timeline#jia_tan_becomes_maintainer https://research.swtch.com/xz-timeline#jia_tan_becomes_maint...
would be useful info for Lasse Collins before taking the pressure campaign seriously.
- iso8859-1 3y agoWhat about just using 'web of trust', for example with GPG? If the user's key is signed by people that met up with the actual person, it would be much harder to make fake identities.
- ptx 3y agoThere was an article from 2019 [0] that someone on HN linked recently about how "web of trust is dead", but it seems to concern scalability problems with the keyserver, which resulted in DoS attacks, which made them disable the feature by default. The concept should presumably still be good, assuming the issues specific to the GPG keyserver can be avoided. [0] https://inversegravity.net/2019/web-of-trust-dead/ https://inversegravity.net/2019/web-of-trust-dead/
- carols10cents 3y agoWhat would prevent the sock puppet accounts from signing each others' keys?
- iso8859-1 3y agoThey could do that, but you'd be able to see that nobody/few outside their cluster signed any of their keys. Let's say they have fake passports and physically appear at key signing parties. Now you're screwed because even your peers (that you thought know how to validate identities using passports) will get fooled. Read more on GPG's trust levels: https://www.gnupg.org/gph/en/manual/x334.html https://www.gnupg.org/gph/en/manual/x334.html