2 ms·
> In other words: you always need to perform OOB identity verification Web-of-trust alleviates that, to some extent.
by remram 3y ago
> In other words: you always need to perform OOB identity verification
Web-of-trust alleviates that, to some extent.
- woodruffw 3y agoThe WoT has been defunct in PGP for over 4 years at this point[1]. It was also never a particularly good solution to this problem, because it (1) was itself largely unauthenticated and blindly trusted by relying parties, much like a normal key directory, and (2) failed to encode what key holding parties were trusted for (the classic example being that I absolutely trust party A to do C for me, but this does not imply that I want to encourage networked party B to trust A for D). And of course the keyserver birthday attacks and DoS, as cherries on top :-) (I think WoTs can solve these problems. But PGP's implementation has been so far the most ambitious tried by a semi-large audience, and it didn't hold up. We need a better starting point.) [1]: https://inversegravity.net/2019/web-of-trust-dead/ https://inversegravity.net/2019/web-of-trust-dead/
- remram 3y agoI agree completely.