3 ms·

This would all be good once trust is established. FB would basically become a large keyserver that people already use, with an exposed API. That's a good though

This would all be good once trust is established. FB would basically become a large keyserver that people already use, with an exposed API. That's a good thought. But I would still need to verify the trust in person. Otherwise, Facebook could be the MITM. Which is, of course, the problem with the web of trust concept being exposed to the world at large. Too many people would simply establish trust for the expediency. I can see someone in my high school class signing my key and thus expecting me to do the same, without any understanding of the point of the whole business. If Facebook has shown us anything, it's that interpersonal concepts (like "friend") can be easily eroded.

jiggy2011 13y ago
Yes, you would still have to trust FB to a degree , especially in the initial phase and they would still be serving the code that did all of the crypto so you have issues there. Once the trust was established though, especially with OTR it would be more difficult for them to later start abusing it. But it's still an improvement on FB having everything on their server under their complete control, if they starting messing with keys people would notice. There could be a problem with people just signing any old key, but really you just need to verify that the person is who they say they are. I think that works 90% of the time on FB as it is, it's unlikely you'd get away with being an imposter.
- jlgaddis 13y ago
  > Yes, you would still have to trust FB to a degree Lots of people trusted Hushmail "to a degree" and we saw how that turned out...