4 ms·

>If I have something I want to communicate to Bob what matters is his identity not really anything else. But how do you know that Bob exists and you want to ta

>If I have something I want to communicate to Bob what matters is his identity not really anything else. But how do you know that Bob exists and you want to talk to him? At some point you met someone named Bob and at some point you decided you wanted to communicate with him, but Bob as an identity really only exists in your head. He could be named Jim, he could be someone that is pretending to be Bob, Bob might be one of two twins both named Bob. Maybe Bob is working for your enemies. One way to simplify the thorny issue of identity is to look at what someone wants out of the communication. The part of the identity Bob that matters to a communication is the expected utility of the communication. The identity is merely an end to that utility. For instance when you call tech support, you are trying to solve a problem and it doesn't really matter if the person tells you their name is Jim rather than James. The only hard and fast identity is cryptographic identity, it can be compromised if someone shares their secret key, but at least you know that you are communicating with someone that has access to that secret key. That is, I can send to a message to all parties with access to the secret key, SK0. The next question is how do I know that parties which have access to SK0 will increase my utility via communication. That can only be built from past actions either directly or indirectly performed by that party. Utility of identity depends on reputation of identity. Reputation of identity depends on past actions of identity (think stackoverflow/hackernews/silkroad). All of which can be cryptographically proved if the identity consists merely of access to SK0. Note, this is how identity and trust works outside of computers.

stinkytaco 13y ago
OK, I see where you are going. Using crypto and web-of-trust as an identity system is really using it as a reputation system. I would point out, however, that the cryptographic identity is not a "hard and fast identity", at least not in a way that's useful. As you point out, I've met Bob, I trust Bob and Bob's an old friend. I know Bob's cryptographic identity, but I also know that identity could be compromised at any time. However, if I know Bob I'm much more likely to realize that. The reputation system tied to that identity could also be compromised, the difference is I'm much less likely to find out until it's too late and the potential harm to me is very high (lets say the government is operating a Silk Road honeypot). That brings us back around to the problem of identity. If I know and trust Bob then his utility is higher. Which is the point of the "web of trust", it (sort of) builds that utility system in. I personally know Bob and know he's pretty sharp. He knows Jim and has signed Jim's key, but I don't know Jim and I'm taking Bob's word for his identity. Jim knows someone as well and has signed their key, but now we're getting pretty far removed from Bob. Their utility (in this case their utility at confirming identities) is getting smaller for me. I'm less inclined to trust them. But Bob, Bob's an old friend. So I see where you're going, but I still think "identity" is the critical factor.
- EthanHeilman 13y ago
  >So I see where you're going, but I still think "identity" is the critical factor. Agreed. So how do we live in such a world and make decisions? Do you trust Bobs ability to protect his key? Can you buy insurance against this given Bobs reputation? Are the premiums worth the cost?

stinkytaco 13y ago

OK, I see where you are going. Using crypto and web-of-trust as an identity system is really using it as a reputation system. I would point out, however, that the cryptographic identity is not a "hard and fast identity", at least not in a way that's useful. As you point out, I've met Bob, I trust Bob and Bob's an old friend. I know Bob's cryptographic identity, but I also know that identity could be compromised at any time. However, if I know Bob I'm much more likely to realize that. The reputation system tied to that identity could also be compromised, the difference is I'm much less likely to find out until it's too late and the potential harm to me is very high (lets say the government is operating a Silk Road honeypot). That brings us back around to the problem of identity. If I know and trust Bob then his utility is higher. Which is the point of the "web of trust", it (sort of) builds that utility system in. I personally know Bob and know he's pretty sharp. He knows Jim and has signed Jim's key, but I don't know Jim and I'm taking Bob's word for his identity. Jim knows someone as well and has signed their key, but now we're getting pretty far removed from Bob. Their utility (in this case their utility at confirming identities) is getting smaller for me. I'm less inclined to trust them. But Bob, Bob's an old friend. So I see where you're going, but I still think "identity" is the critical factor.

EthanHeilman 13y ago
>So I see where you're going, but I still think "identity" is the critical factor. Agreed. So how do we live in such a world and make decisions? Do you trust Bobs ability to protect his key? Can you buy insurance against this given Bobs reputation? Are the premiums worth the cost?