4 ms·

"Hello! I'm Fish!" "Hi. I'm Jesus!" "Wow, Jesus? Nice to meet you, can I have your public key?" I don't trust any of you :)

nhaehnle 13y ago
This highlights a huge problem of the PGP/GPG web of trust: It mostly solves the wrong problem. I don't care whether a Linux kernel release is signed by a guy who has government-issued ID that says "Linus Torvalds" on it. I care whether it is signed by the guy who started the whole thing more than 20 years ago. There would be value in a modified web of trust where, when you receive an e-mail from hipaulshi, you can be certain that it's the same person you replied to on HN. Who cares what her (or his) real name is? In a sense, what you really want for most internet-centric communication is something like certificate pinning. Of course things are different when you're talking about people who you know in person. But for those you don't have to organize key signing parties. And even for people I know in the real world, I would be happy with a solution that just pins the very first public key it sees as long as nothing obviously suspicious is happening. This suffices for 99.9% of use cases. [0] [0] No, this is not sufficient if you know that a government is out to get you. But if it helps to move us into an encryption-by-default setting, it is still a win for the overall ecosystem.
- superuser2 13y ago
  You need authoritative, external real name because without it, all you can conclude is that if you are being MITMed, it's by the same entity MITMed all your other connections with that person. The alternative would be to confirm the fingerprint of the public key out of band, but lots of entities aren't already authenticated to each other (i.e. I can authenticate my best friend but not Amazon) and don't have a safe/practical way to check each other's public keys.
  - nhaehnle 13y ago
    In practice, 99% of use cases do not have to worry about a MitM attack that is successful 100% of the time. The probability of a MitM attack remaining successful for all your interactions (and that's what would be required for it to go undetected) drops exponentially under a lot of (though admittedly not all) attack scenarios. This is exactly the reasoning behind proposals such as TACK. Edited to add: Keep in mind that external verification basically never happens, as much as cryptographers want it to happen. In the real world, you have a choice between no verification at all and a pinning-based verification which is weaker than the theoretical ideal, but makes MitM'ing significantly harder and much more likely to be detected for everybody at no user interface cost.
- deleted 13y ago
  [deleted]

nhaehnle 13y ago

This highlights a huge problem of the PGP/GPG web of trust: It mostly solves the wrong problem. I don't care whether a Linux kernel release is signed by a guy who has government-issued ID that says "Linus Torvalds" on it. I care whether it is signed by the guy who started the whole thing more than 20 years ago. There would be value in a modified web of trust where, when you receive an e-mail from hipaulshi, you can be certain that it's the same person you replied to on HN. Who cares what her (or his) real name is? In a sense, what you really want for most internet-centric communication is something like certificate pinning. Of course things are different when you're talking about people who you know in person. But for those you don't have to organize key signing parties. And even for people I know in the real world, I would be happy with a solution that just pins the very first public key it sees as long as nothing obviously suspicious is happening. This suffices for 99.9% of use cases. [0] [0] No, this is not sufficient if you know that a government is out to get you. But if it helps to move us into an encryption-by-default setting, it is still a win for the overall ecosystem.

superuser2 13y ago
You need authoritative, external real name because without it, all you can conclude is that if you are being MITMed, it's by the same entity MITMed all your other connections with that person. The alternative would be to confirm the fingerprint of the public key out of band, but lots of entities aren't already authenticated to each other (i.e. I can authenticate my best friend but not Amazon) and don't have a safe/practical way to check each other's public keys.
- nhaehnle 13y ago
  In practice, 99% of use cases do not have to worry about a MitM attack that is successful 100% of the time. The probability of a MitM attack remaining successful for all your interactions (and that's what would be required for it to go undetected) drops exponentially under a lot of (though admittedly not all) attack scenarios. This is exactly the reasoning behind proposals such as TACK. Edited to add: Keep in mind that external verification basically never happens, as much as cryptographers want it to happen. In the real world, you have a choice between no verification at all and a pinning-based verification which is weaker than the theoretical ideal, but makes MitM'ing significantly harder and much more likely to be detected for everybody at no user interface cost.
deleted 13y ago
[deleted]