4 ms·
A "web of trust" is essentially an extension of the CA "tree of trust". Why can't we have both? Apple can act as iPad users' first WoT node. If a user logs int
by tlrobinson 13y ago
A "web of trust" is essentially an extension of the CA "tree of trust". Why can't we have both?
Apple can act as iPad users' first WoT node. If a user logs into Facebook they immediately add every Facebook friend to their web. etc, etc.
Just because WoTs are currently usability nightmares doesn't mean they have to be forever.
- pixelcort 13y agoIsn't this what Keybase is kind of accomplishing?
- bdamm 13y agoAgreed. Somehow I feel we need to end up on reputation-based nodes of trust that do act as proxies into real-world trust. It must not be like PGP is now, but it does need to be distributed and based on local trust.
- zanny 13y agoAnd you can easily have a web of distrust, in that if one of your more immediate trustees stops trusting a distant branch, you can at least prompt that something is wrong. That way you can avoid the whole "compromise one node and screw everyone over" problem as long as someone realizes the compromise before you trust it.
- clarkm 13y agoCheck out SPKI / SDSI. It has a hybrid model similar to what you described, but unfortunately it never really gained adoption.
- thefreeman 13y agoEven with just that single example the scaleability issue becomes apparent. I would never want to trust all of my Facebook friends with my computer security. And even less so for my friends' friends, etc. And I certainly could be wrong in my understanding, but I believe all it takes is a single malicious (or pressured) actor to ruin that chain. That seems scary to me.