4 ms·

There's no other model than the web-of-trust. And it didn't fail because it's hard to grap (it's really not), it failed because a) almost no one needs it and b)

by tinco 12y ago

There's no other model than the web-of-trust. And it didn't fail because it's hard to grap (it's really not), it failed because a) almost no one needs it and b) the tech is hard to use. Imagining a world where the web-of-trust was succesful is not hard. It starts with everyone using Outlook instead of gmail. Then imagine Outlook having PGP support builtin. Then imagine in the contacts list, every contact was marked with a color, red, yellow green. Whenever sending an e-mail to a red contact, Outlook would display a small one liner on top of the compose box "There is no identity information about the contact you are sending an e-mail to". (it doesn't matter that no one knows what that means, it's just a small nag that people understand is negative) Whenever sending an e-mail to a yellow contact, Outlook would display the following nag line: "You have not verified the identity of the contact you're sending an e-mail to. Click here to resolve". When the user clicks the line, they'll be asked to call the contact on the phone, or meet with them in person and ask them to compare keys. (Perhaps aided with some fancy tech like NFC or whatever) Will people ignore the nag line? Yes. Will people click through the dialogs to resolve the nag line without actually verifying? Yes. Does that matter? Not as much as crypto-purists would have you believe. There's always that uncle, niece or colleague that's going to be anal about it anyway. And if the web of trust is big enough, and the devices enabling the web are communicating, it will be very easy for the web to self-heal whenever corruption arises. Just imagine if whenever someone who purports to be your aunt sends you an e-mail, and your e-mail client automatically checks the key with everyone elses in your family. The only reason the web-of-trust doesn't work is because it was never adopted and made usable by the important software developers. And that never happened because not enough people cared.

rictic 12y ago
At the risk of being inappropriately snarky, to someone who is somewhat skeptical of WoT-based proposals, this reads like: Step 1: the UI will be a mixture of meaningless and annoying to users, causing them to ignore and misuse it Step 2: mumble mumble... self-healing corruption Step 3: the only reason this hasn't succeeded is that people didn't care enough It's exactly those parts in step 2 where I've historically fallen off of the WoT story. What does the UI do when my nontechnical friend has marked my key but his dad has marked it as untrusted? What happens when I lose my phone with my keys on it? How do we not end up in a situation where users see big scary warnings all the time constantly and they just learn to ignore them?
- stormbrew 12y ago
  I think part of the problem that the OP is sort of addressing is that we've spent so much time trying to gloss over the first-line failures of PGP, in terms of even getting a key to begin with let alone giving it to other people, that we don't even know if there are practical solutions to the problems you're listing. Every tool in this space suffers from the choices PGP implementations have made and asking what your uncle would do if trust conflicts occured when he's going to first be asked if he wants an RSA/RSA, RSA/DSA, DSA sign-only, or RSA sign-only key before he gets there, and then have to figure out what keyserver to send to and then.... Answering these high level UX questions requires having actual users.
  - XorNot 12y ago
    Frankly, red/yellow/green is an excellent solution. Do I care now? No. Do I care when the secrecy is important? Maybe I'll not send things to non-green users.
- tinco 12y ago
  It's not a pitch for implementing WoT. It's a thought experiment to show that it could be viable. It won't make anyone happier if that's what you want, security never made any UI more pleasant. The system might send you an e-mail if someone casts doubt over the trustworthiness of a key. If you lose your phone with your keys, they're gone, just like when you lose your keys. I never said big scary warnings. Just small reminders that what's happening isn't secure, like the green bar in your browser. Most of the time harmless, but informative when you need it.
wtbob 12y ago
> There's no other model than the web-of-trust. SPKI & SDSI had a different model: rather than trust people to tell you who someone is, one trusts them to tell you who they think they are. That is, rather than me verifying that key 0xDEADBEEF belongs to the individual known to the town council of Lower Shroppington as 'William Morris' (which is inherently fragile: I may not be an expert at verifying identity documents, or at verifying those issued by Lower Shroppington; the individual before me might have a document issued by Lower Shroppington deliberately to mislead me; heck, who is the real William Morris: there could be more than one), I would just verify that this is the individual I call William Morris, and let you make use of that as you may. If Lower Shroppington wanted to, they could issue a certificate stating that they call him William Morris too. It was a really smart way of doing things. How might it fit into a modern email infrastructure? Easy! example.com could use key 0xBADDA451 use certify that foo@example.com belongs to the keyholder of the key 0xC0FFEEBA; .com could use key 0xFEEDBAC7 to certify that example.com belongs to 0xBADDA451; the root domain could use key 0x55378008 to certify that .com belongs to 0xFEEDBAC7; IANA could certify the ownership of the root domain; the ICANN board could certify the current IANA key; the previous ICANN board could certify the current ICANN board, and so forth. What would you see in Outlook or Gmail? Your agent would display that the claimed sender email is valid. It might also try to find some path connecting you & good ol' Bill Morris, then show you that your buddy Steve's ex girlfriend Wilhelmina says that key belongs to Billy Morris. Interestingly, this could even work for an email legitimately sent on William's behalf. All a normal user would care about is, 'this email is legit' (for some value of); us geeks could geek out as we wished.
- tinco 12y ago
  So that's the authority model, or the 'tree-of-trust'. In a good trust model I think it can't be more than just a weighting or advisement over your web-of-trust, never your sole source of trust. In the end a tree-of-trust rests on the fact that you trust the manufacturer of your laptop that they put trustworthy certificates there so you could verify the roots. We're seeing the major browsers now turning that tree-of-trust into a web-of-trust by cross referencing domain certificates to see if there are duplicates or other shady things going on.

by tinco 12y ago

rictic 12y ago

At the risk of being inappropriately snarky, to someone who is somewhat skeptical of WoT-based proposals, this reads like: Step 1: the UI will be a mixture of meaningless and annoying to users, causing them to ignore and misuse it Step 2: mumble mumble... self-healing corruption Step 3: the only reason this hasn't succeeded is that people didn't care enough It's exactly those parts in step 2 where I've historically fallen off of the WoT story. What does the UI do when my nontechnical friend has marked my key but his dad has marked it as untrusted? What happens when I lose my phone with my keys on it? How do we not end up in a situation where users see big scary warnings all the time constantly and they just learn to ignore them?

stormbrew 12y ago
I think part of the problem that the OP is sort of addressing is that we've spent so much time trying to gloss over the first-line failures of PGP, in terms of even getting a key to begin with let alone giving it to other people, that we don't even know if there are practical solutions to the problems you're listing. Every tool in this space suffers from the choices PGP implementations have made and asking what your uncle would do if trust conflicts occured when he's going to first be asked if he wants an RSA/RSA, RSA/DSA, DSA sign-only, or RSA sign-only key before he gets there, and then have to figure out what keyserver to send to and then.... Answering these high level UX questions requires having actual users.
- XorNot 12y ago
  Frankly, red/yellow/green is an excellent solution. Do I care now? No. Do I care when the secrecy is important? Maybe I'll not send things to non-green users.
tinco 12y ago
It's not a pitch for implementing WoT. It's a thought experiment to show that it could be viable. It won't make anyone happier if that's what you want, security never made any UI more pleasant. The system might send you an e-mail if someone casts doubt over the trustworthiness of a key. If you lose your phone with your keys, they're gone, just like when you lose your keys. I never said big scary warnings. Just small reminders that what's happening isn't secure, like the green bar in your browser. Most of the time harmless, but informative when you need it.

wtbob 12y ago

> There's no other model than the web-of-trust. SPKI & SDSI had a different model: rather than trust people to tell you who someone is, one trusts them to tell you who they think they are. That is, rather than me verifying that key 0xDEADBEEF belongs to the individual known to the town council of Lower Shroppington as 'William Morris' (which is inherently fragile: I may not be an expert at verifying identity documents, or at verifying those issued by Lower Shroppington; the individual before me might have a document issued by Lower Shroppington deliberately to mislead me; heck, who is the real William Morris: there could be more than one), I would just verify that this is the individual I call William Morris, and let you make use of that as you may. If Lower Shroppington wanted to, they could issue a certificate stating that they call him William Morris too. It was a really smart way of doing things. How might it fit into a modern email infrastructure? Easy! example.com could use key 0xBADDA451 use certify that foo@example.com belongs to the keyholder of the key 0xC0FFEEBA; .com could use key 0xFEEDBAC7 to certify that example.com belongs to 0xBADDA451; the root domain could use key 0x55378008 to certify that .com belongs to 0xFEEDBAC7; IANA could certify the ownership of the root domain; the ICANN board could certify the current IANA key; the previous ICANN board could certify the current ICANN board, and so forth. What would you see in Outlook or Gmail? Your agent would display that the claimed sender email is valid. It might also try to find some path connecting you & good ol' Bill Morris, then show you that your buddy Steve's ex girlfriend Wilhelmina says that key belongs to Billy Morris. Interestingly, this could even work for an email legitimately sent on William's behalf. All a normal user would care about is, 'this email is legit' (for some value of); us geeks could geek out as we wished.

tinco 12y ago
So that's the authority model, or the 'tree-of-trust'. In a good trust model I think it can't be more than just a weighting or advisement over your web-of-trust, never your sole source of trust. In the end a tree-of-trust rests on the fact that you trust the manufacturer of your laptop that they put trustworthy certificates there so you could verify the roots. We're seeing the major browsers now turning that tree-of-trust into a web-of-trust by cross referencing domain certificates to see if there are duplicates or other shady things going on.