Re: [p2p-hackers] ease of use in a decentralized communication system

[Sean Lynch]

K.S.Sreeram wrote: Bill Cox wrote: Well, if you already have a DHT running, why not allow users to publish their public keys using their e-mail address as the key? How do you prevent somebody else from using *your* email address? And it is very difficult for the DHT to validate an email address. This could actually turn out to be a big security issue. I've given the idea of a decentralized directory a lot of thought, because I think the DNS is the real achilles heel of the Internet. The best way I've come up with is to throw out the idea of uniqueness and concentrate on eliminating the need for users to enter keys by hand. Use some form of human-comparable authenticator like bubblebabble etc that can easily be read off over the phone or printed on a business card. Also, there's no need to send entire public keys via email or IM, you just need a secure hash. That then becomes a self-authenticating name that you can look up in the DHT. I really don't think you can get better than this solution with a truly decentralized directory. Anything easier would require relying on an existing centralized scheme like DNS or PKI. BTW, I've been thinking about something exactly like this for a decentralized social networking/blogging/chat/social browsing system. I have a couple other ideas I want to implement first, though. Feel free to contact me if you want ideas to steal.

signature.asc
Description: OpenPGP digital signature

_______________________________________________
p2p-hackers mailing list
[EMAIL PROTECTED]
http://lists.zooko.com/mailman/listinfo/p2p-hackers