On Mon, 1 Dec 2003 17:21:03 +1100 Mary Gardiner <[EMAIL PROTECTED]> wrote: > Adding a *trust level* to that key not only means "yes, I trust that > this key really is the digital public key of that person" but "yes, I > trust that any keys signed by this key are signed after the key owner > exercises due caution about people's identities." It's transitive -- I > trust X, and then if X signs Y's key I trust that Y's key is > authenticate *even though I never did the ID check myself*.
It even means more; it should also be taken to mean that X believes Y is competent enough to keep his private key secret. FWIW, I would not evey sign someone's key unless I had known them (not necessarily in RL) for sometime, either directly or by reputation AND had seen much more than a single form of identification. > Therefore, I trust person X's key only when I'm sure X is as paranoid as > me about ID checking. Just seeing X's photo ID doesn't tell me that. > Just because you have certified that key 1024D/77625870 is my public key > by checking my ID and so on doesn't meant that you should trust me to > check other people's ID for you. > > So as far as I can tell, public key signing does nothing to tell me > whether I should trust people to sign other people's keys or not. It > just tells me whether *I* should sign their key. > > FWIW, I don't like the word "trust" being used to describe this > relationship between myself and X -- it's too overloaded and you get the > same thing as you get with LiveJournal "friends lists" -- people taking > it as a mark of "X is a decent person/X is my friend". Yeah, 'trust' like 'security' is a strange word and depends on who's doing what to whom. Also, even with trust metrics like Advogato's (and LiveJournals?) the strength must be enormously reduced even after just a few links. I'm sure we've all heard of the six degree's of separation that links us to ANYONE in the world. Matt -- SLUG - Sydney Linux User's Group - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
