IETF Logo Mail Archive

Re: pgp signing in van

Ted Lemon <ted.lemon@nominum.com> Sat, 07 September 2013 03:04 UTC

Return-Path: <Ted.Lemon@nominum.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BE9821F9D75 for <ietf@ietfa.amsl.com>; Fri, 6 Sep 2013 20:04:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.588
X-Spam-Level:
X-Spam-Status: No, score=-106.588 tagged_above=-999 required=5 tests=[AWL=0.011, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Da2wb+4Y6ujW for <ietf@ietfa.amsl.com>; Fri, 6 Sep 2013 20:04:21 -0700 (PDT)
Received: from exprod7og116.obsmtp.com (exprod7og116.obsmtp.com [64.18.2.219]) by ietfa.amsl.com (Postfix) with ESMTP id B723421F9D7A for <ietf@ietf.org>; Fri, 6 Sep 2013 20:04:21 -0700 (PDT)
Received: from shell-too.nominum.com ([64.89.228.229]) (using TLSv1) by exprod7ob116.postini.com ([64.18.6.12]) with SMTP ID DSNKUiqXtYxQ+m2K36yfldLWi0m2IokqfLpm@postini.com; Fri, 06 Sep 2013 20:04:21 PDT
Received: from archivist.nominum.com (archivist.nominum.com [64.89.228.108]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by shell-too.nominum.com (Postfix) with ESMTP id 25B291B8184 for <ietf@ietf.org>; Fri, 6 Sep 2013 20:04:21 -0700 (PDT)
Received: from webmail.nominum.com (cas-01.win.nominum.com [64.89.228.131]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "mail.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by archivist.nominum.com (Postfix) with ESMTPS id 099DA19007A; Fri, 6 Sep 2013 20:04:21 -0700 (PDT) (envelope-from Ted.Lemon@nominum.com)
Received: from [10.0.10.40] (192.168.1.10) by CAS-01.WIN.NOMINUM.COM (192.168.1.100) with Microsoft SMTP Server (TLS) id 14.2.318.4; Fri, 6 Sep 2013 20:04:20 -0700
Content-Type: text/plain; charset="windows-1252"
MIME-Version: 1.0 (Mac OS X Mail 7.0 \(1805\))
Subject: Re: pgp signing in van
From: Ted Lemon <ted.lemon@nominum.com>
In-Reply-To: <522A9105.60108@gmail.com>
Date: Fri, 06 Sep 2013 23:04:18 -0400
Content-Transfer-Encoding: quoted-printable
Message-ID: <D2B391D8-B7D9-4A17-BF34-1DAEA2144339@nominum.com>
References: <m2zjrq22wp.wl%randy@psg.com> <2309.1378487864@sandelman.ca> <522A5A45.7020208@isi.edu> <CA2A6416-7168-480A-8CE1-FB1EB6290C77@nominum.com> <522A71A5.6030808@gmail.com> <6DE840CA-2F3D-4AE5-B86A-90B39E07A35F@nominum.com> <CAPv4CP_ySqyEa57jUocVxX6M6DYef=DDdoB+XwmDMt5F9eGn1A@mail.gmail.com> <A6B01C4B-B59A-49FD-9524-D49F85750BF7@nominum.com> <522A9105.60108@gmail.com>
To: Melinda Shore <melinda.shore@gmail.com>
X-Mailer: Apple Mail (2.1805)
X-Originating-IP: [192.168.1.10]
Cc: IETF discussion list <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 07 Sep 2013 03:04:28 -0000

On Sep 6, 2013, at 10:35 PM, Melinda Shore <melinda.shore@gmail.com> wrote:
> I actually don't think that pgp is likely to be particularly
> useful as a "serious" trust mechanism, mostly because of
> issues like this.

It's not at all clear to me that "serious" trust mechanisms should be digital at all.   Be that as it may, we have an existence proof that a web of trust is useful—Facebook, G+ and LinkedIn all operate on a web of trust model, and it works well, and, privacy issues aside, adds a lot of value.   IETF uses an informal web of trust, and it works well.   Most open source projects use informal webs of trust, and they work well.   PGP signing for software distribution works well.

What these mechanisms are not is a web of trust that you could use to authenticate a real estate transaction.   You shouldn't accept them as signatures on legal contracts.   You shouldn't use them to transfer large sums of money to strangers.   But they are definitely useful.

v2.23.0 | Report a Bug | By Email