Re: [saag] Direct trust between users

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Apr 26, 2019 at 4:42 AM Ben Laurie <[e-mail]> wrote:

>
>
> On Wed, 24 Apr 2019 at 18:57, Phillip Hallam-Baker <[e-mail]>
> wrote:
>
>> Nico asked about the Mesh Trust model and I said that I was trying to
>> avoid imposing one. I do have metrics for measuring the quality of trust
>> established in terms of a work factor however:
>>
>> http://mathmesh.com/Documents/draft-hallambaker-mesh-trust.html
>>
>> This is not a computational work factor as we are used to. It is a social
>> work factor nominally denominated in currency (USD) and bounded in time.
>>
>> Let us say that we did some key signing even open to IETF meeting
>> attendees only. It would cost an attacker $325 plus travel minimum to
>> impersonate me. Not an impossible sum if they really really want to
>> impersonate me but enough to stop a large number of attacks. Furthermore,
>> there is a significant risk of being caught if they attempt the
>> impersonation on any large scale. So the social work factor might be $1000.
>>
>
> Presumably $1,000 buys more than one impersonation, and of anyone you want
> (there's no list of who was actually at IETF, AFAIK).
>

The design of VeriSign Class 3 was intended to mitigate the risk of
impersonation by making it unprofitable for the attacker. In particular it
was intended to make crime impractical for repeat offenders.

So the first step in the chain was to make it so that a party has to commit
a crime to obtain a fraudulent certificate. The next was to limit the
validity so that they had a narrow window of opportunity to make a return.
So if they paid $300 for the cert, they would have to make that back in
five days to turn a profit. Not impossible but requires them to make some
effort and that adds cost.

But even if they get away with a profit of $5K per time, that isn't going
to last them long. So they have to do it again and register/impersonate
another company etc. etc. And they will probably go about it the same way
so that they begin to establish a pattern of behavior. And each time they
do it, they are committing more crimes in the registration process. So they
are either repeat offenders in one jurisdiction increasing the probability
of being investigated or they are offending in multiple jurisdictions
increasing the probability of being investigated.

So yes, the work factor isn't insurmountable but it isn't zero either. Carl
Ellison's point about ceremony may be relevant here.

Lets say that the attacker attempts to register themselves multiple times.
We could defeat that by binding the assertion to their conference
registration number. Perhaps we print the QR code or a part of it on their
badge and it can only be used once. Perhaps we also require validation to
the email address they registered for the conference.

At the end of the day, the data is dumped into a blockchain and so we have
a tool that allows us to roll back attacks after the event. Which is why I
did not suggest taking pictures of the person registering.