@HerraBRE A single universal "trust score" would indeed be ridiculous or even dangerous.
But say you would like to get the opinion of someone knowledgeable about a subject you are not familiar with. How do you do it? Ask around, right? And the recommendation you may get (if you are lucky) is for a specific subject, today. That might be feasible technically. I recently came across this post which touches the question: https://medium.com/@bblfish/what-are-the-failings-of-pgp-web-of-trust-958e1f62e5b7
@Tryphon I agree we could use a better LinkedIn. 😁
Anyone that takes inspiration from the PGP web-of-trust would do well to seriously reconsider. IMO, obviously.
The PGP web of trust was (is) a very deep, fundamental failure. That article doesn't even scratch the surface of why - quite the opposite, it's largely written from the POV that the underlying concept had merit.
I disagree, I think it's dangerous and harmful.
As a result, I'm deeply sceptical of any derived works.
@HerraBRE Let's say a LinkedIn that does something useful ;-)
I am not familiar with the PGP web of trust, I was mostly intrigued by the other possibilities mentioned.
@Tryphon The PGP WOT's core concept goes like this:
1. I publish claims with my key, e.g. "this key belongs to Bjarni."
2. Others sign these claims to vouch for their truthfulness.
3. You calculate a trustworthiness score for a key by finding paths through the social graph of attestations.
It conflates "This key is safe to use" with "a claim was truthful", with "I convinced people of something", with "I am to be trusted to evaluate others' claims."
These are not sane or safe equivalences.
@Tryphon ... and as a by-product of sustaining this crazy method for validating keys, you create a permanent public record of which people know each other (and due to PGP signing customs, have probably met in person) and when.
Social graphs contain very sensitive information.
No secure system should immutably and publicly leak that kind of information about its users - for many, especially the people who NEED the kind trust the system claims to offer, it's actively dangerous to participate.
@Tryphon That's the two-toot summary of why I hate the PGP WoT. 😁
I hope it's at least marginally interesting!
@HerraBRE very interesting! Thank you for the summary!
@Tryphon You're welcome!
The only guarantee TOFU gives, is "this is the same key as you were communicating with last time" - which is simple enough that people can reason about it, and yet strong enough that it significantly boosts security.
TOFU is an excellent baseline, people who need more can augment it by verifying keys out of band, pinning keys, etc.
Simplicity matters! For code and UX.
Bad UX = mistakes = insecurity.
The security of WKD piggy-backs off TLS and the CA-based trust model of the web.
The WKD promise is "the website at foo.com claims this is the key for email@example.com". That's a good baseline, assuming user is on friendly terms with his domain and website admin.
WKD is great for institutions and organizations, maybe less awesome for Joe Random Activist.
Server run by the main developers of the project It is not focused on any particular niche interest - everyone is welcome as long as you follow our code of conduct!