Robot CA at toehold.com

[Kyle Hasselbacher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Dec 05, 2002 at 05:27:25PM -0500, David Shaw wrote:
>On Thu, Dec 05, 2002 at 04:03:00PM -0600, Kyle Hasselbacher wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> On Thu, Dec 05, 2002 at 09:52:39PM +0100, Volker Gaibler wrote:

>> >But why use encryption at all in that case? Slightly simplified:
>> >If someone can read your unencrypted mail (sysadmin or somebody sniffing
>> >network traffic) - and that's what you want to prevent - also can create
>> >bogus-but-signed keys.
>> 
>> That situation is made no worse by having non-working encryption.
>> Hopefully the user gets a key working BEFORE people start sniffing.  When a
>> doppleganger shows up, hopefully people will notice.  There's some optimism
>> there, I know.
>
>This still doesn't stop the doppelganger.  The postmaster attack lets
>someone get a signed key in addition to the user's signed key.  Then
>there would be two seemingly identical "Alices" on the keyserver.  If
>people do notice, how do they pick from between the two?  ("I'm
>Spartacus!  No, I'm Spartacus!").

If I see a key that's not mine that IS signed by the robot, then I know
that someone else has access to my email.  That's a big improvement over
them reading my mail without me knowing.  The action I can take when I find
out is the same--get another email address.  Without knowing, I take no
action, and the snooping continues.

>> Do you not bother to lock your bicycle when you know there are people with
>> bolt cutters?  Envelopes can be steamed open, but I still use them.  What
>> I'm proposing is "better than nothing".  It is NOT absolute security.  It's
>> merely better than the (terrible) security that's there now.
>
>The thing is, I'm not sure this is actually better than nothing.  Like
>I said in another email, it is certainly better than nothing if you
>can guarantee that everyone in the community uses it (closed
>community), but what change does it actually make in the use of
>encryption outside of a closed community?  What benefits does it give?
>
>At worst, I can accept that it is harmless (except for that false
>sense of security), but if something is harmless and without a real
>benefit, why do it at all?

It brings a benefit to those who use it.  The ones who get their keys
signed by the robot and use the robot's signatures ARE the "closed
community".  People without the robot's signature or who don't trust it do
not get the benefit--just like the people who don't use GnuPG now.

This is just like GnuPG itself--it brings a benefit only to those who use
it.  People with keys are a closed community within the larger set of
people who have email access.

It seems, however, that you would not be a user.  If I've understood you
correctly, your decision is to encrypt to every candidate key you can find
regardless of whether it has been validated.  If you find two keys for an
email address, you prefer ones with more validation (such as the robot's),
but otherwise, you don't care.  Do I have that right?
- -- 
Kyle Hasselbacher
kyle@toehold.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE98PjW10sofiqUxIQRAqSRAKCb6d0v/uWGxxJ7H9mrRPMOGwqTagCg3IzJ
bW00fs+/QN93GZUYLxYwgQE=
=JLS5
-----END PGP SIGNATURE-----