Robot CA at

David Shaw
Tue Dec 10 18:13:02 2002

On Tue, Dec 10, 2002 at 03:07:40PM -0000, wrote:

> The main objection I have to getting any sort of robot or automated gnupg 
> user into the WoT is that the robot is inherently insecure. You have a 
> program that is signing keys on machine connected to the internet, and 
> the passphrase *and* secret key are both stored on the box. I know that 
> not everyone stores their secret key on removable media far from the 
> public internet, but I do think that the great majority of the people 
> in the WoT store their passphrase in memory only.

This is not necessarily true - I wrote a robot which has the same
general concept as the other robots, but does no signing online.  I
wasn't satisfied with including a key on a internet-connected machine,
so the robot code just handles the grunt work and then passes me a
list of keys to sign offline.  That robot, incidentally, is not

I totally agree about storing the key online though.  It would be a
real mess if a CA secret key was stolen.

> I would really like to see all robots and automated scripts kept out 
> of the WoT and continue to assume (hope?) that all signatures inside of the 
> web were performed correctly by actual people. Barring that, I'd like to 
> have an option to the various WoT trace programs that allow certain keys 
> to be excluded. This sounds easier than trying to account for 
> signature levels, which are not reliable anyway, as many have pointed 
> out.

I think we want the same thing, but are going about it differently.  I
want robots and scripts kept out of the web of trust... but if they do
leak in there, I don't want them excluded from the various web mapping
programs.  By that point, the damage is done and they are for better
or for worse part of the web.  Of course, it could be argued that this
would encourage people to sign robot keys, so perhaps it is indeed
better to leave them out.  I don't like that as the mappers will then
show a different web of trust than the real world will.


   David Shaw  |  |  WWW
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson