key-signing for pseudonyms

[Thomas Sjögren]

On Sun, May 16, 2004 at 06:35:18PM -0400, Atom 'Smasher' wrote:
> so, if i'm at a conference and i want to exchange key signatures with
> people, i can prove that i currently control this email address and key by
> sending some secrets back and forth.... not a problem... but if i want to
> "prove" that i'm atom smasher...?? that could be tough....

maybe the only solution is then to try to organize av physical web of
trust; i know X, X knows Y, Y knows Z, Z knows you. but i guess you have
to belive the "six degrees of seperation"-theory for that to work.

> and the weird thing is that the key-signing how-to guides go into detail
> about verifying the fingerprint and name... that's only 2/3 of identifying
> a key! in my situation, i can easily confirm 2/3 (email and fingerprint),
> but it's not the 2/3 that most people are trained to look for.

imho the 2/3 you have as an example (email and fingerprint) isn't as
valuable as the 2/3 most people check (id and fingerprint). primary
because an email isn't usually printed on a goverment issued photo-id.

/Thomas
-- 
== thomas at northernsecurity.net | thomas at se.linux.org
== Encrypted e-mails preferred | GPG KeyID: 114AA85C
--
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 481 bytes
Desc: Digital signature
Url : /pipermail/attachments/20040517/699e6ebd/attachment.bin