key-signing for pseudonyms
thomas at northernsecurity.net
Tue May 18 16:02:27 CEST 2004
On Mon, May 17, 2004 at 05:03:34PM -0700, vedaal at hush.com wrote:
> assuming that it were *really* possible to verify a person's real identity,
> and that everyone signing someone's key,
> *really* knew the person, and signed only when they were sure,
> then the web-of-trust would provide a data base that could potentially
> be very harmful to privacy,
> an extensive 'non-repudiable' ID data base
> that could be used to collect everything that the person ever 'signed'...
Keysignings is in a way a threat to privacy. It's not to hard to create
a sociogram of a persons key, mapping the date of the signature and name
of the signer.
if one wants to be blunt: gpg protects your communication but not your
privacy. but that is probably pushing it a bit.
> for this type of pseudonym,
> the gnupg trust system is ideal, in that it can be used to assign one
> of the 'lower' non-exportable trust levels, indicating something like:
> -- i never met this person and don't know who he /she 'really' is,
> but do know that the person's e-mail address is the same as the key ID's,
> and also that i generally like what the person signs --
i would rather see a semianonymous signature type which would only allow the owner
of the key and the signer to reveal the signature info (name, date,
email etc). almost like Chaums group signatures.
== thomas at northernsecurity.net | thomas at se.linux.org
== Encrypted e-mails preferred | GPG KeyID: 114AA85C
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 481 bytes
Desc: Digital signature
Url : /pipermail/attachments/20040518/4e25fc46/attachment.bin
More information about the Gnupg-users