PGP/MIME considered harmful for mobile

[David Shaw]

On Feb 28, 2011, at 8:18 AM, Aaron Toponce wrote:

> On 02/27/2011 08:27 PM, Robert J. Hansen wrote:
>> FM: [message]
>> RM: Hey, that's not me!  I'm me.  See?  I've signed this with the same cert I've used for everything else on this list.
>> FM: No, I'm the real Martin.  I didn't sign up for this mailing list until last week.  You signed up here a long time ago and posted messages pretending to be me, so that when I came on the list you could falsely claim to be me!
>> RM: But I'm the real Martin!  I've been posting here for months!
>> FM: Prove it.  You can't!  Therefore, I'm the real Martin.
>> RM: But you can't prove it either!
> 
> If RM has a substantial amount of signatures on his public key, and FM
> doesn't, nor does he sign his mail, I'll be more likely to believe that
> RM is the real deal. Isn't that the whole point of the Web of Trust, or
> am I missing something here?

Unfortunately, barring the case where you have an actual trust path to either Martin, key signatures don't tell you much.  After all, FM could easily make up dozens of fake people keys and use them to sign his key.

In this particular case, though, key signatures aren't even necessary - RM just needs to prove that he is the same entity that signed the other messages to the list.  That is, he's "real" in the sense that he is the Martin that the list knows and has been conversing with.

"What's in a name? That which we call a rose
By any other name would smell as sweet."

David