WoT question - policy

[Dirk Gottschalk]

Hi.

Am Donnerstag, den 15.11.2018, 23:41 +0100 schrieb Stefan Claas:
> On Thu, 15 Nov 2018 22:54:01 +0100, Dirk Gottschalk wrote:

> Hi Dirk,
 
> > Am Donnerstag, den 15.11.2018, 21:05 +0100 schrieb Stefan Claas:
> > > I disagree, with my humble approach imho third parties do not
> > > know
> > > that people are my real friends, colleagues, or that i belong to
> > > a
> > > certain group.  
> > 
> > The implication matters. For example: If you sign a three keys of,
> > let's assume kidnappers, with level 3. I guess, police won't read
> > and
> > understand your policy first, you'll get a little trouble for sure.
> > Okay, that is a bad example. But, the diagram will result in level
> > 3
> > Relations, what can lead to assumptions somebody does not want or
> > intent.
> 
> You make a very important point, which i thought also about and
> that is my little approach for covering my a*#. I would strongly
> assume that law enforcement would also check a sig0 user,
> regardless of policy or not, if something happens to a key owner,
> or if i sign with sig0 a key on a key signing party, where i also
> don't know that the person who attended is a good or bad person with
> a real or fake id. I am totally unable to distinguish  between a real
> or fake id nor do i know if a person is good or bad if i would attend
> such a key signing party.

That was a bad example. But you see what I meant. Signature levels
imply in some cases the assumption that it is related to the relation
of people whether it's right or wrong.


> > > I am no expert, but i like to know from my example (because i
> > > don't
> > > understand this) how could i trust this internal computation,
> > > when
> > > it is only visible to me and not to third parties?  

> > It is based on your trust into the signers. There is a chain in
> > trust dependencies for the trustdb. The levels full, marginal and
> > so on lead to basical calculations in how reliable a key is, which
> > is indirectly signed by trusted keys. I did not dig deeper into the
> > GPG internals for this system, but I've already seen it works well,
> > at least for me.

> Like i said in my previous reply i have to study this in more depth.

There's documentation about the trustdb. I read it a while ago, but not
entirely. You can also set the amount of needed signatures for the
trust calculations and so on. Then comes the trust deepness into play.
I also have to read further because I want to "abuse" GnuPG for an
email controlled bot system inside a bigger company as part of the
security concept. The commands shall be encrypted and signed and some
function should be usable by "unknown" users with the needed trust
level and so on.


Regards,
Dirk

-- 
Dirk Gottschalk
Paulusstrasse 6-8
52064 Aachen, Germany

GPG: DDCB AF8E 0132 AA54 20AB  B864 4081 0B18 1ED8 E838
Keybase.io: https://keybase.io/dgottschalk
GitHub: https://github.com/Dirk1980ac

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20181116/9cc46753/attachment.sig>