Re: kernel.org status: establishing a PGP web of trust

Jon Masters
2011-10-06T16:02:18Z

On Tue, 2011-10-04 at 16:29 -0400, Valdis.Kletnieks@vt.edu wrote:
> On Mon, 03 Oct 2011 21:04:41 +0300, Adrian Bunk said:
> > On Mon, Oct 03, 2011 at 12:28:17PM -0400, Frank Ch. Eigler wrote:
>
> > > What is the threat that this passport checking is intended to cure?
> > > That someone else might have been impersonating Rafael for years,
> > > sending patches, chatting in email and over the phone, and attending
> > > conferences?
> >
> > Key signing is an identity check.
>
> That's dodging the issue. Somehow, I don't see Andrew Morton asking Linus to
> sign his key, and Linus saying "How do I know you're the *real* Andrew Morton?"
> And Andrew is a clever guy, if he was a fake Andrew, I'm sure he'd have gotten
> a fake ID that would be good enough to fool Linus, who is also a clever guy but
> I'm not aware of any special background he has in forgery detection. ;)

Exactly. This is why we really need to get over the stupidity of turning
up to keysigning parties and looking at passports from countries we've
never been to as if we could really even tell they weren't freshly
printed. I know I wouldn't know what a Russian passport is supposed to
look like, even though I've seen many apparently from that country.

What I'd like to see is "keysigning" parties where folks with well
established (in use) keys turn up and *prove* they own the key by
signing some information the other attendees provide. That way they can
not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
photo ID" (which means nothing in the case of a well established online
identify that is trusted already), but they can say "hey, I have access
to this key, because I just signed that random message you gave me
interactively". Who cares who the heck they really are beyond that?
(intentionally a loaded statement to make the point).

Jon.