Re: kernel.org status: establishing a PGP web of trust

[Krzysztof Halasa <khc@pm.waw.pl>]

> On Thu, 06 Oct 2011 11:58:22 EDT, Jon Masters said:
>> What I'd like to see is "keysigning" parties where folks with well
>> established (in use) keys turn up and *prove* they own the key by
>> signing some information the other attendees provide. That way they can
>> not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
>> photo ID" (which means nothing in the case of a well established online
>> identify that is trusted already),

The person may be trusted but how do you know the message apparently
from that person is genuine?

Valdis.Kletnieks@vt.edu writes:

> Wouldn't the fact that I attend the keysigning party and claim that I was
> the owner of key B4D3D7B0, and then subsequently signing your key with
> that same key, prove that I actually controlled key B4D3D7B0?

I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets
signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0)
reads Alice's mail and signs something "in Alice's name". Alice loses.
There are many ways for Alice to lose if she wishes to. One of the
simpler ones is to send the private key straight to Chuck then erase it
from her computer.

It's Alice's problem to make sure other people sign her key instead of
some other number she has found on the floor. It's their responsibility
to verify Alice's identity, but they aren't responsible for her actions.
-- 
Krzysztof Halasa