Re:I'm giving up on PGP
by edejong on Tuesday December 06, 2016 @05:40PM
(#13118932)
The web of trust is fundamentally flawed and for very simple reasons.
First of all, the WoT is based on belief networks. What is a belief? Is it based on a probability? Is it binary? Can we believe something negatively? Whatever it is, we know it is subjective and difficult to define quantitively.
Second of all, even when formally specifying a belief using a certain quantity, we need to calculate transitive beliefs (person A beliefs with certainty x the identity of person B, C and D, who each believe with certainty y the identity of person E and A). This requires doing some matrix inversions for which the whole matrix needs to be known. However, who do we trust to provide us with the matrix? If I can provide the matrix, I can also tamper by adding extra nodes, thus shifting trust towards nodes I control. We can provide the matrix in a distributed fashion, but how do we prove completeness?
Then there is a temporal aspect to WoT which is hard to tackle. I might have a belief now, but that does not entail I will belief it tomorrow. Without a continuous stream of events on a subject, the precision of my beliefs are always diminishing. However, the current WoT networks do not take this fully into account (or transitive beliefs for that matter).
First of all, the WoT is based on belief networks. What is a belief? Is it based on a probability? Is it binary? Can we believe something negatively? Whatever it is, we know it is subjective and difficult to define quantitively.
Second of all, even when formally specifying a belief using a certain quantity, we need to calculate transitive beliefs (person A beliefs with certainty x the identity of person B, C and D, who each believe with certainty y the identity of person E and A). This requires doing some matrix inversions for which the whole matrix needs to be known. However, who do we trust to provide us with the matrix? If I can provide the matrix, I can also tamper by adding extra nodes, thus shifting trust towards nodes I control. We can provide the matrix in a distributed fashion, but how do we prove completeness?
Then there is a temporal aspect to WoT which is hard to tackle. I might have a belief now, but that does not entail I will belief it tomorrow. Without a continuous stream of events on a subject, the precision of my beliefs are always diminishing. However, the current WoT networks do not take this fully into account (or transitive beliefs for that matter).