News for hackers. Stuff that matters.
Re:Why I Wrote PGP (1999) by UncleMeat on Sunday August 08, 2021 @10:09AM (#28106812)
Web of Trust mixes two kinds of trust.

If my mom gives me her public key, I trust that it is her public key. If my mom signs some other person's public key - I really don't know how much I trust that. Trusting that somebody is who they say they are is not the same as trusting them to properly vouch for another person.

Re:Why I Wrote PGP (1999) by XorNot on Sunday August 08, 2021 @09:27PM (#28111818)
This is still a UI problem though more then any other: Web of Trust stored and it could have displayed the actual verification chains, and set up some decent defaults based on that - i.e. "Government", "Bank", "Personally Verified", "Friend of a Friend" - all of this would be easy to communicate via what keys signed what exactly who you were dealing with.

This even leads to a logical DNS integration: debian.org advertises the core group of keys which should verify people on that address via DNS, and it shows up as "DNS-only" or something.

Good crypto frequently undermines itself by trying to be adversarial to the whole concept of government or big companies (look at TLS - it succeeded because it's the antithesis of this) but those the primary users and coordinators that can drive adoption.

I have this complaint with Signal right now: if Signal wanted a legitimate funding source, they should sell a "verified Signal" service to let companies subscribe to use Signal as an alternative to SMS providers - my father wants to do this for his small business right now, to replace the SMS bulk sender and be able to send larger files to people securely.

Instead we've got whatever cryptocurrency ridiculousness.

Re:Why I Wrote PGP (1999) by jandrese on Sunday August 08, 2021 @06:38PM (#28110825)
This is the reason Frendster failed. Friending someone automatically made you a friend with all of their friends, even the ones that were jerks or you had never met.