Friday, March 21, 2008
I still haven't been able to figure out why the privacy, identity and vrm debates wander around such abstract terms and doesn't talk about two technologies of the 90s that I thought were promising if more widely deployed.
The first technology - ecash of various sorts - I am not going to go into today (as the answer is too large to fit into the margin of this blog)
The second technology - pgp - has thus far been uncracked (well, there was an issue once, long ago), is widely used (there is no good substitute for PGP/mime), fully standardized and interoperable, and works on personal data, email and various chat systems, on every platform known to man.
The infrastructure has existed for over a decade - gpg itself, key servers, and the graphical tools such as engimail for thunderbird, and seahorse are now straightforward to use, at least under Linux. Less straightforward under other OSes, but that's a solvable problem
As to why browsers don't support pgp based authentication (based on your signature and the keyserver infrastructure)... don't know. I would love to be enlightened.
(Browsers have extensive support for certificates, but the primary certificate authorities are charging 2600 dollars a pop for that string of numbers. Sounds like a great business to be in, but I think true security needs to come from the bottom up rather than the top down in
many cases, which is what pgp derived system do.)
"Identity" and "verification of identity" have been solved from the bottom up, already, using pgp. It's astonishing to me how many times the concept of a "web of trust" has been reimplemented in (linkedin, myspace, facebook, amazon, etc) - without actually implementing any real, cryptographically secure trust between the participants. Each person is placed in a silo from which the trust does not escape, and the middleman holds the keys.
Wider use of pgp might be able to solve that.
As to solving the "I'm a real guy, with real money to spend" problem, presenting a signed key (signed by for example, your "buyers club" of individuals, which has a track record) on an anonymous email address, with your "personal rfp", would reveal the depth of your interest
without revealing your actual identity.
The first technology - ecash of various sorts - I am not going to go into today (as the answer is too large to fit into the margin of this blog)
The second technology - pgp - has thus far been uncracked (well, there was an issue once, long ago), is widely used (there is no good substitute for PGP/mime), fully standardized and interoperable, and works on personal data, email and various chat systems, on every platform known to man.
The infrastructure has existed for over a decade - gpg itself, key servers, and the graphical tools such as engimail for thunderbird, and seahorse are now straightforward to use, at least under Linux. Less straightforward under other OSes, but that's a solvable problem
As to why browsers don't support pgp based authentication (based on your signature and the keyserver infrastructure)... don't know. I would love to be enlightened.
(Browsers have extensive support for certificates, but the primary certificate authorities are charging 2600 dollars a pop for that string of numbers. Sounds like a great business to be in, but I think true security needs to come from the bottom up rather than the top down in
many cases, which is what pgp derived system do.)
"Identity" and "verification of identity" have been solved from the bottom up, already, using pgp. It's astonishing to me how many times the concept of a "web of trust" has been reimplemented in (linkedin, myspace, facebook, amazon, etc) - without actually implementing any real, cryptographically secure trust between the participants. Each person is placed in a silo from which the trust does not escape, and the middleman holds the keys.
Wider use of pgp might be able to solve that.
As to solving the "I'm a real guy, with real money to spend" problem, presenting a signed key (signed by for example, your "buyers club" of individuals, which has a track record) on an anonymous email address, with your "personal rfp", would reveal the depth of your interest
without revealing your actual identity.
Labels: identity, pgp, security, vrm
¶ 5:11 PM
