Rendered at 07:00:58 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
lxgr 15 hours ago [-]
Great concise description of the problem.
As for the solution, it seems to explicitly not address recovery of lost keys/identities, which is however exactly the part that makes this hard for regular users.
That, and general name confusion attacks, I suppose: "I'm lxgr17@key, yeah, don't ask about the first 16. Oh also make sure 'key' is not the one with the Georgian lowercase e in the middle, that one's an impostor. Wait, actually, let me quickly spell it out in hexadecimal Unicode points..."
At least blockchain addresses have that going for them: They're way too long to even try and remember or spell out on the phone.
tptacek 9 hours ago [-]
It's not "hard" for regular users; it's a complete non-starter for regular users. Every "non-custodial" or "self-sovereign" system of trusted identities founders on this issue: account recovery is the hardest problem in identity, and if you don't have a solution for it, your system is going to be a niche at best.
People have been coming up with these schemes for decades, and for that entire time, the near-universal de facto standard trusted identity system has been "Google accounts". People knew at the beginning that they were delegating trust to Google; they know it now as well; they are not going to adopt "names resolve to a key, the same key, in every application", no matter how many different names that scheme is given.
Terr_ 9 hours ago [-]
It's interesting to imagine how different the security landscape would be if human brains could easily transcribe a smallish quantity of high-value bits [0] and then compare two versions for exact equality.
I think the exact and trusted data-movement is the hard part. If we could instantly transcribe a 150 digit number (~512 bits) from eye to fingertips, then the actual memory/comparison could be done in any pocket-calculator, with X-Y==0.
Krasnol 12 hours ago [-]
Wait, actually, let me quickly...send it over in Whatsapp
upofadown 14 hours ago [-]
A cryptographic identity is a public key as used in a public key signature scheme. So a particular person is represented by a ridiculously long number. That number can be shortened with some sort of hash to a shorter value to make a key fingerprint, which is a shorter ridiculously long number.
The scheme described in the system seems to use a blockchain to create a shared mapping between a name and a cryptographic identity. So a third party is still in control of that mapping, but there are a lot of third parties and most of them would have to conspire to forge a mapping. Then you could send a message to a name, rather than a number, with confidence that someone in the past picked that name and locked in the mapping between that name and the cryptographic identity.
The append-only, distributed nature of the traditional SKS PGP keyserver network seems to provide the same sort of thing. If you query several keyservers you can be reasonably sure that someone mapped a name (and email address) to a particular cryptographic identity sometime in the past. A single server operator can not forge a mapping without the possibility of that forgery being detected.
The thing is, people don't actually want a reliable name to cryptographic identity mapping service for end to end encrypted messaging. They instead want to be sure that they are securely exchanging messages with an particular flesh and blood person, and if you want to insure that you are back in the realm of ridiculously long numbers.
XorNot 10 hours ago [-]
Technically speaking the long numbered problem is solved with QR codes though.
You want to be sure it's a particular person the you need to establish in-person trust.
irq-1 14 hours ago [-]
> The same key, in every app, for every recipient. Not assignable to anyone else, not revocable, not subject to suspension. Yours forever.
This is impractical and the opposite of what we want. It's a required ID to use the internet, monitored by governments, tracked by corporations, and forever unchanging.
What we need is a system that allows people to easily create new IDs, that updates contacts that people choose. Think of a contact book that sends new keys to all contacts on every change. (Contacts would need to be always online.) It could update the key used on a website or not, depending on the users choice.
Breaking tracking and required IDs means flux and churn.
marcus_holmes 5 hours ago [-]
> It's a required ID to use the internet, monitored by governments, tracked by corporations, and forever unchanging.
There are clearly two opposing requirements.
One for anonymity, where people who need to be anonymous can create an identity that is verifiably the same person each time, but not a specific, identifiable, individual. The classic example is journalistic sources.
One for trust and verification, where the identity needs to be absolutely, permanently, associated with a specific individual. Online banking is the classic example here.
I don't think the same system can be used for both.
- If we can create multiple identities without verifying the human each time, as you say "flux and churn", then the second requirement is broken - there is no link between the identity and a verifiable person so the identity can't be trusted.
- If we can't create multiple identities without verifying the human each time, then the first requirement is broken - every identity can be associated with a specific human and there's no anonymity.
We could try some hybrid system where some identities are known people, and others are pseudonymns. But that feels like two systems wedged into the same box. The hard problems of absolutely correctly identifying a human so the second system works is still not solved, and irrelevant to the first system.
You are absolutely correct that the system that identifies individuals is incredibly attractive for states and large corporations, and so incredibly dangerous for actual humans. We need to be very, very, careful with this.
lxgr 13 hours ago [-]
> What we need is a system that allows people to easily create new IDs, that updates contacts that people choose.
> Contacts would need to be always online.
That also sounds impractical.
> It's a required ID to use the internet
How does any of that follow? Having a reusable self-sovereign ID format for those scenarios where people want to share it is very different from having an authority-issued ID format that's mandatory for some interaction.
As a concrete example: I have an iMessage (CKV), Signal, WhatsApp, and GPG identity key, but I don't need to provide any of them when ordering pizza online. But what I can't do is choosing to use the same key for my same number on both e.g. Signal and iMessage to make it easier for people to switch between messengers without having to re-verify me.
A hypothetical shared key format would fix that, but would (hopefully!) still allow me to create multiple keys/identities for multiple contexts, and to not provide any persistent identity when it's not necessary.
irq-1 11 hours ago [-]
If the ID is permanent then governments will require it, because they can. If it has attestations or endorsements, governments will require a government endorsement. Think about what China, Iran or Russia would do with a permanent ID being a standard. The US, England and the EU are not immune to the same impulses.
Always online is no different than an email account or website, and the rate of change would be, at least, minutes not seconds.
lxgr 10 hours ago [-]
If governments want to do these things, they already can. Phone numbers are KYCed in many countries, for example, and many messengers mandatorily require them.
The lack of an interoperable key standard isn’t stopping them. (In fact, it’s even helping a bit by providing cover for MITM snooping)
vmg12 11 hours ago [-]
Not revocable doesn't seem ideal. Someone will have their identity stolen and they would have to give up their entire online identity and generate a new one.
AgentME 11 hours ago [-]
> Spaces takes this shape. (Disclosure: I work on it.) Issued names live in a binary Merkle trie. The root of that trie is committed to Bitcoin’s chain
Who can update and publish the merkle trie onto the blockchain? Is it only Spaces themselves who can? If so, this seems a little inferior to more direct blockchain solutions like the Ethereum Name Service which exists as a smart contract on a blockchain that anyone can use directly.
TheColorYellow 14 hours ago [-]
> two parties have to be able to agree on which key grace@key is bound to without consulting anyone in particular. They need a shared, append-only record of which names exist and which keys they belong to. And that record can’t have a signing key to steal, an operator to coerce, or a committee to lobby
Having studied this problem space for some time, this is also my read of what the ultimate solution requires. That said, as the author also mentions, the biggest challenges in this paradigm are social, not necessarily technical. Therefore, I think the new solution requires a protocol approach rather than just a technical standard or implementation.
The KERI protocol (https://keri.one/) has been the best attempt I've seen at this. They focus on a similar concept, persistent long lasting identifiers built on top of cryptographic primitives, but they do so with a microledger approach than a monolithic blockchain as the root. The core primitive is what is known as a Key Event Log which tracks verified attestations of key transactions such as issuance, revocation, delegation, rotation, interaction, and so on. It is a very powerful concept that then facilitates stronger trust assumptions via end-to-end verification. And maybe most importantly, enables some very clean key management procedures that then can anchor the protocol behavior needed to optimize for those social challenges discussed earlier.
Regardless, adoption of KERI and other solutions like Spaces has not been very productive. I fear we've reached a tipping point where the external threats are too large now and top-down authoritarian-like solutions that address these issues head on will be the winners, leaving out dociety with very poor tradeoffs in such a critical area.
> Signal ships safety numbers because the platform might one day be compelled or compromised, and the architecture is meant to let you catch that. But almost nobody verifies
We have a solution to this! Wa and Signal both have key transparency. This uses cryptography to make it possible to verify that everyone is getting the same data[1]. Now your phone can check the keys listed under your username are all keys you made (and your contacts can check this too!)
Edit 2 (quick note): if you don't trust the app on your phone to verify your keys, then you also can't trust it to show you a valid security code, or do what the author proposed in their product spaces.
Edit:
It's also striking how similar (in essence) the current solution is to the solution the author is working on/proposing:
> Spaces takes this shape. (Disclosure: I work on it.) Issued names live in a binary Merkle trie. The root of that trie is committed to Bitcoin’s chain, used here as a widely-replicated, hard-to-rewrite timestamp service
Fundamentally the same: the name is your phone number (or alternatively in signal your username), key transparency also uses a merkle tree based structure. Instead of using the bitcoin chain as a consensus mechanism, key transparency implementations generally use trusted witnesses: simple servers that promise to only sign consistent versions of the merkle tree. This is better! Because essentially no clients (phones) have a local copy of the bitcoin chain, so you still have to trust a server to tell you what was posted in the bitcoin block.
For the rest current key transparency systems also have verifiers, which verify that the append only merkle tree is transformed into a dictionary legitimately (this is pretty compute intensive, and needs to be done by a trusted server too. WA currently contracts cloudflare as their only verifier). Spaces would also have to do this to be secure if they reach any scale, but this isn't mentioned in TFA.
Also a message for the author: Key transparency is cool tech, but you shouldn't reinvent the wheel! I hope you research current solutions more! You can ask questions in the transparency.dev slack (https://transparency.dev/slack/)
[1]: There are a bunch of details here. You need to check that everyone _is_ actually getting the same data. There are multiple ways to do this. The transparency ecosystem has generally stabilized on a system where you have trusted verifiers. But anyone (yes you!) can setup a server that can help monitor the chat app and trusted verifiers.
aliasxneo 12 hours ago [-]
I am co-founding a project that somewhat addresses some of this. The basis of it is a decentralized trust system built using human-readable names (think domain names), native mTLS, and post-quantum cryptography. This removes two barriers we've found: inability to easily confirm hashes (i.e. DIDs or fingerprints) and relying on a centralized trust giver (i.e. central certificate authorities).
Happy to share more if anyone is interested in this space: hn@sepositus.com. We're in shadow mode so not much public material at this point (although we do have a full PoC).
lrvick 13 hours ago [-]
Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so.
Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month.
PGP is not going away any time soon, and it is more relevant than ever.
No part of what's being proposed here has anything to do with PGP. They aren't proposing a "web of trust" with "key servers". They're proposing an immutable binding between names and key identities.
PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. That is to trusted identity what the one time pad is to cryptography: a punt on the entire problem space.
lrvick 8 hours ago [-]
> PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities.
Or between total strangers that met in person at a key signing party and agreed "you look like a human and not a bot to me".
We need human identity to be certified by humans using very long lived standard PKI primitives. Anything else, bots can easily monopolize to the point of being useless.
Rather than debate this here though yet again, I am working on a blog post which includes a lot of quotes, including one from you, to make a case for why PGP is still the best and most widely used and useful proof-of-human and self-sovereign PKI solution that exists, and why we should double down on it.
That comment thread is sure to be interesting.
tptacek 7 hours ago [-]
That's fine! It's perfectly reasonable to say "this isn't a problem worth solving". But you can't then say something else actually solves the problem by punting on it. Be clearer about what you're saying, instead of invoking the specter of "security influencers".
lrvick 7 hours ago [-]
I am not saying it is not a problem worth solving. I am actually saying PGP actually solves the problem of which key actually belongs to which person.
There are dozens of keys claiming to be Torvalds that lack credible endorsements from high reputation identities, so those are easily ignored. The one that has been signing the Linux kernel for years and signed by many people putting their reputations on the line is the one we care about.
It is intuitive and does not need a math degree to understand.
tptacek 6 hours ago [-]
Like I said: this is to cryptographic identity what the one-time pad is to message encryption. Simple and unuseful.
lrvick 6 hours ago [-]
It is unuseful to people with threat models that allow for entrusting their social graph to centralized identity systems managed by centrally controlled software supply chains that any compromised insider could manipulate.
For me and thousands of other Linux distro maintainers that maintain the core software supply chains and infrastructure that runs the internet, we cannot afford centralized trust graphs. Nothing else comes close to solving the problems PGP solves.
That is why it is an active IETF standard with modern cryptography and several actively maintained and widely used implementations.
akerl_ 7 hours ago [-]
Why do I trust the people who are putting their reputations on the line? If they either screwed up or are malicious, I guess I'm just out of luck?
lrvick 6 hours ago [-]
If you can manipulate dozens of Linux maintainers to sign a key maliciously, we have bigger problems. Like a complete failure of the internet.
Decentralized human trust, or centralized corporate trust. Pick one.
akerl_ 6 hours ago [-]
Again, this works when your userbase is a small group of highly technical people who already have social connections to each other. But then again, so would just swapping Signal security numbers.
It completely and totally collapses in the face of non-technical users or broad adoption, which is one of multiple reasons that PGP remains a thing that a small set of people use.
tptacek 5 hours ago [-]
Just to be pedantic about this: it does not in fact work; PGP has failed those kinds of user groups and platforms over and over again over the last 3 decades.
lrvick 37 minutes ago [-]
And yet many of the highest risk systems that exist, the whole foundation of the internet, several governments, major corporations, and thousands of high risk individuals rely on it because centralized options will never be agreed to by all parties, for good reason.
I have lost count of the orgs I have personally trained to use PGP properly in recent years.
In spite of your claims, PGP solves the problem it was designed to solve for the groups that need it most and the tooling is getting rapidly more accessible to a wider audience with more development energy today than it has ever had.
This is not 2016 PGP we are talking about anymore.
akerl_ 7 hours ago [-]
If the measure here is "I met this person at an event and they were a human", and the protocol becomes actually important for proving personhood, what is the measure that stops somebody from turning up to a bunch of events and getting "human" keys signed to then repurpose for bots?
lrvick 7 hours ago [-]
Because this is too expensive to scale, and people talk in small circles about who has signed who. Good luck inventing thousands of fake identities with a long trust history and reputation with this approach.
Botmasters like situations where they can hide offline and buy bots blue checkmarks with stolen credit cards.
akerl_ 7 hours ago [-]
This is a fun kind of paradox. Right now it wouldn't scale well because signing parties are a niche nerd activity and having your identities signed by other GPG users doesn't really help with anything you'd want to do with a bot.
But if you were to actually succeed in making key signing parties a more common thing that people used to test for human-ness, and that test was tied to meaningful things online, it would both become easier to fake and more valuable to fake.
lrvick 6 hours ago [-]
When you sign a key you pick a trust level. If no one reputable has ever trusted a persons key with a higher level than "human", then that key should be subject to significantly higher scrutiny.
If you look at my key, you will find it is heavily connected to the keys that sign most linux distributions, bitcoin, and commits to the Linux kernel today.
If those 5444 linked identities that long pre-date AI are colluded to create a fake me and fake people that signed people who signed me over the last 25 years, and got those fake fingerprints in the keychains of every distro and got matching fingerprints on thousands of privately owned sites, we indeed have serious problems.
akerl_ 6 hours ago [-]
Yes, that would be the conundrum I was describing. If your plan were to work, the idea of a signer being "reputable" would be watered down into nothing.
lrvick 27 minutes ago [-]
Well, it is working as intended, right now, and the binaries running on the servers we are communicating with right now were likely signed and validated with Linux maintainer PGP keys because it is the only standard and decentralized option.
PGP does not need mass adoption to function, but with solutions like keyoxide offering a more accessible trust onramp, it is there for anyone that wants to self certify and take control of their own identity today, and get signed by trusted community members tomorrow at a conference.
sabedevops 9 hours ago [-]
I've struggled with PGP with the idea that I can't quite express "I'm signing as this specific User ID by using this specific signing subkey"... The only way I've found to reliably express that is to maintain completely separate keys. Is there anything in the works to give ergonomics around this?
lrvick 8 hours ago [-]
You should only be signing other peoples keys with your master key which should never touch an internet connected operating system. Subkeys should have limited privileges and be easy to lose or rotate as needed, but can all live under the same master offline identity key, which acts like a personal CA.
Don't forget authentication! Been using pgp keys on smart cards as ssh keys for ages.
growse 11 hours ago [-]
Who's reinventing a tool that can do all that?
Grosvenor 10 hours ago [-]
No one. The influencers are simply telling you you're wrong if you think you need that.
Which is the thing, we do need a single key that can be used for all those things. So we get PGP.
growse 10 hours ago [-]
> No one.
I thought everyone was "trying so hard to re-invent PGP".
> we do need a single key that can be used for all those things
We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?
lrvick 8 hours ago [-]
It is hard enough for people to keep up with one keychain, let alone a dozen of them for every use case in their lives.
PGP keychains allow you to have a single 24 word mnemonic seed to recover your entire digital identity, data access, etc. The UX is strictly better than the commonly suggested hodge podge of flavor of the week alternatives.
Standards make interoperability a lot easier.
noman-land 10 hours ago [-]
One thing I don't like about key signing is that
1. You reveal your social graph
2. Different instances of the key can be differently signed
For someone to sign your key that information has to be stored on your key or in a central location.
purplehat_ 9 hours ago [-]
The first bit seems possibly solvable with private set intersection. You can publish a salted hash of everybody you trust, and I can compute hashes of everyone I trust with your salt to see if we have anyone in common. Then I check the signature corresponding to the salted hash I like, and hopefully it doesn't reveal anything you don't want to reveal.
I don't know if anyone has actually done this in practice. Does it work?
lrvick 8 hours ago [-]
Having a public graph is critical for trust in Linux distributions. All it means is a human met you and agreed you are human and signed your key. It does not imply you are friends.
It is pretty useful for someone totally outside the trust graph to be able to prove the key that just signed the latest release of stagex is only a couple steps away from the keys that sign debian and the Linux kernel. Keys that long predate AI.
Public trust accountability is exactly what we want from people responsible for the legos that make up the internet.
You can of course have private signature packets revealed as needed though.
tptacek 6 hours ago [-]
People are not Linux distributions.
lrvick 6 hours ago [-]
But Linux distributions are made of people.
captn3m0 14 hours ago [-]
I tried to follow the links, but could not discover the expected cost of a record creation.
> "Supply is capped at about ten per day. Individual squatting (buy at auction, hold, resell) is possible. "
Won't this mean that squatters will keep buying the top-alexa domains for the first few years?
I'd have liked to see a comparision with other "crypto"-led infra in this space. .eth/ENS, namecoin, .box, .bit for eg.
philipallstar 14 hours ago [-]
> Spaces takes this shape.
Why write in such a silly way? Do you mean "Spaces does this"?
brabel 10 hours ago [-]
Sounds like something a LLM would write.
Edmond 15 hours ago [-]
>We have public-key infrastructure for machines. We don’t have it for people.
As for the solution, it seems to explicitly not address recovery of lost keys/identities, which is however exactly the part that makes this hard for regular users.
That, and general name confusion attacks, I suppose: "I'm lxgr17@key, yeah, don't ask about the first 16. Oh also make sure 'key' is not the one with the Georgian lowercase e in the middle, that one's an impostor. Wait, actually, let me quickly spell it out in hexadecimal Unicode points..."
At least blockchain addresses have that going for them: They're way too long to even try and remember or spell out on the phone.
People have been coming up with these schemes for decades, and for that entire time, the near-universal de facto standard trusted identity system has been "Google accounts". People knew at the beginning that they were delegating trust to Google; they know it now as well; they are not going to adopt "names resolve to a key, the same key, in every application", no matter how many different names that scheme is given.
I think the exact and trusted data-movement is the hard part. If we could instantly transcribe a 150 digit number (~512 bits) from eye to fingertips, then the actual memory/comparison could be done in any pocket-calculator, with X-Y==0.
The scheme described in the system seems to use a blockchain to create a shared mapping between a name and a cryptographic identity. So a third party is still in control of that mapping, but there are a lot of third parties and most of them would have to conspire to forge a mapping. Then you could send a message to a name, rather than a number, with confidence that someone in the past picked that name and locked in the mapping between that name and the cryptographic identity.
The append-only, distributed nature of the traditional SKS PGP keyserver network seems to provide the same sort of thing. If you query several keyservers you can be reasonably sure that someone mapped a name (and email address) to a particular cryptographic identity sometime in the past. A single server operator can not forge a mapping without the possibility of that forgery being detected.
The thing is, people don't actually want a reliable name to cryptographic identity mapping service for end to end encrypted messaging. They instead want to be sure that they are securely exchanging messages with an particular flesh and blood person, and if you want to insure that you are back in the realm of ridiculously long numbers.
You want to be sure it's a particular person the you need to establish in-person trust.
This is impractical and the opposite of what we want. It's a required ID to use the internet, monitored by governments, tracked by corporations, and forever unchanging.
What we need is a system that allows people to easily create new IDs, that updates contacts that people choose. Think of a contact book that sends new keys to all contacts on every change. (Contacts would need to be always online.) It could update the key used on a website or not, depending on the users choice.
Breaking tracking and required IDs means flux and churn.
There are clearly two opposing requirements.
One for anonymity, where people who need to be anonymous can create an identity that is verifiably the same person each time, but not a specific, identifiable, individual. The classic example is journalistic sources.
One for trust and verification, where the identity needs to be absolutely, permanently, associated with a specific individual. Online banking is the classic example here.
I don't think the same system can be used for both.
- If we can create multiple identities without verifying the human each time, as you say "flux and churn", then the second requirement is broken - there is no link between the identity and a verifiable person so the identity can't be trusted.
- If we can't create multiple identities without verifying the human each time, then the first requirement is broken - every identity can be associated with a specific human and there's no anonymity.
We could try some hybrid system where some identities are known people, and others are pseudonymns. But that feels like two systems wedged into the same box. The hard problems of absolutely correctly identifying a human so the second system works is still not solved, and irrelevant to the first system.
You are absolutely correct that the system that identifies individuals is incredibly attractive for states and large corporations, and so incredibly dangerous for actual humans. We need to be very, very, careful with this.
> Contacts would need to be always online.
That also sounds impractical.
> It's a required ID to use the internet
How does any of that follow? Having a reusable self-sovereign ID format for those scenarios where people want to share it is very different from having an authority-issued ID format that's mandatory for some interaction.
As a concrete example: I have an iMessage (CKV), Signal, WhatsApp, and GPG identity key, but I don't need to provide any of them when ordering pizza online. But what I can't do is choosing to use the same key for my same number on both e.g. Signal and iMessage to make it easier for people to switch between messengers without having to re-verify me.
A hypothetical shared key format would fix that, but would (hopefully!) still allow me to create multiple keys/identities for multiple contexts, and to not provide any persistent identity when it's not necessary.
Always online is no different than an email account or website, and the rate of change would be, at least, minutes not seconds.
The lack of an interoperable key standard isn’t stopping them. (In fact, it’s even helping a bit by providing cover for MITM snooping)
Who can update and publish the merkle trie onto the blockchain? Is it only Spaces themselves who can? If so, this seems a little inferior to more direct blockchain solutions like the Ethereum Name Service which exists as a smart contract on a blockchain that anyone can use directly.
Having studied this problem space for some time, this is also my read of what the ultimate solution requires. That said, as the author also mentions, the biggest challenges in this paradigm are social, not necessarily technical. Therefore, I think the new solution requires a protocol approach rather than just a technical standard or implementation.
The KERI protocol (https://keri.one/) has been the best attempt I've seen at this. They focus on a similar concept, persistent long lasting identifiers built on top of cryptographic primitives, but they do so with a microledger approach than a monolithic blockchain as the root. The core primitive is what is known as a Key Event Log which tracks verified attestations of key transactions such as issuance, revocation, delegation, rotation, interaction, and so on. It is a very powerful concept that then facilitates stronger trust assumptions via end-to-end verification. And maybe most importantly, enables some very clean key management procedures that then can anchor the protocol behavior needed to optimize for those social challenges discussed earlier.
Regardless, adoption of KERI and other solutions like Spaces has not been very productive. I fear we've reached a tipping point where the external threats are too large now and top-down authoritarian-like solutions that address these issues head on will be the winners, leaving out dociety with very poor tradeoffs in such a critical area.
https://keri.one/
> Signal ships safety numbers because the platform might one day be compelled or compromised, and the architecture is meant to let you catch that. But almost nobody verifies
We have a solution to this! Wa and Signal both have key transparency. This uses cryptography to make it possible to verify that everyone is getting the same data[1]. Now your phone can check the keys listed under your username are all keys you made (and your contacts can check this too!)
Edit 2 (quick note): if you don't trust the app on your phone to verify your keys, then you also can't trust it to show you a valid security code, or do what the author proposed in their product spaces.
Edit:
It's also striking how similar (in essence) the current solution is to the solution the author is working on/proposing:
> Spaces takes this shape. (Disclosure: I work on it.) Issued names live in a binary Merkle trie. The root of that trie is committed to Bitcoin’s chain, used here as a widely-replicated, hard-to-rewrite timestamp service
Fundamentally the same: the name is your phone number (or alternatively in signal your username), key transparency also uses a merkle tree based structure. Instead of using the bitcoin chain as a consensus mechanism, key transparency implementations generally use trusted witnesses: simple servers that promise to only sign consistent versions of the merkle tree. This is better! Because essentially no clients (phones) have a local copy of the bitcoin chain, so you still have to trust a server to tell you what was posted in the bitcoin block.
For the rest current key transparency systems also have verifiers, which verify that the append only merkle tree is transformed into a dictionary legitimately (this is pretty compute intensive, and needs to be done by a trusted server too. WA currently contracts cloudflare as their only verifier). Spaces would also have to do this to be secure if they reach any scale, but this isn't mentioned in TFA.
Also a message for the author: Key transparency is cool tech, but you shouldn't reinvent the wheel! I hope you research current solutions more! You can ask questions in the transparency.dev slack (https://transparency.dev/slack/)
[1]: There are a bunch of details here. You need to check that everyone _is_ actually getting the same data. There are multiple ways to do this. The transparency ecosystem has generally stabilized on a system where you have trusted verifiers. But anyone (yes you!) can setup a server that can help monitor the chat app and trusted verifiers.
Happy to share more if anyone is interested in this space: hn@sepositus.com. We're in shadow mode so not much public material at this point (although we do have a full PoC).
Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month.
PGP is not going away any time soon, and it is more relevant than ever.
For now check out this post about how we use it to build trust in the Linux ecosystem today: https://kron.fi/en/posts/stagex-web-of-trust/
PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. That is to trusted identity what the one time pad is to cryptography: a punt on the entire problem space.
Or between total strangers that met in person at a key signing party and agreed "you look like a human and not a bot to me".
We need human identity to be certified by humans using very long lived standard PKI primitives. Anything else, bots can easily monopolize to the point of being useless.
Rather than debate this here though yet again, I am working on a blog post which includes a lot of quotes, including one from you, to make a case for why PGP is still the best and most widely used and useful proof-of-human and self-sovereign PKI solution that exists, and why we should double down on it.
That comment thread is sure to be interesting.
There are dozens of keys claiming to be Torvalds that lack credible endorsements from high reputation identities, so those are easily ignored. The one that has been signing the Linux kernel for years and signed by many people putting their reputations on the line is the one we care about.
It is intuitive and does not need a math degree to understand.
For me and thousands of other Linux distro maintainers that maintain the core software supply chains and infrastructure that runs the internet, we cannot afford centralized trust graphs. Nothing else comes close to solving the problems PGP solves.
That is why it is an active IETF standard with modern cryptography and several actively maintained and widely used implementations.
Decentralized human trust, or centralized corporate trust. Pick one.
It completely and totally collapses in the face of non-technical users or broad adoption, which is one of multiple reasons that PGP remains a thing that a small set of people use.
I have lost count of the orgs I have personally trained to use PGP properly in recent years.
In spite of your claims, PGP solves the problem it was designed to solve for the groups that need it most and the tooling is getting rapidly more accessible to a wider audience with more development energy today than it has ever had.
This is not 2016 PGP we are talking about anymore.
Botmasters like situations where they can hide offline and buy bots blue checkmarks with stolen credit cards.
But if you were to actually succeed in making key signing parties a more common thing that people used to test for human-ness, and that test was tied to meaningful things online, it would both become easier to fake and more valuable to fake.
If you look at my key, you will find it is heavily connected to the keys that sign most linux distributions, bitcoin, and commits to the Linux kernel today.
If those 5444 linked identities that long pre-date AI are colluded to create a fake me and fake people that signed people who signed me over the last 25 years, and got those fake fingerprints in the keychains of every distro and got matching fingerprints on thousands of privately owned sites, we indeed have serious problems.
PGP does not need mass adoption to function, but with solutions like keyoxide offering a more accessible trust onramp, it is there for anyone that wants to self certify and take control of their own identity today, and get signed by trusted community members tomorrow at a conference.
Which bit of PGP?
Which is the thing, we do need a single key that can be used for all those things. So we get PGP.
I thought everyone was "trying so hard to re-invent PGP".
> we do need a single key that can be used for all those things
We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?
PGP keychains allow you to have a single 24 word mnemonic seed to recover your entire digital identity, data access, etc. The UX is strictly better than the commonly suggested hodge podge of flavor of the week alternatives.
Standards make interoperability a lot easier.
1. You reveal your social graph
2. Different instances of the key can be differently signed
For someone to sign your key that information has to be stored on your key or in a central location.
I don't know if anyone has actually done this in practice. Does it work?
It is pretty useful for someone totally outside the trust graph to be able to prove the key that just signed the latest release of stagex is only a couple steps away from the keys that sign debian and the Linux kernel. Keys that long predate AI.
Public trust accountability is exactly what we want from people responsible for the legos that make up the internet.
You can of course have private signature packets revealed as needed though.
> "Supply is capped at about ten per day. Individual squatting (buy at auction, hold, resell) is possible. "
Won't this mean that squatters will keep buying the top-alexa domains for the first few years?
I'd have liked to see a comparision with other "crypto"-led infra in this space. .eth/ENS, namecoin, .box, .bit for eg.
Why write in such a silly way? Do you mean "Spaces does this"?
We do, you just don't know about:)
SDK: https://github.com/CipherTrustee/certisfy-js
Web trust use: https://bsky.app/profile/bitlooter.bsky.social
Some examples of how you could leverage it: https://blog.certisfy.com/
Happy to answer questions.
this article shows "alice@key" which looks very sensible.
then one click away, joining spaces, you can only get "horse-battery-staple@key AGE age1hsuwgduwhdiehhduwhdiheudhwi..."
and one cannot even pick the first part! pure insanity!