-- Leo's gemini proxy
-- Connecting to bbs.geminispace.org:1965...
-- Connected
-- Sending request
-- Meta line: 20 text/gemini; charset=utf-8
there's also this subspace for sharing keys:
gemini://bbs.geminispace.org/s/PGP
2023-10-09 · 8 months ago
I look at a public key like a name. I can say I am Fred Brown, but if you see Fred Brown on another site you don’t even know if they are *claiming* to be the same person. Think of it like a fully qualified name. I can add it to my local address book with your alias on our shared web site, and if I see it someplace else i will know it is supposedly trying to be the same person. It’s also like an email address. Someone else can use my email address to create a login, but they won’t be able. To prove they control it. By signing something I can prove I control my public key.
If I trust the BBS web site then the site can display a verified user supplied public key associated with a user on the site. So the site can make the claim that login=fred is the same as key=ABCXYZ. If other sites that I trust also have a login that seems to talk like Fred with the same verified public key, then I know it’s the same person. If another site spoofs Fred’s key and uses it without his authorizing it, it doesn’t make his key useless, it just spoils my trust in that site.
Step 1) A user friendly, transportable public key. Step 2) Social sites let me voluntarily validate the key using the site and the site announces it on my profile page. Step 3) clients add features that can copy/paste the keys into a client-local address book. Step 4) user friendly transportable identity, the low tech way!
That was pretty much the idea, yes. Rather than share the public key I proposed hashing again then sharing only part, that makes it really only useful for matching identities.
You still have the problem that users could post e.g. to Bubble claiming particular hash. You have to have a "known trusted place" e.g. user profile where the server shares it correctly, and teach people to trust only that.
I think the key advantage to the accepted "link both from somewhere you control" method is that posting hashes does not favour personal capsule owners, instead it relies on trustworthy shared/social capsules.
Thanks.
I guess I see the problem in two parts. 1) who is this person *claiming* to be? 2) Do I trust the claim?
For step one we need a global unique name (that’s provable). For step two it will always be a grey area depending on what sites you personally trust. Different people will trust different sites.
I was thinking about ways to sign a gemtext message with a key and I remember a post a while back talking about posting keys. But my gemsearch king-fu is weak. Can anyone help me? I remember they had the idea of a pictograph for a public key. Maybe I’d want another pictograph for the digest signature? (I know my terminology is wrong there.)
-- Response ended
-- Page fetched on Sun Jun 2 12:34:20 2024