[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [Debconf-discuss] list of valid documents for KSPs

On 30 May 2006, Theodore Tso stated:

> On Tue, May 30, 2006 at 07:49:34AM -0500, Manoj Srivastava wrote:
>>> What Martin Krafft showed you was,
>> How do I know that person actually was  Martin Krafft?
> So if you have no idea whether or not someone was Martin Krafft, how
> can you ask everyone to revoke all signatures for Martin Krafft as
> you did earlier.  That is really unreasonable.

        The person who I thought was Marting has apparently revealed
 that the identity documents that were preseted to the key signing
 party participants were ones that did not come out of a trusted
 process.  Typically, the identity papers are produced by official
 bodies, like governments, that have international treaties in place
 to assure a minimal conformance of identity checks.

        Given that, it is entirely reasonable to ask for signatures to
 be revoked,  since this was not the first time such an "experiment"
 has apparently been conducted.

> Does that mean that if someone shows up at an future keysigning
> party at OLS, for example, with an Transational Republic ID which
> has the name "Manoj Srivastava", that everyone would be therefore be
> entitled to demand on debian-devel that all signatures for "Manoj
> Srivastava" should now be revoked?

        I would think that if an imposter was running around, and if
 people were no longer sure that such an imposter twas the one whose
 ID they had based their signatures on, HELL YES!!!

> After all, we have no idea if anyone who might or might not have
> been "Manoj Srivastava" might or might not have produced an
> identification documents that may or may not have been false.  We
> don't know!

        Then please do revoke your signature on a key that purports to
 be mine.

> Do you see how rediculous this is?  How irrational you are being?

        I think you are the one being irrational talking about a "web
 of trust" and blithely signing keys for people who conduct "tests" to
 see how weak processes of "trust" are.

        If I, or someone posing as me, has ever done anything to
 damage trust in my identity, REVOKE YOUR SIGNATURES FROM MY KEY.

        Is that plain enough for you? 
> Had Martin never mentioned this, it would have been a non-issue.
> There is no real damage. While signatures may have been based on a
> non-offical ID, Martin did indeed own the key in question, so the
> end harm is zero. But Martin decided to publish this experiment

        Err, while you so assert, and perhaps you have inside
 information that enables you to make that statement, I have no such
 recourse.  How do I know someone called Martin does own that key,
 except by hearsay?

> So, if KSPs are not changed, then the Web of trust becomes
> effectively worthless.  Manoj should be far more concerned about
> that, then about Martin's demonstration of this.

        Well, KSP's in Debian are essentially dead, as far as I am
 concerned, since the community has not come to an agreement that
 bringing Bubba's passports is an unacceptable action.  Everyone is
 actring the ostrich, claiming that the burden lies on the
 verification process of the signer, despite the fact that it is
 essentially impossible to detect the forgery without specialized
 equipment and  access to government data files.

        Since we have rejected a social workaround of deprecating
 Bubba's passports (like, you know, in other unpublished "tests"), I
 fail to see how one can actually sign a key in the community.  I
 can't tell Bubba's ID's from the official ones.

On 30 May 2006, Joe Smith told this:

> Let me try to spell it out another way.  Either the entity at the
> the KSP who was allegedly Martin Krafft was indeed Martin Krafft, or
> he was not.  It must be one or the other; you seem to be arguing
> things both ways, and you don't get to do that.

        Sigh.  Your logic is flawed.  I met someone who claimed to be
 Martin. I find that there is now doubt about the papers presented by
 such an individual. A person who owns that key claims to have
 presented papers of uncertain provenance. If you think this has
 nothing to do with the validity of the process of signing that key,
 especially  since my memory of the actual checking process is
 unclear, and that many people bought into that identity papers, I
 certainly am ginna lower the trust I place in your ability to
 determine how the web of trust is extended.

On 30 May 2006, Henning Makholm stated:

> Scripsit Manoj Srivastava <srivasta@debian.org>
>> Nothing that a general software developer can do to check an ID is
>> proof against a determined individual, we all assume that there is
>> a gentleman's agreement in place that such an attack is not
>> mounted.
> If you _really_ believed that you could depend on people keeping any
> gentleman's agreement, the whole charade of holding a KSP would be
> completely pointless.

        If you think that you can check an ID if there are no
 expectations of good faith, then you are sticking your head in the
 sand, and ignoring the fact that false identification papers, made
 from official blank passports, are readily available, in all parts of
 the world (despite what Ron Johnson said out of sheer ignorance). 
> The only reason to hold a KSP is that one _does not_ believe that
> people are capable of keeping gentlemen's agreements.
        Then you might as well sign every key on the key servers --
 since for a couple of hundred dollars anyone can present you with any

> A security mechanism that only works in the non-presense of
> fraudsters is no security mechanism at all.
> A KSP that depends on there being any pre-existing trust to abuse is
> *completely worthless* as a KSP whether or not that trust is abused
> or not.
        You just dismissed signing PKA keys by individuals.  There is
 no way that an individual with access to official records can
 determine if a particular passport is a "test" passport or not.

On 30 May 2006, Steve Langasek said:

> On Tue, May 30, 2006 at 06:28:32AM -0500, Manoj Srivastava wrote:
>> Nothing that a general software developer can do to check an ID is
>> proof against a determined individual, we all assume that there is
>> a gentleman's agreement in place that such an attack is not
>> mounted.
> I assume no such thing.  I maintain a healthy degree of skepticism
> regarding the true motives and identities of everyone, including
> those whose keys I've signed.  It just doesn't interfere with my
> ability to work with people in advancement of Debian's goals,
> because I recognize that statistically it can't *matter*: assuming
> the worst about people is no better than assuming the best, because
> it basically requires throwing away all collaboration in a project
> like this in spite of the fact that in over 10 years of Debian's
> existence 

        In other words, in 10 years of Debian's existence, no one has
 violated the trust, so now you expect people not to bring in
 passports from Bubba.  I agree. We have 10  years of history of
 people not violating the gentlemen's agreement that we are aware of.

> In other better words, Bubba is known to sell forgeries, but the
> Transnational Republic is not known to sell them.

        You might have a trust path to such information. I am pretty
 sure I do not.  I see little difference between Bubba's Transnational
 Republic ID's and Transnational Republic's ID's that say
 Transnational Republic, given the knowledge I currently possess.


Isn't air travel wonderful?  Breakfast in London, dinner in New York,
luggage in Brazil.
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C

Reply to: