Robot CA at toehold.com

[David Shaw]

On Tue, Dec 10, 2002 at 03:07:40PM -0000, greg@turnstep.com wrote:

> The main objection I have to getting any sort of robot or automated gnupg 
> user into the WoT is that the robot is inherently insecure. You have a 
> program that is signing keys on machine connected to the internet, and 
> the passphrase *and* secret key are both stored on the box. I know that 
> not everyone stores their secret key on removable media far from the 
> public internet, but I do think that the great majority of the people 
> in the WoT store their passphrase in memory only.

This is not necessarily true - I wrote a robot which has the same
general concept as the other robots, but does no signing online.  I
wasn't satisfied with including a key on a internet-connected machine,
so the robot code just handles the grunt work and then passes me a
list of keys to sign offline.  That robot, incidentally, is not
running.

I totally agree about storing the key online though.  It would be a
real mess if a CA secret key was stolen.

> I would really like to see all robots and automated scripts kept out 
> of the WoT and continue to assume (hope?) that all signatures inside of the 
> web were performed correctly by actual people. Barring that, I'd like to 
> have an option to the various WoT trace programs that allow certain keys 
> to be excluded. This sounds easier than trying to account for 
> signature levels, which are not reliable anyway, as many have pointed 
> out.

I think we want the same thing, but are going about it differently.  I
want robots and scripts kept out of the web of trust... but if they do
leak in there, I don't want them excluded from the various web mapping
programs.  By that point, the damage is done and they are for better
or for worse part of the web.  Of course, it could be argued that this
would encourage people to sign robot keys, so perhaps it is indeed
better to leave them out.  I don't like that as the mappers will then
show a different web of trust than the real world will.

David

-- 
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson