gpg for pseudonymous users [was: Re: gpg for anonymous users - Alternative to the web of trust?]

[Stan Tobias]

Daniel Kahn Gillmor <dkg at fifthhorseman.net> wrote:
> On 04/05/2013 11:39 AM, Stan Tobias wrote:
> > Daniel Kahn Gillmor <dkg at fifthhorseman.net> wrote:
>
> >> For a pseudonymous author who wants to establish a credible claim to a
> >> given identity, one way would be to encourage the people who have been
> >> following the work of that author to certify the key.  
[snip]
> > 
> > What would such a certification accomplish?
>
> It establishes a history of someone doing work and being active using
> that name.  Given that it includes an e-mail address, it is effectively
> globally unique (modulo problems with the DNS).

(Modulo a black box in an ISP's locked room.  Modulo other circumstances.
I think it was a misguided idea from the old times that an email
could serve as a personal identifier.)

> If there are two such
> entities, using two separate keys, that's entirely possible.  My
> certification would indicate which one is the one i have come to know as
> "adrelanos <adrelanos at riseup.net>".

So basically you restate what I have said before: you introduce
someone (you help to start a history), and you mark your association (to
differentiate this one from other "adrenaloses"; I don't mean support, but
merely association by knowledge).  The first one is merely a side effect.
As for the latter, I don't believe it is even implicit in a certificate
(at signing parties, people sign keys to persons whom they won't know).
At best, it can be considered a side effect of your signing policy (if
you refuse to sign further "adrenaloses"), but this is not what is being
ceritified anyway.

Certificates are a message to others.  When you sign "Werner Koch"
key, you tell me that you have verified the key owner *is* Werner Koch,
and is willing to identify himself with this key.

Now, when you certify "adrelanos" key (UID, to be precise), do you mean to
tell me you have verified the "real" owner is adrelanos?  Obviously, no.
Do you mean to tell me you've verified that the anonymous owner - the
person who identifies himself by the key - uses the key "adrelanos"?
It's a tautology.  Do you mean to tell me the "invented person" is
adrelanos?  He's that by definition; it's a tautology again.  There is
nothing that can be verified, therefore nothing to certify.  I don't
see any meaning to your certificate.

As I noticed last, what's relevant is that each software issue is signed
by the same key (identified by fingerprint).  The key could be stripped
of any UIDs, and still fulfill its function well.  Thus I don't see what
a certificate could change.


> > Further thoughts for discussion:
> > If I told you my pseudonym was "Werner Koch" (for "John Smith" was already
> > too occupied), would you sign my key?  
>
> Well, i already know a Werner Koch, and i don't think i would sign any
> colliding user IDs without good reason.  If i'm dealing with User IDs
> that are clearly non-global, have no difficult-to-forge corroboration
> (e.g. gov't issued ID), etc, and i have no prolonged experience
> interacting with someone using that identity, i'm likely to decline to
> make that certification.

I have chosen the pseudonym "Werner Koch" to make a contrast.  You suspect
fraud, and refuse to sign my key without checking, because you happen to
know a (important) Werner Koch.  Yet you're willing to sign "adrelanos"
key, because you don't happen to know another adrelanos?  I sense a
logic flaw, and thus a weakness in the signing policy.


> > Why would it take 5 years to
> > convince yourself to sign adrelanos' key; why not 5 months, or 5 weeks?
>
> I said 5 years as an example, not as a magic threshold where my
> confidence in someone's persistent identity kicks in.   I suspect that
> each person has their own sense of this, and can make their own
> decisions about when making a public statement of known identity is
> warranted.  One of the nice things about OpenPGP is that there is no
> requirement for everyone to have the same certification policy.

With time, his reputation may change, and your confidence, but not
his identity.  His identity is established by fiat of his creator,
and will be the same in five years as it is now.  I think it is wrong
to assume time plays any role here.

(With time "adrelanos" may gain history which might further identify him,
but I doubt this whole history will enter his key UID.  For example, on
Werner's key I see only "Werner Koch", not where he lives, what he did,
which schools he finished, where he's been, what beer he likes, and what
his cat looks like.)


> > If someone revealed to you "adrelanos" was a secret FBI operation,
> > would you still sign it?  (FBI behind "adrelanos" might be the true
> > original author of the software, accept bug reports, feedbacks, etc., and
> > I've heard they have really nice blokes there.  So essentially nothing
> > changes, except the state of your knowledge.)
>
> I hope it's clear that my certifying anyone's OpenPGP certificate is a
> statement about who i believe uses a given name and address and what key
> they use.  It is *not* a statement of political affinity, friendship, or
> a technical endorsement.

Sure.  I'd prefer you said "is known by", rather than "uses".

> I am happy to sign the keys of people with whom i have fundamental
> disagreements.  My saying "this is adrelanos' key" does not say anything
[snip]

I'd be willing, too, to sign the Enemy's key, as long as its UID says
"Enemy" and not "Friend".  The problem is that "adrelanos" doesn't
mean anything to you, nor to me, but perhaps it might mean something
to someone else.  This is a reason for my objection to vouching for
anonymous identities.  I think it is dangerous.

Regards, Stan.