Re: GnuPG Web-of-Trust calculations based on trust-signatures don't add up (T7611)

Daniel Kahn Gillmor via Gnupg-devel <[email protected]> writes:

>  - I generally expect WoT calculations to be cumulative or additive in
>    some sense.

I think that may be a fundamental problem.  I don't know PGP WoT but
here is a thought experiment:

If someone identify themselves using a governmental ID that I can
verify, I tend to assign some trust to that.

If they next identify themselves using ANOTHER governmental ID that
claim something else, I would still tend to assign this identification
some trust, but less than in the first situation.  That's because I now
have proof that some step in my identification is ambigious.

So I don't think identity trust calculations must generally always be
additive when given more information.

Before someone suggests that I shouldn't assign trust to this situation,
recall that this situation happens in the real world.  People show me a
passport and I'm happy to sign the fingerprint.  Then they show me a
driver's id that has another last name or similar and go "oh never mind
the different name, I got married".  I'm still happy to sign the
fingerprint, but I'm not as confident about what the identity really is.

/Simon

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

-----BEGIN PGP SIGNATURE-----

iQNoBAEWCAMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmgaeWgUHHNpbW9uQGpv
c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f
V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z
ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh
BLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XQkBQkNZGbwAAoJENc89jjFPAa+BtIA
/iR73CfBurG9y8pASh3cbGOMHpDZfMAtosu6jbpO69GHAP4p7l57d+iVty2VQMsx
+3TCSAvZkpr4P/FuTzZ8JZe8BrgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx
I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0
+MTXPPY4xTwGvgUCZ9F0SgUJDWRmSQCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R
cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE
8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J
ENc89jjFPAa+wUUBAO64fbZek6FPlRK0DrlWsrjCXuLi6PUxyzCAY6lG2nhUAQC6
qobB9mkZlZ0qihy1x4JRtflqFcqqT9n7iUZkCDIiDbg4BFySz2oSCisGAQQBl1UB
BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA
JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XTSBQkNZGboAAoJENc89jjF
PAa+0M0BAPPRq73kLnHYNDMniVBOzUdi2XeF32idjEWWfjvyIJUOAP4wZ+ALxIeh
is3Uw2BzGZE6ttXQ2Q+DeCJO3TPpIqaXDAAKCRBRcisI/kdFonGZAQDnCNh0ZS78
V9EjWIJf51BOEYJCLB69jbUGsKk/SFPoygEA+AnNAECZyd/+vhH8M7bxcM8QbgTg
zzMrvrmI2qjMXgo=
=IIRs
-----END PGP SIGNATURE-----