Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

Map a public key to a person (in cases where that is even desirable! Which is not most of them) using the web of trust.


Web of Trust systems only work in cooperative environments. In the presence of malicious parties they fail spectacularly.


How so?


A malicious actor can utilize a botnet to skew the crowdsourcing of trust, for example. In other words, in a WOT for identification, one's identification can be invalidated or stolen by someone who purchases cloud time.


Web-of-Trust means there's a link between you and the other entity. The number of people who trust something is not really relevant, so crowdsourcing wouldn't matter. I know there was a service called WOT that relied on that, but in my opinion they were simply misusing the concept.


A pgp wot or the wot that you refer to can be subverted. In the scenario of everyone's identification, the WOT covers everyone in the population not a small WOT inside a relatively much larger population.


How can it be subverted?




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: