web of trust

Beautiful security
by Andy Oram and John Viega
Published 15 Dec 2009

Neal McBurnett (see “References” on page 129) analyzed the network structure of the Web of Trust digraph. He examined the digraph for path lengths, connectedness, degree of scale, and other features. 128 CHAPTER SEVEN Mark Reiter and Stuart Stubblebine created PATHSERVER (see “References” below), a way to evaluate multiple signature paths between keys. These analyses are inspired by the Web of Trust and derive from the Web of Trust, but we must note that they are orthogonal to the Web of Trust proper. It is an integral feature of the Web of Trust that it consists of viewpoints; it may be considered relativistic, in that no frame of reference in the Web of Trust is inherently more valuable or trusted than any other.

…

But large, disconnected networks of people may find it difficult to use the basic Web of Trust because there are few paths between people who do not already know each other. As the Web of Trust includes more nodes with relatively few edges, finding trust paths becomes difficult. The Web of Trust works at its best with groups of people who have some connections. It does not work well with a large, ubiquitous network like the Internet. However, there are two saving graces—modern social networking reconstructs the sorts of small networks that are ideal for the Web of Trust. It may not work well on the Internet as a whole, but it works well in the Internet that most of us use.

…

It is an integral feature of the Web of Trust that it consists of viewpoints; it may be considered relativistic, in that no frame of reference in the Web of Trust is inherently more valuable or trusted than any other. The trust portion of the Web of Trust relies completely on the user-specific trust markings and the weights that the key holder places on keys. The mesh of keys is an interesting object that we believe is useful on its own, and helps the overall use of the Web of Trust, but it is an orthogonal construct to the Web of Trust. The Web of Trust’s directed graph says something about the people in it. What it says, though, is open to both further research and debate. References Allman, E., J. Callas, M. Libbey, J. Fenton, and M. Thomas. DomainKeys Identified Mail (DKIM) Signatures, RFC 4871, http://www.ietf.org/rfc/rfc4871.txt.

Peer-to-Peer
by Andy Oram
Published 26 Feb 2001

.), File sharing: Napster and successors, Cultivating the Gnutella network, Reducing broadcasts makes a significant impact regular graphs, The small-world model–The small-world model Freenet case study, Initial experiments Reiter, Michael, Reputation metrics Reive, Catherine, Acknowledgments rekey delta messages, The New-Member-Added delta message relay servers for peer communication, Message fanout–Message fanout reliability with anonymity, Reliability with anonymity–Reliability with anonymity remailers, Mixmaster Remailers–General discussion, Communications channel impact on accountability, Peer-to-peer models and their impacts on accountability remote proxies (Publius), Publius proxy volunteers replenishable resources, An economic rather than legal challenge replicable resources, An economic rather than legal challenge reply blocks, Free Haven, Elements of the system reputation, Accountability, Reputations–True decentralization, Reputation–Summary automatic handling via web of trust, Codifying reputation on a wide scale: The PGP web of trust–Codifying reputation on a wide scale: The PGP web of trust calculating using a Bayesian approach, Reputation metrics–Reputation metrics can be sold or stolen, Reputation for sale—SOLD! codifying with web of trust, Codifying reputation on a wide scale: The PGP web of trust–Codifying reputation on a wide scale: The PGP web of trust default score is important, Bootstrapping Free Haven, Reputation system, Reputation systems–Reputation systems attacks on the system, Attacks on the reputation system broadcasting referrals, Reputation systems pseudonyms and, Reliability with anonymity good vs. bad, determining, Collecting ratings identity as an element of, Identity as an element of reputation key certification problem, Codifying reputation on a wide scale: The PGP web of trust macropayment digital cash schemes and, Anonymous macropayment digital cash schemes meta-reputation problem, Multiple trusted parties metrics, Reputation metrics–Reputation metrics portable, Interdomain sharing real world vs.

…

asymmetry between web servers and, The writable Web caching pages, Caching and mirroring protocol-centric namespaces and, An explosion of protocols web of trust, Signature verification, Codifying reputation on a wide scale: The PGP web of trust–Codifying reputation on a wide scale: The PGP web of trust key revocation problem, Codifying reputation on a wide scale: The PGP web of trust overtaken by hierarchical PKIs, System successes and failures PKIs as alternative to, Codifying reputation on a wide scale: The PGP web of trust scalability question, Codifying reputation on a wide scale: The PGP web of trust web servers Akamai, Active caching and mirroring asymmetry between web browsers and, The writable Web Publius Servers, Publius, Risks involved in web server logging risks involved in logging, Risks involved in web server logging–Anonymizing proxies web services, Web services and content syndication web sites blocking, Red Rover–Red Rover using IP addresses, Client life cycle for Free Software Foundation (FSF), A success story: From free software to open source for peer-to-peer, Peer-to-peer web site for Publius, Publius in a nutshell Website web server, The writable Web Werbach, Kevin, Napster: Harnessing the power of personal selfishness Werthimer, Dan, SETI@home Whitten, Alma, Future work Wiki, The writable Web Wiley, Brandon, Contents of this book, Interoperability Through Gateways–Acknowledgments, Contributors Winamp, Gnutella’s first breath Winer, Dave, File sharing: Napster and successors, Conversations and peers EditThisPage.Com, The writable Web Woolsridge, Brett, Acknowledgments World Free Web (WFW) project, Existing projects World Wide Web abuse of port 80, Abusing port 80 anonymizing proxies and, Anonymizing proxies as a form of conversation, Conversations and peers as small-world domain, Initial experiments brief history of, Evolving toward the ideal combined with Freenet, Existing projects conversational technologies, Jabber: Conversational Technologies–Conclusion data models for, Where’s the content?

…

The higher the trust level, the more confidence Bob can have in using the key. A perennial question about the web of trust, however, is whether or not it scales. Small groups of people can create a web of trust easily, especially if they can meet each other in person. What happens when we try to make the web of trust work for, say, a consumer and a merchant who have never met before? The conventional wisdom is that the web of trust does not scale. After all, there is a limit to how many people Alice and Bob can know. The most frequently cited alternative to the web of trust is a so-called Public Key Infrastructure. Some trusted root party issues certificates for keys in the system, some of which go to parties that can issue certificates in turn.

Little Brother
by Cory Doctorow
Published 29 Apr 2008

> OMG we're doomed > No it's not that bad but we need to figure out who we can trust > How? > That's what I wanted to ask you -- how many people can you totally vouch for like trust them to the ends of the earth? > Um 20 or 30 or so > I want to get a bunch of really trustworthy people together and do a key-exchange web of trust thing Web of trust is one of those cool crypto things that I'd read about but never tried. It was a nearly foolproof way to make sure that you could talk to the people you trusted, but that no one else could listen in. The problem is that it requires you to physically meet with the people in the web at least once, just to get started

…

Darryl and I, when we traded keys, that was kind of a mini-keysigning party, one with only two sad and geeky attendees. But with more people, you create the seed of the web of trust, and the web can expand from there. As everyone on your keyring goes out into the world and meets more people, they can add more and more names to the ring. You don't have to meet the new people, just trust that the signed key you get from the people in your web is valid. So that's why web of trust and parties go together like peanut butter and chocolate. # "Just tell them it's a super-private party, invitational only," I said. "Tell them not to bring anyone along or they won't be admitted."

…

Making things well-known is just as hard as keeping them secret. Think about it -- how many billions of dollars are spent on shampoo ads and other crap, just to make sure that as many people know about something that some advertiser wants them to know? There's a cheaper way of fixing man-in-the-middle: the web of trust. Say that before you leave HQ, you and your bosses sit down over coffee and actually tell each other your keys. No more man-in-the-middle! You're absolutely certain whose keys you have, because they were put into your own hands. So far, so good. But there's a natural limit to this: how many people can you physically meet with and swap keys?

Smart Mobs: The Next Social Revolution
by Howard Rheingold
Published 24 Dec 2011

If you can use it and pay for it, you can find an Epinion about it. Members can rate each review as “Highly Recommended,” “Recommended,” “Somewhat Recommended, or “Not Recommended.” Members can click a button next to the name of an Epinionator and add him or her to a personal “web of trust.” People who trust each other inherit each other’s webs of trust. Although webs of trust are an official feature of Epinions, the first web of mistrust appeared spontaneously, created by a user. Epinions continuously publishes updated ratings for the community to see. This feature is mentioned by some habitual users who joke about their prolific contributions as a compulsion: “I am addicted to a drug called Epinions.

…

eBay, dominant survivor of the e-commerce bubble, uses a reputation system to facilitate billions of dollars worth of transactions for people who don’t know each other and who live in different parts of the world. Epinions pays contributors of the most popular online reviews of books, movies, appliances, restaurants, and thousands of other items. Epinions’s reputation system enables people to rate reviewers and to rate other raters through “webs of trust.” The most trusted reviewers are read by more people and therefore make more money. Slashdot and other self-organized online forums enable participants to rate the postings of other participants in discussions, causing the best writing to rise in prominence and most objectionable postings to sink.

…

The MIT researchers started a company named Firefly to commercialize Ringo and sold it to Microsoft in 1998. Microsoft eventually implemented its own version of Firefly’s “digital passport” technology.2 Ringo turned out to be the progenitor of an evolutionary lineage. Finding new books, movies, or music is a popular pursuit, but it represents only one form of the myriad webs of trust that support markets, scientific enterprises, businesses, and communities. Consider the history of online knowledge-sharing economies. One of the most seductive aspects of social cyberspace is the way virtual communities share useful information. I remember how excited I became in the 1980s, when the never-ending “Experts on the Well” discussion inspired people in the Well, a virtual community of a few thousand, to compete for the honor of providing the fastest and most accurate answers online to questions posed by other members of the community.3 This custom is more sophisticated than automated word-of-mouth systems like Ringo because it requires each human recommender to keep in mind many other people’s intellectual preferences, gleaned solely from online conversations.

Snowden's Box: Trust in the Age of Surveillance
by Jessica Bruder and Dale Maharidge
Published 29 Mar 2020

His public key had been vouched for by some of the most respected figures in the world of digital privacy. That made it a reliable node in the crowdsourced, decentralized verification system that encryption users call a “web of trust.” It’s easy to go down a rabbit hole when you’re talking about how to build trust in the digital world. That’s why so much writing about blockchain is inscrutable. But the basic principle behind using a web of trust to leverage credibility is simple. In an online article explaining why it’s so important, Henk Penning, a developer at Utrecht University, arrived at a conclusion that would please fans of The Matrix.

…

pp. 72–3 “The surveillance you’ve experienced means you’ve been selected”: Poitras, Citizenfour, 4:22–5:06. p. 73 DARKDIAMOND for Laura and SILVERSHOT for Micah: Poitras, Astro Noise, 101. p. 73 COPPERCOMET for Greenwald: Edward Snowden to Laura Poitras in an encrypted email on April 21, 2013. pp. 73–4 Henk Penning on trust: “On the Apache.org Web of Trust,” WebCite, webcitation.org. p. 76 “Whatever they were doing was sensitive”: Lee, “Ed Snowden Taught Me to Smuggle Secrets.” pp. 76–7 “confirm that no one has ever had a copy of your private key”: Poitras, Citizenfour, 1:19–1:27. p. 80 Lindsay Mills: Paul Lewis, “Edward Snowden’s Girlfriend Lindsay Mills: At the Moment I Feel Alone,” Guardian, June 11, 2013. 4.

Linux Security Cookbook
by Daniel J. Barrett , Richard E. Silverman and Robert G. Byrnes
Published 8 Jun 2003

GnuPG allows keys to be signed, indicating that the signer vouches for the key. It also lets you control how much you trust others to vouch for keys (called "trust management"). When you consider the interconnections between keys and signatures, as users vouch for keys of users who vouch for keys, this interconnected graph is called a web of trust . To participate in this web, try to collect signatures on your GnuPG key from widely trusted people within particular communities of interest, thereby enabling your key to be trusted automatically by others. Public-key methods are also the basis for digital signatures : extra information attached to a digital document as evidence that a particular person created it, or has seen and agreed to it, much as a pen-and-ink signature does with a paper document.

…

A keyserver does absolutely nothing to assure the ownership of keys. Anyone can add a key to a keyserver, at any time, with any name whatsoever. A keyserver is only a convenient way to share keys and their associated certificates; all responsibility for checking keys against identities rests with you, the GnuPG user, employing the normal GnuPG web-of-trust techniques. To trust a given key K, either you must trust K directly, or you must trust another key which has signed K, and thus whose owner (recursively) trusts K. The ultimate way to verify a key is to check its fingerprint with the key owner directly. [Recipe 7.9] If you need to verify a key and do not have a chain of previously verified and trusted keys leading to it, then anything you do to verify it involving only computers has some degree of uncertainty; it's just a question of how paranoid you are and how sure you want to be.

…

But the more smartly selected checks you make, the more independent servers and systems an attacker would have to subvert in order to trick youand thus the less likely it is that such an attack has actually occurred. This process will also merge new signatures into an existing key on your key ring, if any are available from the keyserver. 7.21.4 See Also For more information on the web of trust, visit http://webber.dewinter.com/gnupg_howto/english/GPGMiniHowto-1.html. Recipe 7.22 Revoking a Key 7.22.1 Problem You want to inform a keyserver that a particular public key (of yours) is no longer valid. 7.22.2 Solution Create a revocation certificate: $ gpg --gen-revoke --output certificate.asc key_id Import the certificate: $ gpg --import certificate.asc Revoke the key at the keyserver: $ gpg --keyserver server_name --send-keys key_id Delete the key (optional) $ gpg --delete-secret-and-public-key key_id THINK CAREFULLY BEFORE DELETING A KEY.

The Orbital Perspective: Lessons in Seeing the Big Picture From a Journey of 71 Million Miles
by Astronaut Ron Garan and Muhammad Yunus
Published 2 Feb 2015

Moreover, if we tie all M a ss Coll a bo r at io n â•…  147 these developments in mass collaboration with better accountability, through pay-for-performance models and the improved data feedback made possible by the widespread use of inexpensive sensors, we can see vast improvements in the effectiveness of development work worldwide. In the next and final chapter, we will look at what significance and opportunities these collaborative capabilities present for the trajectory of our global community. This page intentionally left blank Conclusion A Web of Trust Like the U.S.–╉Russian space program that led up to it, the planning and construction of the International Space Station required the partners involved to overcome some unique challenges. The collaboration brought together fifteen nations with different bureaucratic and political processes and differing national objectives and interests, geographically separated on three continents.

…

Whether or not you believe that it is possible to develop real trust-filled relationships online, I think it’s reasonable to consider Willow Brugh’s view: “I think we are able to open the door to build trust more quickly and to be more aware and accepting through online interaction. I think we’re also able—╉and this is the key point—╉to expand the web of trust, where I might not trust you directly but I have met someone that you know and trust them explicitly, and therefore I’ll trust you as well.” I am really fascinated by this possibility, and we have only begun to scratch the surface of what’s possible when we connect seven billion problem solvers—╉and then connect those problem solvers with needed data and tools.

…

Panelists included Phil Dixon and Jeff Martin from Google, Jeremy Johnstone from Yahoo, and Patrick Svenburg from Microsoft, with Greg Elin from the Sunlight Foundation moderating. 2.╇ Luis von Ahn, “Massive-Scale Online Collaboration.” Filmed April 2011. TED video, 16:39. http://www.ted.com/talks/luis_von_ahn_massive _scale_online_collaboration?language=en. Conclusion: A Web of Trust 1.╇ Carl Sagan, Pale Blue Dot: A Vision of the Human Future in Space (New York: Random House, 1994), 7. 2.╇ Founding members of Impact CoLab are Ron Garan, Elyse David, Krishan Arora, Ness Knight, Daria Musk, Dan Cook, and Ali Llewellyn. 3.╇ Star Harbor Space Training Academy is a project conducted through Space Development Ventures.

Coding Freedom: The Ethics and Aesthetics of Hacking
by E. Gabriella Coleman
Published 25 Nov 2012

A remarkable accomplishment for someone who’s been with the project this long, but not so surprising for someone whom no other developer has, as far as I can tell, ever claimed to have met in person.21 When it became clear that Miller, who occupied a crucial technical position in the project at that time, was outside the web of trust, there was such alarm that within three days, two developers drove to meet the individual in question and succeeded in bringing him into the cryptographic network. The developers’ strong reactions demonstrated the essential nature of these infrequent face-to-face interactions and significance of verifying the identity of one of their technical guardians. Integration into Debian’s web of trust is thus a vital first step in new maintainers’ integration into the Debian project. This process connects and leads into the second and often most rigorous part of the NMP: philosophy and procedures.

…

This is a process of identity verification that can then be used over the Internet to confirm, with certainty, that an individual is who they say they are. By requiring new developers to obtain the signature of an existing Debian developer, the NMP integrates them into what they call a cryptographic “web of trust.” Because nearly every hacker within Debian has a key signed by at least one existing developer, and because many developers have keys signed by numerous others (the stronger the connected set of signatures is, the more trustworthy it is considered), nearly all maintainers are connected. Debian can use cryptographic algorithms to prove that most every developer met at least one other developer, who in turn met at least one other developer, and so forth, until every developer is linked.

…

It is a step that brings a developer closer to a new social localization within a larger ethical and technical project of developers who have also undergone the same reflective exercise. Through this reconfiguration of temporality, developers after the NMP can be said to share at least three connections: they are technologically linked through the web of trust that requires them to meet at least one other developer; they share the experience of a common ritual of entry; and finally, they have started to learn a Debian-specific vocabulary with which to situate themselves within this world, formulate the broader implications of freedom, and continue the conversation on freedom, licensing, and their craft, with a wider body of developers.

The Truth Machine: The Blockchain and the Future of Everything
by Paul Vigna and Michael J. Casey
Published 27 Feb 2018

Unlike the KYC solution, which seeks smarter ways for people to prove who they are, this one lowers the barrier to entry by finding efficiencies in the system itself so that it’s less important to “know your customer.” Whether WeTrust’s model works or not, it may help us learn a lot about how these new systems of algorithmic, distributed trust can interface with those old, deeply embedded social webs of trust. We think it’s important that solutions to the challenges faced by the poor aren’t just imposed in some cookie-cutter manner by Silicon Valley venture capitalists who insist they know best. Solutions must be informed by and tailored to the underlying cultural structures of the communities in question.

…

Those latter two categories have become more fluid, especially in the age of social media and as our cultures become more open to new ways of defining what it means to be human, whether that breaks down along sexual orientation, gender, or religious, racial, or ethnic grounds. What’s powerful, though, is that the technologies driving those changes now also make it possible to turn these more dynamic aspects of who we are into a means of proof—primarily in the realm of our social identity. Our circle of friends and interactions constitutes a web of trust that has its own powerful, informational value. If that circle incorporates a large number of essentially trustworthy people—no one among them is on the no-fly list, for example—it’s possible to deduce with decent probabilities that you are also trustworthy—or at least that you should be given a positive score, to be confirmed or challenged by other measures of your trustworthiness.

…

Done poorly, we are almost guaranteed to create biased benchmarks of “worthiness” that discriminate against those who, for whatever cultural, circumstantial, or personal reason, don’t meet the algorithm’s standard. Do I have better or worse credit if I view a lot of Republican political Web sites? This is dangerous territory. As pseudonymous cryptocurrency journalist Juan Galt put it, a web of trust can become an Orwellian web of shame. Influential cryptocurrency thinker Andreas Antonopoulos argues that the problem lies in trying to solve identity in the first place, which he says is in breach of what Bitcoin’s open, permissionless architecture represents. Blockchain developers building these identity/reputation tools are promoting a “relic of traditional financial systems,” he argues.

Engineering Security
by Peter Gutmann

Because of this it’s been suggested that these revocation-proof CAs be marked as such in their certificates so that applications can avoid the overhead of having to check for a revocation that will never happen [149]. B A Bob Alice C D Figure 184: The web of trust PGP’s version of X.509’s hierarchical trust model is the web of trust [150], shown in Figure 184. The theory behind the web of trust is that although Alice doesn’t directly know Bob, she does know A and C, who in turn know B and D, who know Bob, and 676 PKI so Alice can build a trust link to Bob (or at least Bob’s public key) through these indirect paths. In practice though it’s doubtful that the web of trust can really deliver [151][152]149. For example when fake keys for Tor developers started appearing [153] it proved impossible to verify the developers’ genuine keys through the web of trust [154].

…

[146] Nelson Bolyard, posting to discussion thread for “Most common trusted root certificates”, 15 June 2010, http://netsekure.org/2010/04/most-commontrusted-root-certificates/#comment-435. [147] “E-Gesundheitskarte: Datenverlust mit Folgen“, Detlef Borchers, 10 July 2009, http://www.heise.de/security/news/meldung/141864. 744 PKI [148] “Loss of data has serious consequences for German electronic health card”, Detlef Borchers, 11 July 2009, http://www.h-online.com/security/news/113740. [149] “Re: [TLS] New version of Multiple OCSP mode of Certificate Status extension”, Peter Gutmann, posting to the tls@ietf.org mailing list, messageID E1OgKhk-0006UP-Fe@wintermute02.cs.auckland.ac.nz, 4 August 2010. [150] “The Evolution of PGP’s Web of Trust”, Phil Zimmermann and Jon Callas, in “Beautiful Security”, O’Reilly, 2009, p.107. [151] “Reflecting on PGP, keyservers, and the Web of Trust”, Greg Rose, posting to the cryptography@c2.net mailing list, message-ID 4.3.1.0.20000901145546.00c55100@127.0.0.1, 1 September 2000. [152] “Investigating the OpenPGP Web of Trust”, Alexander Ulrich, Ralph Holz, Peter Hauck and Georg Carle, Proceedings of the 16th European Symposium on Research in Computer Security (ESORICS’11), Springer-Verlag LNCS No.6879, September 2011, p.488. [153] “Another fake key for my email address”, Erinn Clark, posting to the tortalk@lists.torproject.org mailing list, 9 March 2014, message-ID 20140309192556.gc5591@berimbolo.double-helix.org. [154] “Re: Another fake key for my email address”, Guido Witmond, posting to the tor-talk@lists.torproject.org mailing list, 10 March 2014, message-ID 531DABE1.5020006@witmond.nl. [155] “Codes of the Underworld”, Diego Gambetta, Princeton University Press, 2009. [156] “Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0”, Alma Whitten and J.

…

For example when fake keys for Tor developers started appearing [153] it proved impossible to verify the developers’ genuine keys through the web of trust [154]. This doesn’t mean that the concept can’t be usefully applied in practice though. Outside the computer security field it’s used extensively by organised-crime groups like the mafia, who employ complicated chains of introducers to prevent an outsider (typically an undercover agent) from posing as a legitimate Mafioso [155]. As an example of the kind of problems that a web-of-trust-based security system can run into, in one (informal) experiment into the effectiveness of PGP’s key distribution mechanism a professor asked his students to securely exchange PGP keys and then follow this up with an exchange of encrypted email (which in previous experiments had already proven very problematic), but with an extra twist: They were given bonus marks for spoofing keys and otherwise attacking the security of the key management process.

Crypto: How the Code Rebels Beat the Government Saving Privacy in the Digital Age
by Steven Levy
Published 15 Jan 2002

Since Carol knows Bob—and has earlier received a verified copy of Bob’s public key—she can establish the veracity of his signature. If it checks out, that means that Bob has really met the person who holds this new key and is implicitly telling Carol, “Hey, it’s really Alice.” So Carol can be sure that Alice is who she says she is. At least to the degree she trusts Bob. This system—known as a “web of trust”—requires some judgment on the user’s part. After all, Carol can’t be sure of Alice’s identity unless she personally knows someone who has physically met her and signed her key. What if she doesn’t know anyone who’s physically signed it? Is it worth trusting a second-level verification? Maybe her friend Bob hasn’t signed Alice’s key, but he has signed a key of someone named Ted.

…

Seeing one of those trusted introducers on a key ring would be a strong assurance of authenticity. In any case, PGP allowed users to set what cryptographer Bruce Schneier refers to as “paranoia levels”: how many levels of separation you’re willing to accept, depending on the degree to which you trust various signers. With this web of trust, a stronger encryption algorithm, a better interface, and a number of other improvements, PGP 2.0 was—unlike Zimmermann’s favorite weekend comedy show—ready for prime time. The informal team of programmers had even prepared translations of the interface in several languages, so people worldwide could use it from the day of release.

…

., ref-1, ref-2 substitution boxes (S-boxes), ref-1, ref-2, ref-3, ref-4, ref-5, ref-6, ref-7 SWIFT, ref-1 T Attack (differential cryptanalysis), ref-1, ref-2, ref-3 telephones: cellular, ref-1 security devices for, ref-1, ref-2, ref-3, ref-4, ref-5, ref-6, ref-7, ref-8, ref-9, ref-10 Tempest technology, ref-1 Tenet, George, ref-1 Tessera, ref-1 threshold scheme, ref-1 Time, ref-1 time-sharing, ref-1, ref-2 toll payments, ref-1 trapdoors, ref-1, ref-2, ref-3, ref-4, ref-5, ref-6, ref-7, ref-8, ref-9 knapsacks, ref-1, ref-2, ref-3, ref-4, ref-5, ref-6 one-way function, ref-1, ref-2, ref-3, ref-4 Senate bill and, ref-1, ref-2, ref-3 Tritter, Alan, ref-1, ref-2, ref-3, ref-4 Tuchman, Walter, ref-1, ref-2, ref-3, ref-4, ref-5, ref-6, ref-7, ref-8, ref-9, ref-10 univectors, ref-1, ref-2 Usenet, ref-1, ref-2 vector space, ref-1 VeriSign, ref-1 Very Large Scale Integration (VLSI), ref-1 ViaCrypt, ref-1 virtual private networks, ref-1 Wagner, Dave, ref-1 Walker, Steve, ref-1 Wall Street Journal, ref-1, ref-2 Warren, Jim, ref-1, ref-2 Washington Post, ref-1 web of trust, ref-1 Weingarten, Fred, ref-1 Weldon, Curt, ref-1 Williamson, Malcolm, ref-1, ref-2, ref-3, ref-4, ref-5, ref-6 Windows, ref-1 wiretapping, ref-1, ref-2, ref-3, ref-4, ref-5, ref-6, ref-7 Wise, William, ref-1 World Wide Web, ref-1, ref-2 browsers for, ref-1, ref-2, ref-3 Wormser, Dave, ref-1 Wylie, Shawn, ref-1 Xerox Corporation, ref-1, ref-2 xor operations, ref-1 Zero Knowledge, ref-1 zero-knowledge proofs of identity, ref-1 Zimmermann, Kacie, ref-1 Zimmermann, Phil, ref-1, ref-2, ref-3, ref-4, ref-5, ref-6, ref-7, ref-8, ref-9, ref-10, ref-11 contents acknowledgments preface the loner the standard public key prime time selling crypto patents and keys crypto anarchy the clipper chip slouching toward crypto epilogue: the open secret notes bibliography glossary index VIKING Published by the Penguin Group Penguin Putnam Inc., 375 Hudson Street, New York, New York 10014, U.S.A.

Lying for Money: How Fraud Makes the World Go Round
by Daniel Davies
Published 14 Jul 2018

It is even possible to create a distributed control fraud, in which the mechanism of fake profits, high risk and value extraction arises without the necessary involvement of a single legally culpable actor, by assembling a set of perverse, ‘criminogenic’ incentives which make the distortions happen independently. Finally, we reach the highest level of abstraction. These frauds exploit the general web of trust which makes up a modern economy, rather than a single relationship. There are plenty of actions which are not even really crimes at all in the traditional sense – they are not obviously or intrinsically dishonest activities. Nevertheless, experience has shown us that a market economy works better if people are able to assume that they won’t be done.

…

Land is physical and tangible and hard to steal, but an inheritance right is something different; you can’t always tell whether it’s been stolen from you and promised to someone else. As soon as the concept of a property right was invented, as soon as ownership got more complicated than simply the ability to control things by fighting anyone else who wanted them, there is a need for a social web of trust that the rights will be respected and not misused. And where there’s trust, there’s the opportunity for fraud. Inheritances also have another important property when we look at them as potential locuses of fraud; they were one of the few ways in which abstract property rights over large and valuable things could come to be owned by women.

A First-Class Catastrophe: The Road to Black Monday, the Worst Day in Wall Street History
by Diana B. Henriques
Published 18 Sep 2017

While some traditionalists might cheer to see the innovative troublemakers in Chicago brought low, it would be a body blow to the financial system. That system was held together by invisible strands of trust—the confidence that debts would be paid, trades would be settled, institutions would function, money would circulate. Shred that web of trust, and the system would not hold together. The Merc simply had to open on time on Tuesday; the world had to see that it and its trading firms could be trusted. These were not Chicago pit gypsies whose credit was on the line. The Merc was owed roughly $1 billion by Morgan Stanley; in turn, it was obligated to pay $670 million to Goldman Sachs and $917 million to Kidder Peabody.

…

And certainly, the MMI’s spike after Blair Hull’s buy orders would have helped stave off despair. If there was any “conspiracy,” it was an opportunistic one centered on the concealment of how widespread the trading halts were on the Big Board. The fact remains: While the market had fallen on Monday, it had almost fallen apart on Tuesday. All that had saved it was a makeshift web of trust, pluck, and improvisation—and perhaps a few bits of inspired subterfuge here and there. Only misinformed hindsight sees that midday turning point as the “end” of the 1987 crash. For Phelan and Melamed, for Ruder and Corrigan and Greenspan, for the stunned portfolio insurers in California, it was simply a fragile rally that let the market stumble toward the blessed closing bell on Tuesday without shattering the world’s confidence in America’s financial system.

Where We Are: The State of Britain Now
by Roger Scruton
Published 16 Nov 2017

The suspicion of identity cards reflects a deep characteristic of British society, which is the connection between freedom and trust. Precisely because we are free to associate as we will, to build networks and institutions and little platoons without official permission or official knowledge, there is a premium, in our society, on honesty. British society has emerged over the centuries as a self-policing web of trust between strangers. It is because each member is free to bestow trust and to earn it as he wishes that this kind of trust emerges and becomes a secure collective asset of the people who are linked by it. Mass immigration of communities who do not build trust in that way – who depend on family networks like the Sicilians or religious obedience like the Pakistanis – has jeopardized the old legacy of communal action, and reminded the British people of the downside of freedom.

The Metric Society: On the Quantification of the Social
by Steffen Mau
Published 12 Jun 2017

Wie wir der digitalen Entrechtung entkommen’, Blätter für deutsche und internationale Politik 59/11 (pp. 43-59). Latour, Bruno, and Steve Woolgar (1986) Laboratory Life: The Construction of Scientific Facts, Princeton University Press. Lauterbach, Debra, Hung Truong, Tanuj Shah and Lada Adamic (2009) ‘Surfing a web of trust: reputation and reciprocity on couchsurfing.com’, Proceedings of the 2009 International Conference on Computational Science and Engineering 4 (pp. 346-53). Leberecht, Tim (2015) The Business Romantic: Give Everything, Quantify Nothing, and Create Something Greater Than Yourself, New York: HarperCollins.

This Is Not Normal: The Collapse of Liberal Britain
by William Davies
Published 28 Sep 2020

If published, the findings are shared with journalists in press releases, drafted by university press offices. We expect that these findings are then reported honestly and without distortion by broadcasters and newspapers. Civil servants draft ministerial speeches that respond to these facts, including details on what the government has achieved to date. A modern liberal society is a complex web of trust relations, held together by reports, accounts, records and testimonies. Such systems have always faced political risks and threats. The template of modern expertise can be traced back to the second half of the seventeenth century, when scientists and merchants first established techniques for recording and sharing facts and figures.

Hello World: Being Human in the Age of Algorithms
by Hannah Fry
Published 17 Sep 2018

They’re also used by websites to see if you’re logged in or not (to know if it’s safe to send through any sensitive information) and to see if you’re a returning visitor to a page (to trigger a price hike on an airline website, for instance, or email you a discount code on an online clothing store). † That plugin, ironically called ‘The Web of Trust’, set out all this information clearly in black and white as part of the terms and conditions. ‡ That particular combination seems to imply that I’d post more stuff if I didn’t get so worried about how it’d go down. Justice IT’S NOT UNUSUAL TO FIND good-natured revellers drinking on a summer Sunday evening in the streets of Brixton, where our next story begins.

When Free Markets Fail: Saving the Market When It Can't Save Itself (Wiley Corporate F&A)
by Scott McCleskey
Published 10 Mar 2011

A few steps down the line is the RMBS holder or the firm that wrote default insurance to cover its potential default; the information asymmetry worked its way right through the system to the last person in line. CONFLICTS OF INTEREST Lurking beneath most of the issues that plague the market is one fundamental issue that will never go away: conflicts of interest. The market is all about interactions between parties and that leads to a complicated web of trust and dependency. A customer trusts her broker or investment adviser to provide good advice and best execution regardless of how the outcome affects the broker’s paycheck. Brokers trust each other to carry through on the deals they make in the market and to do so fairly. Research analysts are supposed to be objective in their analysis, rating agencies are supposed to be indifferent to the fact that the issuer is paying for the rating, regulators are supposed to focus on their current job and not what goes on their resume, lawmakers are supposed to do what is good for the market and not what is likely to get the electorate all in a lather before the next election.

What's Mine Is Yours: How Collaborative Consumption Is Changing the Way We Live
by Rachel Botsman and Roo Rogers
Published 2 Jan 2010

Jeff Miranda, “Take the Couch,” Boston Globe (August 22, 2007), www.boston.com/yourlife/articles/2007/08/22/take_the_couch/. 33. Mark Granovetter, “The Strength of Weak Ties,” American Journal of Sociology 78, no. 6 (May 1973): 1360–1380. 34. Debra Lauterbach, Hung Truong, Tanuj Shah, and Lada Adamic, “Surfing a Web of Trust: Reputation and Reciprocity on CouchSurfing.com,” IEEE International Conference 4 (2009): 348. 35. Traveler CouchSurfing story from Lisa Lubin, “You Meet the Darndest People While CouchSuring,” Chicago Tribune (August 9, 2009), www.chicagotribune.com/travel/chi-0809-couch-surfingaug09,0,208222.story. 36.

The Future of Capitalism: Facing the New Anxieties
by Paul Collier
Published 4 Dec 2018

It would bequeath to the next generation a society sliding into the pit of entitled individualism. In retrospect, the period of Utilitarian and Rawlsian dominance of the centre-left will come to be recognized for what it was: arrogant, over-confident and destructive. The centre-left will recover as it returns to its communitarian roots, and to the task of reconstructing the web of trust-based reciprocal obligations that address the anxieties of working families.* Similarly, the period of domination of the centre-right by assertive individualism will come to be recognized as the seduction of a great tradition by economic man. As it recovers its ethical bearings, it will return to ‘one nation’ politics.

What Would Google Do?
by Jeff Jarvis
Published 15 Feb 2009

He rarely types in one of those addresses and wonders what they have to tell him today. Mind you, he reads a lot of news—far more than I did at his age. But he goes to that news only via the links from Digg, friends’ blogs, and Twitter. He travels all around an internet that is edited by his peers because he trusts them and knows they share his interests. The web of trust is built at eye-level, peer-to-peer. Before I go on, let me acknowledge that, of course, things can go wrong. In 2005, the Los Angeles Times decided to be cyber-hip by inventing the “wikitorial,” an editorial from the paper that the public was invited to rewrite. In no time, the quality of discourse around the first wikitorial descended to the level of that on a prison yard during a riot because the Times had made a fundamental error: A wiki is a tool used for collaboration, but there was no collaborating to be done on the topic of the Times’ wikitorial—the Iraq war.

Capital Without Borders
by Brooke Harrington
Published 11 Sep 2016

In the rare instances when these issues have been considered at all, wealthy people themselves have been identified as the key actors. This is despite recent evidence that undermine that narrative, such as media coverage of the 2012 presidential campaign of Mitt Romney, which revealed that his $250 million personal fortune was held in a complex global web of trust funds managed by a private banker at Goldman Sachs: “His Goldman investments are handled by Jim Donovan, who … gave Mr. Romney’s trusts access to the bank’s own exclusive investment funds and helped him execute an aggressive and complex tax-deferral strategy known as an ‘exchange fund’ in 2002.

The Startup Way: Making Entrepreneurship a Fundamental Discipline of Every Enterprise
by Eric Ries
Published 15 Mar 2017

I’ve hired former founders into key executive roles and personally encouraged former employees of mine to become founders themselves. And, of course, most successful people in Silicon Valley become angel investors, even if on a small scale. So the roles get deeply intertwined. It’s a reciprocal web of trust, expertise, and reputation that is an important part of why startup hubs drive so much entrepreneurial success. This career path has only recently become something widely available in contemporary economies. But I think this is just the tip of the iceberg in terms of how this professional identity will evolve in the coming years and decades.

The Economics of Enough: How to Run the Economy as if the Future Matters
by Diane Coyle
Published 21 Feb 2011

And as so few transactions involve simultaneous exchange, that trust is embodied in money or financial instruments, which count and store the value, and allow it to be exchanged. Figure 10. Without trust, all economic transactions are like Checkpoint Charlie. It is extraordinary, when you stop to think about it, how extensive and also how delicate the web of trust represented by money has become in the modern global economy. All but a few countries are engaged in international trade and vast amounts of financial transactions cross national borders. Much of it now takes the form of electronic records on computer systems, not even paper money or bonds or shares, which are themselves abstractions.

Open Standards and the Digital Age: History, Ideology, and Networks (Cambridge Studies in the Emergence of Global Enterprise)
by Andrew L. Russell
Published 27 Apr 2014

., Standards Policy for Information Infrastructure; Tim Berners-Lee, Weaving the Web: The Original Design and Ultimate Destiny of the World Wide Web by its Inventor (New York: HarperOne, 1999), 98; and Calliess and Zumbansen, Rough Consensus and Running Code. 23 Andrew L. Russell, “Dot-Org Entrepreneurship: Weaving a Web of Trust,” Enterprise et Histoire 51 (2008): 44–56; Andrew L. Russell, “Constructing Legitimacy: The W3C’s Patent Policy,” in Laura DeNardis, ed., Opening Standards: The Global Politics of Interoperability (Cambridge, MA: The MIT Press, 2011); Raghu Garud, Sanjay Jain, and Arun Kumaraswamy, “Institutional Entrepreneurship in the Sponsoring of Common Technological Standards: The Case of Sun Microsystems and Java,” Academy of Management Journal 45 (2002): 196–214. 24 H.

Who Owns England?: How We Lost Our Green and Pleasant Land, and How to Take It Back
by Guy Shrubsole
Published 1 May 2019

The 3rd Baron Vestey is a close friend of the Queen, and in 1999 he became Royal Master of the Horse; an appointment that caused mild embarrassment when the Vestey Food Group was implicated in the Findus horsemeat scandal a few years back. Yet at the same time as inveigling themselves into the establishment, the Vesteys had been pioneering new ways of avoiding the tax authorities. Unbeknown to polite opinion at the time, they created a complex web of trusts and overseas companies that allowed them to become, in Nicholas Shaxson’s words, ‘among the biggest individual tax avoiders in history’. The brothers domiciled themselves in Argentina for a while and set up a secret trust fund in Paris. It all began perfectly legally, but when the British exchequer finally got word of where they were squirrelling away their millions, they began to investigate.

Version Control With Git: Powerful Tools and Techniques for Collaborative Software Development
by Jon Loeliger and Matthew McCullough
Published 14 Aug 2012

How the repositories of a large project are organized, or how they coalesce and combine, is again largely immaterial to the workings of Git; Git supports any number of organizational models. Remember that the repository structure is not absolute. Moreover, the connection between any two repositories is not prescribed. Git repositories are peers. So how is a repository structure maintained over time if no technical measures enforce the structure? In effect, the structure is a web of trust for the acceptance of changes. Repository organization and dataflow between repositories is guided by social or political agreements. The question is, “Will the maintainer of a target repository allow your changes to be accepted?” Conversely, do you have enough trust in the source repository’s data to fetch it into your own repository?

Accelerando
by Stross, Charles
Published 22 Jan 2005

"None of them tried treating it as a map of a connectionist system based on the only terrestrial components anyone had ever beamed out into deep space. Except me. But then, your mother had a hand in my wetware, too." "Treating it as a map –" Amber stops. "You were meant to penetrate Dad's corporate network?" "That's right," says the cat. "I was supposed to fork repeatedly and gang-rape his web of trust. But I didn't." Aineko yawns. "Pam pissed me off, too. I don't like people who try to use me." "I don't care. Taking that thing on board was still a really stupid risk you took," Amber accuses. "So?" The cat looks at her insolently. "I kept it in my sandbox. And I got it working, on the seven hundred and forty-first attempt.

Dark Mirror: Edward Snowden and the Surveillance State
by Barton Gellman
Published 20 May 2020

This was the Hollywood version of a “leak”: an unknown source emerging from nowhere, bearing a stupendous scoop. In the real life of a newsroom, this happened so seldom that it was tantamount to myth. Typically, I got my best stories in small pieces from people I had cultivated for years or discovered through a common web of trust, each contributing part of a whole that none would tell me directly. I could not get past the size of the archive. How many documents did it hold? The number did not matter much, but looking for it became a calming distraction. The job was unexpectedly difficult. I found no point-and-click method to count the combined contents of all those hundreds of folders.

Applied Cryptography: Protocols, Algorithms, and Source Code in C
by Bruce Schneier
Published 10 Nov 1993

Contrast this approach with PEM, which leaves quite a bit of information about the sender, recipient, and message in the unencrypted header. The most interesting aspect of PGP is its distributed approach to key management (see Section 8.12). There are no key certification authorities; PGP instead supports a “web of trust.” Every user generates and distributes his own public key. Users sign each other’s public keys, creating an interconnected community of PGP users. For example, Alice might physically give her public key to Bob. Bob knows Alice, so he signs her public key. He then gives the signed key back to her and keeps a copy for himself.

The confusion
by Neal Stephenson
Published 13 Apr 2004

“For yesterday at dinner at the home of Monsieur Castan, I was treated to a description of that same system—a description so flattering that I asked him why it was not used everywhere else.” They found this amusing. “What was Monsieur Castan’s reaction to that?” asked Jacob Gold. “Oh, that other places were cold, distrustful, that the people there did not know one another so well as they did in Lyon, had not built up the same web of trust and old relationships. That they were afflicted by a petty, literal-minded obsession with specie, and could not believe that real business was being transacted unless they saw coins being physically moved from place to place.” The others looked relieved; for they knew, now, that they would not have to break this news to Eliza.