Re: [Ayatana] Secure Identity Design

[Dylan McCall <dylanmccall@xxxxxxxxx>]

On Mon, Jun 21, 2010 at 11:55 AM, Martin Owens <doctormo@xxxxxxxxx> wrote:
> Dear Ayatana,
>
> Myself and a few others have been working on a concept to improve the
> functionality and ease of use of the gpg key system we use. This project
> code named starfish[1] would be hopefully something average users can
> discover and take advantage of as well as making it easier for us geeks
> to deal with.
>
> I would really like your critique of these rough designs for the system:
>
> https://wiki.ubuntu.com/Starfish/Design
>
> I have attempted to show the workflow from not having an identity
> (published gpg key) to discovering the possibility, setting it up and
> then creating a network of trust.
>
> What I am most unsure about is linking the concept of trust with the
> idea of 'friendship', I couldn't think of a better way to explain the
> link between people. Perhaps if any of you have some good ideas you
> could share them with us.
>
> Best Regards, Martin Owens
>
> [1] https://launchpad.net/starfish
> Tags: python, gpg, encryption, identity, trust
>

This looks spectacular! A great way of removing the geekiness from
digital signatures.

I would be wary about using the term “friend,” as in friendship
requests described at the end. Unfortunately, I think the term has a
somewhat unusual definition in the context of the Internet, so we
could end up with an environment like Facebook friends, where people
go crazy getting their keys signed thousands of times by “friends”
they haven't even heard of before. Besides, I can picture government
offices doing key signing in the far distant future, and I consider
any bureaucracy my enemy.

One other thing: grabbing the user's information from his profile
under About Me sounds good, but it would probably not be the best idea
to grab his picture from there. It's my understanding that pictures
attached to public keys can't be removed (at least not easily…). Some
quick instructions to that end may be a good idea.

In the Request Friendship dialog: how about autocomplete powered by
Evolution's contacts list? nautilus-sendto handles that somehow :)


Good luck!
Dylan