Talk:Web of trust

message: Debian! All Debian packages are signed - if you check the keyanalyze results, many of the top 50 are Debian maintainers - including our very own Sam Hocevar! So, it does have it's applications. Alphax τεχ 11:17, 21 March 2006 (UTC)
thread_title:  Major real-world application 

message: Hello. I am not a cryptographer or a member of this Wikiproject, only a user. I added a "refimprovesect" or "noreferences" tag to this article because I could not see any references in the article. If my taking that action was an error, apologies in advance. Thank you for this article (could not find one for "trusted network" except maybe one about a United States Army technology, but I really don't know the subject). If I goofed please let me know if you could. Best wishes. -Susanlesch 21:24, 10 November 2007 (UTC)
thread_title: Citations

message: User:JzG is acting belligerently, but I want to air out his concerns for all to review. Essentially, Jason Harris' site is down often, sometimes for months at a time, so I have done the proper thing and removed the link. JzG says that the removal of this broken link constitutes original research, and promptly reverted my change. This is in spite of the fact that no original research was added to the article, only a broken link was removed. Further, it is absurd to use WP:OR as an excuse to revert the removal of any material. By that logic, I could add obscenities to the article and revert their removal under WP:OR, which is an absurd outcome. Any thoughts? --Namescases (talk) 23:00, 2 January 2008 (UTC)
thread_title:  [[User:JzG]] 

message: It seems this phrase "web of trust" applies in some way to internet browser add-ons, which is how I came here.  I assume the browser add-on allows a group of people to trust a web-site (or not).  Nor sure.  Someone on a Tech Forum said that having a "Web of Trust" add-on to your browser allows you to know whether or not an unknown web-site is dangerous or not.  It would be useful if this article included some explanation of this.  I'm still not sure what it is exactly, or how the encryption "web of trust" relates to the browser.
99.137.251.249 (talk) 02:50, 10 December 2010 (UTC)
thread_title:  How does this apply to an Internet Browser Add-on? 

message: The article states that "Intelligence is normally neither required nor allowed" in a CA-based PKI. Obviously one can choose which CAs to trust: for example, don't trust a Chinese CA on sites that serve the U.S. market. --Damian Yerrick (talk | stalk) 21:04, 6 August 2011 (UTC)
thread_title:  Intelligence not allowed 

message: I feel uncomfortable about heavily using the acronym PGP throughout the article (42 instances in 4 page-lengths); including the introduction (4 instances in 5 text-lines); without stating what it stands for, despite being a rare neologism (238 kilo-hits for "PGP" on books.google.com, cf. 907 Mega-hits for "Wi-Fi"). 139.216.253.90 (talk) 04:29, 23 January 2017 (UTC)
replies: text: The first reference to PGP links to the Pretty Good Privacy article, which unpacks the term comprehensively.  Is this sufficient? David McBride (talk) 09:45, 9 February 2017 (UTC)
thread_title:  PGP acronym not explained anywhere 

message: Drew Streib's analysis states: "It is desirable to have as short as possible an MSD to your key". The graphic seems to contradict this stating: "The more trusted certificate would be B, because it has the highest MSD."
Is Streib's phrasing incorrect?  Is MSD (Total Trusts/Total Hops) as the graphic states, or the reciprocal, (Total Hops/Total Trusts)?
KeelyHill (talk) 20:50, 8 November 2017 (UTC)
thread_title:  Clarification and possible contraction in § Mean shortest distance 

message: There are some issues with this fragment:
"When original author or developer also publishes or shares their updated original public-key (or file-signing pub-key) in their own keyserver under their own domain webserver, inside their own premise: own-home or own-home-office or own-office, and forces HKPS encrypted connection usage for public-key delivery, only then users can get correct and trusted and unmodified key."
I understand what the author is trying to convey (don't trust keyservers) but there are several problems with what was described here:
# How would the user know about this special custom keyserver? The only place to put "use this keyserver" is on the developer's site, but if that was so the developer could just put "download key $FINGERPRINT" instead and then any keyserver can be used
# OpenPGP was specifically designed no to rely on CAs, here an implicit trust in CAs is needed for HKPS
# It's not clear what "own-home" protection would achieve, if the attacker could modify one's infrastructure they could e.g. replace DNS records or edit the "use my own keyserver" page with something entirely different
# Web Key Directory better suits the "let's use HTTPS for key discovery model" - it's used and enabled by default in GnuPG and doesn't require any special keyserver parameters
# The only way to get "correct and trusted" key is from the developer himself. I think it would be better if this fragment used rather weaker phrases like "downloading the key using HTTPS and a correct domain name increases the likelihood of obtaining the correct key".
I'm new to Wikipedia so I'd rather avoid direct edits to the article (to avoid decreasing the quality ratio) but I'd be glad to listen to how to approach this matter.  — Preceding unsigned comment added by Wiktor-kw (talk • contribs) 12:45, 24 October 2018 (UTC)
thread_title:  Problems of "Problems" section 

message: Sorry for the drive-by comment here, just wasn't sure what edit was appropriate.
The definition of "strong set" claims that it is strongly connected. (This is indeed what is claimed by the linked citation.) However, if you follow the link to strongly connected, you will see that its definition is not what's meant here.
Strongly connected: Each node is directly connected to every other node. For the web of trust, that would mean that each member of the strong set has signed the key of every single other one of the 55000 members. This is both obviously untrue and contradicted by the following sentences in the section.
Connected is the correct notion here. This means that there is some path between any two members of the strong set, not that they are necessarily directly connected. 205.220.129.226 (talk) 20:27, 4 June 2024 (UTC)
thread_title:  strong set is not strongly connected