Re: status: establishing a PGP web of trust

From: Valdis . Kletnieks
Date: Thu Oct 06 2011 - 13:21:21 EST

On Thu, 06 Oct 2011 09:30:47 +0200, Thomas Gleixner said:

> If Linus signs his key, then all it means is that I can be sure to a
> certain degree that the person who is using the key is Adrian. But
> it's neither a free ticket for a account nor does it have any
> other meaning.

Exactly. It proves it's Adrian. What you *do* with that information is
an entirely different question.

Many people manage to conflate "authentication" and "authorization",
which are two entirely different things in the security world. My favorite
example demonstrating the difference:

Authentication: "Yes, your driver's license does say you're Jeffrey Dahmer".
Authorization: "Would you like to borrow a steak knife, Jeffrey?"

(For the non-US people - Dahmer was a notorious serial killer and cannibal:

Attachment: pgp00000.pgp
Description: PGP signature