@Sir_Boops .onion is pretty good, it's a *huge* step in the right direction

but...

it's an incomplete answer in its own. It doesn't provide a solution for key rotation (including migrating your stuff to a new .onion)

Also, content addressed storage can help a lot. It doesn't have to be cleartext CAS; look at tahoe-lafs for an example of symmetrically encrypted stored objects

@cwebber @Sir_Boops Seems like we either need some kind of global naming scheme based on something like a blockchain (or rather a forest of them), or chained petnames.

@Sir_Boops @cwebber

. o n i o n
oo n i o n
nn n i o n
i i i i o n
oo o oon
nn n nnn

Btw, fuck non-monospace fonts

@k I don't know what Matrix does?

@cwebber
"Perspectives uses notary servers to verify that the same key is seen across the network, making a man-in-the-middle attack much harder since an attacker must insert itself into multiple places. For federation in Matrix, each Home Server acts as a notary. When one Home Server connects to another Home Server that uses a key that it doesn’t recognize, it contacts other Home Servers to ensure that they all see the same key from that Home Server."

https://matrix.org/docs/guides/faq.html#what-is-perspectives

@k Ah yes, that seems useful!

Though I think an even better path is the one that tor .onion servers take: your key fingerprint *is* your address. So opening a connection to you and knowing that that's the appropriate key are a combined step.

@npd I didn't say we weren't making an improvement! I'm saying that we haven't achieved a truly decentralized system if DNS and SSL CAs are in the mix. It's still an improvement for sure, but we're hampered.

@rdh I'm friends with the main person behind SSL/TLS (Christopher Allen) who was opposed to CAs. There's an alternate system that was in the work called SPKI/SDSI (pronounced "spooky/sudsy"). There are alternate solutions, but they aren't well known because they aren't the ones that took off.

@cwebber @rdh
Web 2.0 of Trust

@jordyd @rdh haha, I'm going to start calling Rebooting Web of Trust that

@cwebber @rdh
Now I gotta go see what that is. I suspect it’s exactly what it says it is but you never know

@jordyd @rdh it's a "workshop" conference I go to where a lot of the "ways out of this mess" are being incubated, including DIDs (Decentralized Identifiers), ocap-ld, and the petnames writeup I recently participated in (still need to finish that one...) all came out of there

@jordyd @rdh we really need more fediverse people showing up to Rebooting Web of Trust fwiw

@cwebber @jordyd

Do you mean this? http://www.weboftrust.info/

@rdh @jordyd yep!

@rdh @jordyd I also wrote a paper for the conference about how AP and this work could get along https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/final-documents/activitypub-decentralized-distributed.pdf

It's fairly out of date though

@rdh @jordyd Also might as well link this while I'm at it, here's a paper on petnames we never finished but has the core ideas https://github.com/cwebber/rebooting-the-web-of-trust-spring2018/blob/petnames/draft-documents/making-dids-invisible-with-petnames.md

If you can understand that, you can start to understand how to kill CAs and DNS.

@cwebber @rdh
That's a very neat idea

@jordyd @rdh Thanks... it's not new! These ideas have been around (and even implemented before) for ages, we were just trying to clean them up and explain clearly to a modern audience

@cwebber @rdh
Do you know of any projects that are headed in this direction?

@jordyd @rdh When Spritely stops being vaporware, it will be. ;)

@cwebber @rdh @jordyd This is a really interesting PDF. Are there plans to use OpenPGP fingerprints as identifiers? They are inherently distributed. (As far as I know Monkeysphere uses `openpgp4fpr` URI scheme for that), Signed notes could be freely exchanged between fediverse nodes (they can be easily checked against the key), heck one could even use key certifications as "follow" mechanism. For the record OpenPGP is quite extensible (with metadata notations, etc).

@cwebber

I'll have to look into these because I'm definitely interested in alternatives.

In fact, my previous post might have looked like I was pro-status quo, but really I'm just of the opinion that we can use these systems without being a part of them.

@rdh Indeed, SSL/TLS foundations are actually totally possible to use without involving CAs at all.

@ebel @starbreaker tor .onion services/addresses definitely help, though you need a Petnames system layered on top to make sense of them

@cwebber @ebel @starbreaker do you know if anyone has done a pet name system / UI on top of Tor onion addresses for websites?

@ebel @starbreaker No but I talked about it with some of the Tor folks at Libreplanet and I was supposed to send them an email and uhhh