Changes between Version 21 and Version 22 of OpenPGPandSSH

Timestamp:

Jan 26, 2008 11:52:17 AM (5 years ago)

Author:

dkg

Comment:

--

OpenPGPandSSH

@@ -108 +108 @@
 Would it be possible to get OpenSSH or the framework to log the relevant User ID on each successful connection?
 
+=== Minimizing Windows of Vulnerability ===
+
+Depending on the timings/delays of fetching keys, signatures, and revocations from keyservers, there is a window during which an invalid key will be treated as valid.  How do we minimize these windows without inserting significant delay in the common use case?
+
+=== Chained Trust specific to account owner ===
+
+It seems like a GPG keyring should provide enough information to describe basic server-wide trust rules.  But what if you wanted a trust rules like:
+ * for account `foo`, trust UserID certifications from key XYZ as well as the usual system-wide introducers, or
+ * for account `foo`, allow chained introductions through any key with already-certified User ID `Fubar <foo@example.org>`
+How would this be implemented?
+
+=== Minimizing Bad Incentives ===
+
+Some users will always want to share access to their account, even if it is discouraged by the system administrators.  Ultimately, since users can share authentication tokens (or keyboards!) with each other, there is nothing that can be done to prevent this absolutely.  How do we make this framework flexible enough to allow users who want to share access to do so without doing things that violate the web of trust?
+
+Are there any other bad incentives that this framework might create that we should try to mitigate?
+
 == Other Work ==