Re: [gentoo-project] [RFC pre-GLEP] Identity verification via OpenPGP WoT

[Michał Górny]

On Mon, 2019-03-04 at 14:18 -0500, Rich Freeman wrote:
> On Mon, Mar 4, 2019 at 2:06 PM Michał Górny <mgorny@g.o> wrote:
>
> > Furthermore,
> > it is recommended that the signer includes the URL of this GLEP
> > as the certification policy URL (``--cert-policy-url`` in GnuPG),
> > and appropriately indicates certification level (see
> > ``--default-cert-level`` in GnuPG).
>
> Rather than say "appropriately" why not explicitly indicate which
> certification level to use?  Otherwise the distinction between 2/3 is
> going to become a point of debate.  If you're going to standardize the
> URL it seems like standardizing the level makes sense (IMO specifying
> the URL for disambiguation is a great idea).

Well, I believe both 2 and 3 can be valid, depending on how minutely
you've verified the document.  I'd say you'd say 3 if you really
carefully ensured all three points (including multiple anti-counterfeit
measures); 2 if you just looked if the document looks reasonable but
failed to prepare.

> > 1. Obtain a hardcopy of signee's OpenPGP key fingerprint.  The signer
> >    must afterwards use the fingerprint to verify the authenticity
> >    of the key being used.
>
> This seems needlessly specific.  How about just requiring that they
> verify the fingerprint of the key to be signed with the person signing
> it.  That could mean being handed a hardcopy, but it it could just
> mean being shown the fingerprint and transcribing it, or comparing it
> on-screen, etc.  Obviously it needs to be communicated via a
> reasonably tamper-proof mechanism.
>
> This just seems to necessitate printing out keys when other methods
> might be just as secure.  Maybe focus more on the what than the how.

Sorry, non-native English speaker here.  I thought the intent is clear
from the sentence, and people are going to be able to figure out that
the purpose is to have tamper-proof value here.

-- 
Best regards,
Michał Górny