PGP-Signed Comments
On the internet, nobody knows you’re a dog.
In one way, that’s great. If you want to be anonymous, there’s plenty of scope for it on the internet. Even when you post comments on this blog and I ask you for an email address and/or a URL of your website, nothing prevents you from entering totally bogus ones.
On the other hand, say you’ve already established something of an online identity, perhaps through your own web site, or as a frequent commenter at this or some other blog(s). What prevents someone else from coming along and posting a comment here, leaving your name and your website’s URL to identify himself? Put another way, how can readers determine the authenticity of comments left here?
Let me pause to say what I mean by ‘authenticity.’ Most readers of this blog have never met you, personally. They know you through your comments, and perhaps through your own web site. What they would like to know is that the person who authored the comment in question is the same person who authored those other comments and who runs that web site1.
Well, now there’s a way to reassure them. If you have a PGP public key (if you don’t, create one for yourself), put a link to it in the <head> section of your web page:
<link rel="pgpkey" type="application/pgp-keys" href="http://yoursite.com/path/to/yourkey.asc" />
Then you can
- Compose and preview your comment as before.
- Edit it, as needed, and preview again.
- When you’re satisfied with the final form of the comment, use GPGDropThing (for MacOSX) or GPGShell (for Windows) or your favourite PGP tool to clear-sign the text in the comment-entry box. Paste the clear-signed comment into the comment-entry box, replacing the unsigned version.
- Click PREVIEW once again, and then click on POST.
To outward appearances, your comment will look no different than before. The only difference will be a clickable link to “verify” the comment.
If you, or another reader, clicks on it, your key is fetched from the URL specified in the link on your web site, and is used to verify that you — and you alone — composed the comment. The key is cached locally, so subsequent verifications of the signature will be nearly instantaneous. The raw, clear-signed comment is available, so paranoid readers can check the signature themselves — provided they have your public key.
I’d been thinking about implementing this for a while, and even went through the hideously-complicated process of installing Crypt::OpenPGP on MacOSX. Fortunately, Krishnan Srijith did the rest of the heavy lifting and wrote a MovableType plugin. I added a few of my own tweaks and … there we are.
Update (3/3/2004): Automatic fetching of PGP keys, as described above is enabled now. In my and Srijith’s limited testing, it seems to work well. But please let me know if you encounter problems.
Update (3/5/2004): I’ve posted some more thoughts on PGP-signed comments.
1 This is a little different from the exigencies of verifying the identity of the author of an email, which is the traditional use of PGP signatures. There, the PGP “Web-of-Trust” model works fairly well. Here, it doesn’t necessarily work so well, a point elaborated on in greater detail by Phil Ringnalda.
Re: PGP-Signed Comments
Though I’m not quite as sure as I once was that we absolutely can’t use the keyservers. I’m getting the feeling that it’s quite within spec to use the various levels of signature in any way you like, as long as you
So from my current understanding, if we all simply said that we would sign any key we retrieve from either a commenter’s URL or a URL in a signed comment’s PGP comment at class \0x12 (“Casual certification of a User ID and Public Key packet. The issuer of this certification has done some casual verification of the claim of identity.”), then we could quite often use the keyservers rather than getting the key from a website, while manually verifying signatures. If I see a signed comment from someone new to me, but the key I get from the keyserver says that you and Srijith have both signed it, I’ll call that good enough. Of course we’ll probably piss off the rest of the WoT community, who seem to feel that anything less that two pieces of photo ID means you’re probably an alien, or the NSA, but so be it.