linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 06 Oct 2011 13:19:57 -0400
From:	Valdis.Kletnieks@...edu
To:	Thomas Gleixner <tglx@...utronix.de>
Cc:	Chris Friesen <chris.friesen@...band.com>,
	Adrian Bunk <bunk@...sta.de>, "Ted Ts'o" <tytso@....edu>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

On Thu, 06 Oct 2011 09:30:47 +0200, Thomas Gleixner said:

> If Linus signs his key, then all it means is that I can be sure to a
> certain degree that the person who is using the key is Adrian. But
> it's neither a free ticket for a k.org account nor does it have any
> other meaning.

Exactly.  It proves it's Adrian. What you *do* with that information is
an entirely different question.

Many people manage to conflate "authentication" and "authorization",
which are two entirely different things in the security world.  My favorite
example demonstrating the difference:

Authentication: "Yes, your driver's license does say you're Jeffrey Dahmer".
Authorization: "Would you like to borrow a steak knife, Jeffrey?"

(For the non-US people - Dahmer was a notorious serial killer and cannibal:
https://secure.wikimedia.org/wikipedia/en/wiki/Jeffrey_Dahmer

Content of type "application/pgp-signature" skipped