Two items from recent magazines...

[Jonathan Corbet]

> W.R.T. using "fake" inventors.  It's illegal to file a patent application
> without the true original inventor's name on it.  If it can be proven that a
> company did this, it is liable for treble damages and the lawyer who filed
> the application can be disbarred.

It's not the inventors who are faked, according to the article -- it's the
companies for whom they work.  I forget the examples now (mag is at home),
but these people have turned up corporations which file their patents under
no end of front companies (tentacles? :-) so as to make it hard for their
competitors to see what they are up to.  It's by using the inventors' names
that all this information is being pulled back together.

Jonathan Corbet
National Center for Atmospheric Research, Atmospheric Technology Division
corbet at stout.atd.ucar.edu

 they are - and I haven't tried checking their
articles to know what to look for to check whether an email
request claiming to be from one of them looks unforged.
If I remember right, none of these people puts a PGP Key ID or fingerprint
in their posting signatures, so I don't have that clue available -
that would increase my confidence a lot.  But I still couldn't be sure.
 
[This is the hitch in digital signatures isn't it?  At least as far as
those not issued from an authority are concerned.  You are really
signing for a location rather than anything else.  You have no idea
who has access to the secret key on the other side of the public or if
the "who" is a "him" a "her" or "they."  A signature is webbed in with
the trust you give it.  Tim May's signature means nothing if everyone
knows that Tim and his close friends all use it even if the key only
has the words "Tim May" on it.
++ Tim, I used your name because I want someone else to be the example
today  :) ++
Technically (for you grassy knoll types) the holder of a secret key could
be quite dead and anyone might have taken up use.
The dead key holder, or even the duress key holder, creates all
sorts of problems if you are dealing with nym's or anonymous keys.
Same problem with so-called "password" or "bearer" accounts.
The money is only as secure as the protocol is secret.  Subjectively
different for each and every user.
 
People like LD have to break past the barrier in concept and accept
that a public key system with an open trust web just cannot be used
to establish IDENTITY.  With a properly structured web it approaches
zero probability of "identity fraud," but never quite gets there.
 
I'm not lying if I sign some key that I know to belong to a person
who actively uses the name "564FR"
All my signature says is that "at one time 564FR held this key and
I trust him to send a revocation if there is a problem."
NOT
"This key is held by 564FR and 564FR alone, so help me (insert deity of
choice)"
 
Frankly I think this system is a lot MORE honest than a centralized
system (which stinks to me of big government anyhow) because
multiple signatures from several individuals represent different
perspectives on identity.  Chances are that if you have 6 nice signatures
you managed to convince 6 very different people that the key is "yours"
I trust this much more than some "trusted authority" which is likely
to be neither trusted, nor an authority.]
 
+++
On the other hand, if I really cared about preserving the anonymity
of the nym-user, and it was somebody I knew in person, or myself,
I probably wouldn't sign it with my real key - it may be relatively obvious
that "Bill The Dragon-Basher" whose key was signed by "Bill Stewart" was me,
but I'd rather not have to deal with a court subpoena or Mafia equivalent
trying to find the users of the keys for "Crypto International, Ltd." or
"Coalition Against the U.S. Invasion of Cuba" or "Some Unapproved Religion" or
"Bear's Custom Chemicals" or an anonymous Panamanian bank account that's mine.
 
But if the keys are only signed by other nyms, how trustable are they?
 
[So how do you know what's a nym and what's not?]
 
If I ran a digibank, I'd be real hesitant about accepting changes of
address or public-key unless I had some physical verification or other
securely shared secret to avoid eavesdropper and interloper attacks,
but one of the goals of digital banking is that you're not supposed
to need physical transactions.  I suppose an initial account set up
by sending the bank a message with a Secret and a public key and a
bunch of digibucks might do the job, with some cut&choose protocols
to decrypt the digibucks if the account is approved?
 
[If I ran a digibank with open accounts, I'd shift the security burden
to the account holder.  Especially when dealing with accounts from
sketchy identities.  Provide the means for security in protocol,
the rest is up to the user.]
 
                Bill The Dragon-Basher
                        (oops!  ^X^C:wq!/exit~.\b\b\b\b\b\b)
# Bill Stewart  Old address: wcs at anchor.ho.att.com AT&T Bell Labs, Holmdel, NJ
# After 10/15, NCR, 6870 Koll Center Parkway, Pleasanton CA, 94566
# Voice/Beeper 510-224-7043, Phone 510-484-6204, email bill.stewart at pleasantonca.ncr.
com
 
- -uni- (Dark) 
[who will begin to attach key fingerprints to mail and not just usenet
and finger]  :)
073BB885A786F666  6E6D4506F6EDBC17
 
-----BEGIN PGP SIGNATURE-----
Version: 2.3
 
iQCVAgUBLP0XEBibHbaiMfO5AQHeKQQAhN6RXRQ8fZ1hz+jvFbuw6N6fvByG2Euq
BYISCdcLgcWa1V/Jpq7GjjIwLTEYjxFQBqg2txyu4QKpmg1HR3ox/MAyUPcqQqQy
K9WxvwVMW/3ydGKRwLyatthHZsa47JGVumwzQJ2/cDzhNZhfiM/SqXgH3jdHBSAO
9r744wKJsoc=
=Qi4O
-----END PGP SIGNATURE-----