Hacker News Reader

no because similar to PGP keys it really doesn't matter where you publish your fingerprint or how you connect your identities. If shaq had a popular website, he could do it there too. E.g. I have my PGP fingerprint on my website: https://timdaub.github.io

View on HN

In other words, your trust is anchored by Twitter or GitHub. I have to gauge that the key I got was uploaded by you rather than someone else and the thing building that trust is by linking it to an identity established on those services.

PGP had the same problem: the web of trust didn’t scale well outside of existing communities – and where people signed keys for strangers, they also relied on trusted third parties (driver’s license, student ID, etc.) to establish that.

Reply on news.ycombinator.com