Nyms Identity Directory

Hi, I'm the author of this document and principal developer of the project. This is a somewhat detailed design overview for a proposed alternative to the PGP keyserver system that I'm building and I didn't really write it for a general audience to avoid cluttering it up with too much background information.

Sometime soon we're going to improve the website with a friendlier high-level description of the goals of the project and the problems that it solves. For now, I apologize that this rather dense document is the only information available.

It might be easier to understand what I'm trying to achieve by reading a post I made yesterday to the modern crypto mailing list which summarized the important features of Nyms:

https://moderncrypto.org/mail-archive/messaging/2014/000602....

I do not see how Nyms protects against identity/email theft (which they list as a concern with current OpenPGP keyservers).

According to the description of the "Remote Verification Protocol", I would be able to associate my GPG key with any identity / email address, provided I can reply to emails sent to that address (at least during the verification pass).

It's certainly an improvement (OpenPGP keyservers provide no verification whatsoever), but it's not secure in any way and does not address the strong anonymity concerns that are exposed in the intro...

I feel like these type of PKI proposals don't really address the various aspects of user adoption. How do you convince a user to use something like this?

Most users have no concept of keys, much less private and public keys. So how do you expect them to understand that they (1) need to generate a key pair, (2) keep one of those keys private, (3) register the other key with your service, (4) publish one of the keys on Twitter, (5) use a local email client instead of Gmail or Yahoo, and (6) keep re-certifying with your service every 30 days?

It's much easier to just tell someone to install TextSecure and use that for your one-off conversation, then go back to them using Gmail for everything else. Like it or not, OpenPGP competes in the same space as everything else, so if you want it to be adopted, you need to make it easier than the competition.

A good example of this type of failure is OpenID. OpenID is a great standard and allows for the user to have much greater control of their online profiles. However, the extra steps involved with setting up an OpenID in the first place means that it wasn't used by the vast majority of users.

Feedback: I stopped reading halfway through the second paragraph, mainly because it's hard to read such dense paragraphs, and also lacks a simple summary at the first paragraph. The rest of it is one giant wall of text, which would be difficult to read even if the paragraphs weren't so dense. Author: can you please put a hyperlinked table of contents? And if you're going to use centered specific-width paragraphs, please use 'align="justify"' for easier reading. Thanks

https://nyms.io/ <-- pfft

Nothing user centric that I can see there. Hideously complex. How can a non-geek get started with this?

Is there code associated with this design?

tl;dr Since this doesn't hold a huge amount of interest for me, I passed on reading the whole document. It would help to have a couple sentences up front explaining what this is.