You wouldn't trust a chain that long with something that sensitive. WOT gives you the ability to have different tiers of trust. If you verified the identity yourself then you can trust it completely. If you accept people verifiying identities on your behalf then you can choose exactly who you trust (ie. not everyone). It not only makes the delegation explicit, it gives you much more fine grained control about how much you can trust a given identity.
I'm not saying WOT solves all of our problems. It only makes it slightly better than verifying every key yourself. But it's better than the CA model because you can make it work for you.
Yeah, web of trust gives me the option to manually decide, every time, if the chain(s) of trust looks "good enough" for me to trust the other party. There are two problems with this:
1. This is a ton of work and a lot of guesswork even for educated individuals. I end up looking at either explicit chains of trust (I trust Bob and he trusts Alice and she says that this is definitely my bank's website) or some random value an algorithm spits out that tries to convey how "trusted" an entity is based on how many paths there are to it and how short they are. In either case, it's a manual decision that will often feel arbitrary.
2. Laypersons are completely fucked. No way my grandmother can reasonably decide who to trust this way.
If web of trust ever becomes widespread somehow, I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs because everyone will just look to them in the web of trust and see if one of them vouches for their banking website.
> I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs
Except that none of those companies bother verifying one's identity if you're not actually paying for their services.
> and see if one of them vouches for their banking website.
In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with.
> Except that none of those companies bother verifying one's identity if you're not actually paying for their services.
I'm sure in this scenario, those companies will be delighted to step fully into the role of CA including accepting money for identity vouching.
> In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with.
No. The same couldn't apply to any company. My primary bank is online only. And how many times have you actually walked into an Amazon office? Or Paypal? Are people in Ohio supposed to fly to San Jose to get Paypal's public key when they create an account? Or are we going to wait for the post office to deliver a physical copy of Paypal's public key (and we'll just trust that whole transaction couldn't be compromised). Physical key exchange is simply not practical in most cases.
It probably could apply to some that I locally deal with. But you're correct in saying that it's not practical for companies that don't have local branches.
>In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with.
You could? Would your grandmother? Would you fly to Mountain View to get Google's? And then turn around and fly to Washington DC to get the IRS's? And then turn around and fly to who knows where to get HN's? And then tell them to keep customer staff ready to assist you to install their public keys?
And what about personal blogs that don't want to be MITM?
No, my grandmother cannot trust me to verify every site she might want to visit. How am I supposed to know if random blog is legit? Or for that matter random bank?
The fact that I have to answer this tells me that you haven't though through the implications of web of trust very far.
From my understanding, the example posted is an unlikely degenerate case where the whole "web of trust" between you and another peer consists of three separate parallel paths.
