Q1. What is the problem that you are trying to solve?
The goal is to mitigate the risks associated with public key trust issues, where an attacker would be able to inject a non-trusted public key into another user keyring.
Q2 - Who is impacted?
Everyone.
Q3 - Why is it important and/or urgent?
It will improve security of the solution.
Q4 - What is your proposed solution? (optional)
The solution needs to be simple enough so that it doesn’t overwhelm regular users with manual key management, but yet allow more advanced users to mitigate risks associated with key trust issues. The system should be non-blocking so that users that do not have clear understanding of key management are not prevented to use passbolt.
The main idea is to allow creating and view the status of the web of trust for users keys:
- admin (or other users) will sign user keys in the user work groups
- users will be prompted to trust administrators keys (and their own / friends keys)
- Final trust level is deducted from existing key signatures and individual keys trust levels
- The application will display trust level for the users’ keys (with twitter “verified” like badge) and display warnings in case trust level is low (example: user key has changed and is not signed by anyone they trust).
Q5. Community support
People can vote for this idea to show traction:
-
Must have: this is critical for me to have this -
Should have: this is important for me to have this -
Could have: this could be nice to have -
Won’t have: we should not schedule this (explain why)
0 voters