so say you're running some site like... maybe coinpal , and you want to allow people to prove to you that they own an ebay account with X feedback. would you prefer to (a) do this automagically with some gpg verification code, or (b) hire a verifymonkey to do it manually?

or, say you're on #bitcoin-otc and someone fairly new is offering a trade, and claims that he has a good ebay or amazon rating. would you rather go to their claimed ebay profile, and manually copy the string and verify gpg key, or run "getebaytrust <nick>" (or getamazontrust <nick>) and have automatic verification done for you?

hope you get the idea.

EDIT: heh, mndrix has stated the issue much more concisely, and with less snark, to boot.

mmm you seem to be missing the whole point - it /is/ supposed to be automatically parsed.

is there any benefit to going uri-style?

please check out the rfc for the gpg identity protocol, posted in this thread:
http://wiki.bitcoin-otc.com/wiki/GPG_Identity_Protocol

comments appreciated.

Mndrix and I (and a couple other discussants) have developed an exportable GPG identity protocol.

http://wiki.bitcoin-otc.com/wiki/GPG_Identity_Protocol

Quick summary: "This page outlines the protocol for exporting your GPG identity to other sites which may or may not support GPG authentication directly. The basic idea is that you can post a GPG-signed message to some area of your user account on the site, connecting your site id with your key via the signature, and then others can verify your signature and be certain that you are the same person on multiple sites.

Please check it out - your feedback (please post in this thread) would be appreciated.

In the future, I will be putting in the code on #bitcoin-otc to automagically query people's identities and ratings in various communities based on their OTC GPG auth, mndrix may implement it for coinpal, and hopefully other sites in the bitcoin community can join in so that we can create a broader web of trust.

wires are more expensive.

ach - if you can do it, probably just as good.

yep, that works. unfortunate that they mangle input.

also, i notice that it is possible to create custom categories in the bio - so maybe that can go under 'pgp key' category

yes, i confirm that the myworld pages are in fact world-readable.

mndrix: your comments on my 'standardization' proposal would be appreciated.

actually, posting either just the key or just the id is not enough to verify anything, since i can post /anyone's/ key. what you need to do is post a clearsigned message saying "i, user <username> on ebay, hereby declare my ownership of <keyid>, as of <date>", signed with said key.

that'll prove to any onlooker, without having to do any additional steps like sending you encrypted email or whatnot, that you indeed own the key.

(date is included just in case ebay drops usernames, and someone else comes in to use it - the new guy's 'registered at' date would then be later than your posted date.)

now... question is where can one post a persistent bit of text (even a pastebin url) on your ebay account...

as it happens, there's a great place for that - your 'bio' on your 'my world' page ( http://myworld.ebay.com/<your_ebay_username> ).

we could even fix up some kind of standard, where a signed message containing your ebay nick, keyid, and a datestamp can be fetched by other places (e.g., the OTC bot ), and once verified with your authed GPG key id, spits out your feedback summary.

the wonders of GPG!

comments appreciated.

indeed, that is not a very likely scenario. while stolen pp accounts are numerous, the intersection of (stolen pp accounts) & (coinpal users) & (thief aware of coinpal and bitcoin and using the coinpal tx history info to steal btc) seems quite small


very cool. now if only you add a couple of form fields for pgpkey, and signed verification message, and then a query url by keyid with json output... i could get it working on the OTC channel.

you seem to misunderstand how these shared wallets work. maybe that is beyond belief?

but how is that useful for /others/ who want to verify what Bob's rating is? doesn't that mean that bob has to reveal his supersecretkey in order to allow others to query and verify his account?

just a note that the trading history of "john doe" would be pretty useless without any ways to verify that the guy you're talking to is the same guy.

if trade history doesn't include paypal email - /anyone/ can claim any trade history.

if history does include paypal email, then someone who gained access to that paypal account can claim it, and then the real owner will charge back. (and we all know how many stolen paypal accounts there are floating about)

if history includes something like gpg key - it becomes a lot more trustworthy. pgp keys can of course also be compromised, but stolen pgp keys are much less likely than stolen paypal passwords, since these tend not to be targeted by the run of the mill trojans out there. (yet)

so in summary: definitely a good idea to allow people to verify a gpg key to include on that page.

another possibility: hash of phone number?

finally: yes working with daniel on the ripple bits. stay tuned.

nice idea!

consider joining #bitcoin-otc too. the order book is pretty deep, and it's always easy to find someone to trade, if the price is right.

percontation point to the rescue!
http://en.wikipedia.org/wiki/Irony_punctuation

have you considered the following: dwolla, bank ach, check by mail?

yea, i think that particular bit is quite telling.

e.g., if i were merely the recipient of stolen btc, rather than the actual thief, i'd be like "hey, i paid for these fair and square, i don't owe you anything"

usually no fees are required.
see this page for current fee schedule:
https://en.bitcoin.it/wiki/Transaction_fees

i've used ripple to keep track of loan interest. works great.