-: Web of trust.
The web of trust is a decentralized trust model
that addresses issues associated with the public
authentication of public keys within a CA based PKI system.
One of those issues is that you have to pay
to get one of these digital certificates from a CA.
Now with a web of trust we instead use a peer-to-peer model,
where I trust you and you trust me,
and because of that we now can give that trust
to other people as we go around.
So how do we know who we're going to be able to trust,
when there's no third party?
Well one of the ways we can do it
is by trusting somebody just because they said so.
So if I have a web server and I want you to trust it
I can install a self-signed certificate.
That says hey, trust me because I said I'm Jason
and you can trust me.
Now you have to decide if you're really
going to trust me though.
If you see one of these self-signed certificates
your web browser's going to give you a error,
like this one in Firefox.
Now you can choose to trust them
by clicking on the I understand the risks,
or you can say, you know, I don't trust that.
I'm going to go to a different website
and get my information there.
For security purposes it's not a good idea
to trust a self-signed certificate
and so this is kind of frowned upon.
You should probably, if you're having a website,
you should spend the money
and get a real digital certificate
from a trusted third party.
The second thing we can do is trust
the collective intelligence of others.
This is the system that's used by Pretty Good Privacy.
It's basically a web of trust,
where every person who trusts you
starts helping to increase your rating
and then as more people know you and trust you,
other people are going to know you and trust you.
The same thing kind of happens on Twitter and Facebook
and other social media.
Google uses this same concept when it's ranking websites.
If they're trying to figure out who's
going to be the authority for a particular topic,
they look at how many people are linking back to it.
So for example, if I'm looking up information
on the CompTIA security + exam,
the number one place that's going to come up
is CompTIA official website for the security + exam.
Because there's thousands of different links
that point back to it.
But if you look at it you might find that the
fourth or fifth person might be my course on it,
because a lot of my students have taken it,
liked it and then linked back to that course.
Now if you go down to page 30 or 40
you're going to find some site
that's not really trust worthy, right?
That's the idea with this web of trust
and this ranking of websites.
eBay had started this way back when they came out
in the late 90s.
Because there was no authenticated way
to prove who each seller was,
they came up with their rating system
and as I bought something from you, I would leave a review.
As you bought something from somebody else
you'd leave a review on them.
And this again is a peer-to-peer web of trust system,
because there was no centralized person saying,
this is a good seller and this is a bad seller,
but instead it was the wisdom of the crowd
that defined how well you were going to be trusted.
(electronic music)