🚀 go-pugleaf

> It seems to me that there are only two really different schemes
> on the list:  Telephone Verification, and all the rest.  What the

Telephone verification doesn't work too well for *SOMEONE YOU MET
ON USENET*.  Actually, even meeting in person with exchange of ID,
fingerprinting, genetic samples, retinal eye patterns, dental work
analysis, etc. the first time doesn't work very well, either.  What are 
you going to compare the results to?  Unless you have access to some 
government's fingerprint files, and that person is IN the files, what 
have you accomplished? The second time, all it proves is that it's 
the same impostor as the first time.

On Telephone Verification:  you weren't going to believe that phone
number your friend sent you by email, were you?  So you look it up in 
the phone book.  You won't find me in the phone book.  You will find
a fake name with my phone number (one which means, to me, "the caller
asking for him is a scummy telephone solicitor").  It's probably hard 
to spoof my copies of the telephone directory quickly (but they do change
something like every year or two, and you could probably get away with
a realistic-looking but fake book delivered a few weeks before the real
one), but spoofing a name in the "new listings" section on Directory 
Assistance is probably trivial, provided you have a place in the area 
to connect a phone.

In-person meetings and postal mail verification have much the same
problem.  Of course, if you've met the person before and recognize
him, THEN you've proved something, but now you're requiring a
pre-existing relationship beyond "net persona".  Of course, if
whatever you're doing requires real trust (like exchange of large
amounts of money, or conspiring together to do something seriously
illegal), you probably don't want to do it with someone you don't 
know that well.  They might be a thief or a law enforcement official.

					Gordon L. Burditt
					sneaky.lonestar.org!gordon