The Web of Trust plugin (WoT) implements a web of trust, similar to Advogato or other systems, primarily for filtering out spam. This is a network of pseudonymous identities, each of which can trust or distrust other identities. When a new identity is created, it obtains identities through the "seed identities" (an obvious point of failure, but unavoidable just as seednodes are unavoidable, short of personal introductions that might give the game away), and then solves a CAPTCHA challenge from an identity a few hops away from the seed. This gets it onto the Web of Trust with 0 trust, making it visible but only just. It is then necessary to get other identities to trust the new identity, so that it can introduce further identities, and so that it can't be blocked by one identity distrusting it.

The Web of Trust plugin is described in Detail in the Bachlor thesis by xor: See the Introduction email or directly download the thesis.

The main purpose of WoT is to make Freetalk work, by making introduction costly and filtering out bad identities while introducing good identities. But it is also a convenient way to manage and announce your own pseudonymous identities, connect to those you trust, and discover those further away. It is used by FlogHelper, currently just to track identities, but in future to announce flogs and allow them to be accessed from the user's identity page and hence from a post from them in Freetalk. It will eventually be used by distributed searching.

There are ongoing flamewars (or rather “trust wars”) on FMS (which is based on a similar web of trust) because some people do not use FMS’ web of trust to mark spammers but also to block suspected pedophiles and other people with digressing opinions.

Notice: Web of Trust is not related in any way to the popular Firefox extension with the same name. Using that tool together with Freenet would actually void your anonymity, as it reports the sites you visit to the company behind it!

The web of trust consists of the following objects:

• Identities are users of it
• Own identities are identities which you own
• Trust values between pairs of identities are a rating from -100 to +100 (inclusive) which any identity can assign to any other identity. Only one such rating can exist for each pair.
• Score values between pairs of own-identities and non-identities, also called effective trust in Freetalk, are the ratings which the plugin computes for each identity. Only one such rating can exist for each pair. If a score is negative, clients should not download content from that identity. If a score is equal to 0 or greater than 0, content should be downloaded.
• Puzzles are used to introduce new identities into the web of trust. A common puzzle implementation is the well-known captcha but other implementation (e.g. audio captchas) are also possible.

Identity A is a well-established identity, i.e. known and not mistrusted by lots of other identities. The owner of identity A has chosen to insert introduction puzzles to allow new identities into the web of trust. Identity B is a fresh identity and wants to join the web of trust.

Identity B discovers identity A and its puzzles. It displays the puzzles locally (in the web interface) to the owner of identity B who then tries to solve the puzzles. The puzzle solution is not verified; instead, a Freenet address is generated from it. This address will be used as a target address to insert identity B to. The only other identity that knows about this target adress is identity A because it has created the puzzle and thus knows the solution. It discovers identity B and inserts it into its list of known identities. This list will be picked up by other identities, and thus identity A gets introduced into the web of trust.

The plugin computes scores from each own identity to each non-own identity automatically like this:

• The rank of each identity is computed:
  • This is the shortest distance of the identity in trust steps from your own identity to the given identity. An own identity X has rank 0. A trustee Y of an own identity has rank 1. A trustee of Y has a rank of 2, and so on.
  • Identities which have received a trust value of 0 from an own identity get a forced rank of "infinite" (which is listed as "none" in the web interface) and their rank computation ends. Here it is called "infinite" for better imagination: Imagine an "infinite" rank as "the identity is still connected to your view of the 'good' identities but as far at the end as it can possibly be, if it was farther it would have no rank"
  • Identities to which the only path is via a trust value of 0 at the end of the path also get a rank of "infinite" / "none".
  • Identities which have a rank of "infinite" cannot inherit their rank to their children: By solving an introduction puzzle you can gain a trust value of 0. Those identities must not be able to inherit their rank to their children to prevent them from being able to create more than one identity by solving a puzzle.
  • Identities which are not reachable in trust steps have a rank of "null".
• The score is then computed:
  • Your own opinion of whether someone is a spammer should always overwrite the remote-opinion. Therefore, if a direct trust relationship between the own identity and the non-own identity exists, it is taken as the score, no further computation is executed.
  • For non-directly-trusted identities the score of the identity is then computed as the weighted sum of all trust values it has received. Trust values are weighted by the capacity of the truster:
    • Rank 1 identities have a capacity of 40 %. If a rank 1 identity assigns 100 trust, 40 points are added to the score.
    • Rank 2 have 16 %
    • Rank 3 have 6 %
    • Rank 4 have 2 %
    • Rank 5 and above have 1 %
    • Rank = "Infinite" / "None" have no capacity, their trust values are ignored: Identities which have only received trust through introduction puzzles should not be able to influence scores.
    • Rank = "null" means the identity is not visible to your own identity at all. Its score value is forced to "None" Its trust values are ignored. Imagine this as "beyond" the horizon of the "infinite" rank. Those identities shall not be downloaded by client applications.

• 1. Why is WOT needed, why don't we use automatic spam filters as with E-Mail?
  • The goal of WOT is not to hide the spam from you, but to prevent your Freenet client from downloading it at all. This is necessary to prevent Denial of Service attacks. E-Mail can handle DoS because E-Mail providers typically own very large computer infrastructure. Freenet is hosted by its users and therefore needs to be efficient both with network and CPU usage.

Sone stores strings as UTF-16, try:

grep -a -o 'U.S.K.@..\\{87,88\\}.,.A.Q.E.C.A.A.E.' WebOfTrust/WebOfTrust.db4o | sed 's,..,\\1,g' | sort | uniq

This will give you your private keys. Public keys can be retrieved by inserting a test file to SSK​@<private key>/test and cutting the key from the final URL.

Web Of Trust development

• Source code
• Pre-compiled binaries (RC)
• Pre-compiled binaries (pre-RC)