> The best solution would be to set it up so that sufficiently recognized
> individuals themselves become authorities, so you could be verified by
> employers, friends, etc, but the challenge there is ensuring that a small
> number of attackers can't create fake people who add an exponentially
> growing number of people and start a sybil attack (this is VERY hard, since
> the legitimate network itself needs to add an exponentially growing number
> of users).

'Sufficient recognition', much like trust, is not a *global* quality,
rather it is subjective. It's a pairwise property between people, not
a global property of an individual. A family of people all recognize
and distinguish each other, without needing to be recognized by any
external authority. So the idea that an entity 'sufficiently
recognizable by *some number* of people' should become an *authority*,
implicitly to everyone, is unnecessary.

Or to put it another way, your examples are missing a link, a third
referent. How about "you could be verified by your friends, to their
friends" or "you could be verified by your employer to the corporate
organization of employers"?

--
Andrew Miller