Words / Pair 40 of 41
Who granted it, and what were they promising
One is granted. The other is demonstrated over and over by the same key producing text you can check without asking anyone permission.
Granted by whom
A label the interface draws next to a name
Something the operator of the interface decided to display. It might mean an account is old, or that a fee was paid, or that somebody looked at something once. It means what its grantor says it means, and that meaning can change without notice.
A key that keeps signing
A private key that has produced text you have checked, more than once, over a period. It is not granted by anybody and it does not depend on any interface being honest. It survives the account, the label and the page.
Badges do useful work. They compress a lot of history into a small mark and they save everybody time. The trouble starts when a reader carries the badge across into questions it was never answering, and the biggest of those is whether the person now writing to you is the person the badge was granted to.
A badge lives on a page. It is drawn by whoever draws the page. If you are looking at a page you are not certain about, the badge is a picture of a badge, and a convincing one, since drawing it takes no key and no permission from anybody.
What a label can and cannot carry
- A badge is scoped to one interface. Off that page it means nothing, and it cannot be checked from anywhere else.
- A badge can be assumed. Names that read almost the same, next to the same coloured mark, are the ordinary way this goes wrong.
- A badge may not mean what you assumed. Nobody publishes the criteria, and the criteria can be revised at any time.
- A key does not move between people quietly. Either the holder signs or they do not, and you can settle it in a minute.
- A badge is granted, so it can also be granted to somebody else, and nothing on the page will tell you that happened.
The gap between the two is easiest to see when the interface goes away. If the page you knew is gone tomorrow, every badge on it is gone with it, and you are left holding a name you cannot check. A fingerprint written down in your own notes is unaffected by any of that. It keeps working wherever the person turns up next, which is the only test of an identity that ever really counts.
Ask for a line and check it
The request a label cannot meet
Ask the person to sign a short line of your choosing, then check the signature against a fingerprint you already hold for them. A badge cannot answer that request and an identity can.
Two things make that a real test rather than a ritual. The line has to be yours, so an old signed statement cannot be dredged up to satisfy it. And the fingerprint has to come from your own record rather than from whatever they send you, since a message that supplies its own fingerprint is only agreeing with itself. Both traps have pages of their own, on old statements against current ones and on good signatures from the wrong key.
When there is no key in the picture
Plenty of the time nobody has a key and nobody is going to get one. The label is all there is. That is a normal position to be in and it does not have to stop you, but it does have to change the size of what you put at risk, since you have no way of telling this party from anybody who can be shown next to the same mark.
Treat it as an unproven counterparty throughout and keep the exposure small enough that being wrong is an annoyance. What you must not do is let a run of good experiences quietly convert the badge into an identity in your head. The label did not become checkable while you were not looking, and the day it matters is the day something unusual is asked of you.
If you get it the wrong way round
- If you treat an identity as a mere badge
- You dismiss a person who can prove exactly what they claim, and you spend longer than you needed to on a deal that was already settled. The loss is patience.
- If you treat a badge as an identity
- You extend confidence built up by one party to whoever is currently sitting behind a label. Where money follows that confidence, the label will not be there when you go looking for it.
- If it is a badge
- Read it as background colour. Let it raise a mild expectation and never let it settle a question about money, an address, or where to send anything.
- If it is an identity
- Record the fingerprint yourself, somewhere outside any interface, and reuse that record every time. An identity you have to look up on their page each time is a badge with extra steps.
Questions readers send about this pair
A badge and a key both point the same way. Is that not stronger?
It is no stronger than the key on its own. The key already settles who produced the text, and the badge adds a claim from a party you cannot audit. Agreement between a strong test and a weak one is just the strong test.
They refuse to sign anything. Is that suspicious?
It is not proof of anything, but it does leave you where you started, with a label and no way to check it. Weigh that against what you were about to commit.
Can a badge be taken away?
By whoever granted it, at any time, for reasons that need not be published. That is the shape of the thing. A fingerprint you recorded yourself cannot be withdrawn by anyone.