The perils of comments in blogosphere

Taking interest in security and public key cryptography, has brought me to a concern about the unacceptable easiness of identity theft in blogosphere comment section.

Many blogs use open commenting system in order to allow bloggers from other blogging systems to be able to comment. Some have an option to register.

Now think of it. How easy is to pretend that you are someone else in open commenting system? Absolutely no challenge, even for the absolute newbie, since the system relies on trust that you would enter your own details. Registering doesn't solve the problem either. There are so many blogging systems, including the independant ones, that it makes impossible to register in all of
them. There is also a challenge of remembering all the passwords on different systems, because using the same password, is a recipe for possible disaster. Much worse, than in the first case.

Why should you care? Who would bother to hassle you?
Fist of all, some of the bloggers are quite prominent and have much influence, making them a welcoming target for many possible reasons. Second, the are many cases of web vandalism like trolling. Some vandals even form groups, like GNAA.

How can we solve it?
There are two possible solutions that I can think of.

One, is to create a global, multi-platform registration system that would manage all the web identities. This would require a broad support from both public and commercial blogging systems and a lot of resources both to set up and to maintain. There is also a possibility of hijacking identities during the introduction of the system, just as described before.

Second, is to use digital signatures, common in public key cryptography. The advantages of this method are clear. There is no need in making a global system and is quite easy to implement, with widely available tools.
There are some problems to be solved thou. For example, digital signatures aren't very HTML friendly, not very pleasing to the eye and some blogging systems are reformatting the comments, therefore destroying the signature. Using an external program to sign the comments, could be a hassle too.
Some of those problems could be overcome, with simple to use plug-ins to existing systems. For instance, the "ugly" signatures can be replaced with neat icons, after the system has verified the message. All the signing and verification could be done within the browser, without external programs. Such plug-ins would be widely available as soon as the method begins to be adopted.

Getting more information and security tools can be done from GnuPG.org.

My public key can be obtained here.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is how digital signature looks like
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEoBjCTrdUoO5KTCwRAq+bAKCnFSTqOxpxPSPcw+DVs2ngVe3wzgCePXqI
rpuD/ymQxBQPGjsjKNGmc+M=
=rPcc
-----END PGP SIGNATURE-----