lkml.org 
[lkml]   [2011]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: kernel.org status: establishing a PGP web of trust
    From
    Date
    On Wed, 05 Oct 2011 01:39:32 +0300, Adrian Bunk said:

    > But the semantics of PGP key signing is that you certify that you
    > verified that a photo ID of that person matches the name on the key.

    No. The semantics are that you've verified the person matches the key.
    Photo ID's are *one way* of doing it.

    http://www.gnupg.org/gph/en/manual.html

    The GNU Privacy Handbook says (under 'Importing a Public Key'):

    "A key's fingerprint is verified with the key's owner. This may be done in
    person or over the phone or through any other means as long as you can
    guarantee that you are communicating with the key's true owner. If the
    fingerprint you get is the same as the fingerprint the key's owner gets, then
    you can be sure that you have a correct copy of the key."

    Now, if you're doing a PGP keysigning, then yes, checking government-issued ID
    is probably the only sane way to verify 50 or 100 people's identities in an
    hour. But if you have other trustable channels of doing so, that's considerd OK
    too.

    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2011-10-05 06:25    [W:4.286 / U:0.316 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site