lkml.org 
[lkml]   [2011]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: kernel.org status: establishing a PGP web of trust
On Thu, Oct 06, 2011 at 11:58:22AM -0400, Jon Masters wrote:

> What I'd like to see is "keysigning" parties where folks with well
> established (in use) keys turn up and *prove* they own the key by
> signing some information the other attendees provide. That way they can
> not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
> photo ID" (which means nothing in the case of a well established online
> identify that is trusted already), but they can say "hey, I have access
> to this key, because I just signed that random message you gave me
> interactively". Who cares who the heck they really are beyond that?
> (intentionally a loaded statement to make the point).

A common approach to this for at least the e-mail portion of the address
is to sign the ID with the address and then mail the signed key
encrypted to the address, deleting all local copies and requiring that
the recipient publish the signature. This at least demonstrates that
the owner of the key can read mail at that address.


\
 
 \ /
  Last update: 2011-10-06 19:43    [W:0.212 / U:0.624 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site