[lkml]   [2011]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: status: establishing a PGP web of trust
    On Thu, Oct 06, 2011 at 06:39:40PM +0100, Mark Brown wrote:
    > On Thu, Oct 06, 2011 at 11:58:22AM -0400, Jon Masters wrote:
    > > What I'd like to see is "keysigning" parties where folks with well
    > > established (in use) keys turn up and *prove* they own the key by
    > > signing some information the other attendees provide. That way they can
    > > not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
    > > photo ID" (which means nothing in the case of a well established online
    > > identify that is trusted already), but they can say "hey, I have access
    > > to this key, because I just signed that random message you gave me
    > > interactively". Who cares who the heck they really are beyond that?
    > > (intentionally a loaded statement to make the point).
    > A common approach to this for at least the e-mail portion of the address
    > is to sign the ID with the address and then mail the signed key
    > encrypted to the address, deleting all local copies and requiring that
    > the recipient publish the signature. This at least demonstrates that
    > the owner of the key can read mail at that address.

    The 'caff' tool does this for you automatically. I just learned of it
    yesterday, and already it's saved me loads of time. Highly recommended,
    and odds are it's already packaged up for you in your distro.

    greg k-h

     \ /
      Last update: 2011-10-06 19:51    [W:0.020 / U:10.896 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site