[lkml]   [2011]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: status: establishing a PGP web of trust
On Thu, Oct 06, 2011 at 06:39:40PM +0100, Mark Brown wrote:
> On Thu, Oct 06, 2011 at 11:58:22AM -0400, Jon Masters wrote:
> > What I'd like to see is "keysigning" parties where folks with well
> > established (in use) keys turn up and *prove* they own the key by
> > signing some information the other attendees provide. That way they can
> > not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
> > photo ID" (which means nothing in the case of a well established online
> > identify that is trusted already), but they can say "hey, I have access
> > to this key, because I just signed that random message you gave me
> > interactively". Who cares who the heck they really are beyond that?
> > (intentionally a loaded statement to make the point).
> A common approach to this for at least the e-mail portion of the address
> is to sign the ID with the address and then mail the signed key
> encrypted to the address, deleting all local copies and requiring that
> the recipient publish the signature. This at least demonstrates that
> the owner of the key can read mail at that address.

The 'caff' tool does this for you automatically. I just learned of it
yesterday, and already it's saved me loads of time. Highly recommended,
and odds are it's already packaged up for you in your distro.

greg k-h

 \ /
  Last update: 2011-10-06 19:51    [W:1.150 / U:1.712 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site