6 ms·
Do any of these keyservers perform email verification? It would go a good way towards some kind of verification that a user's GPG key corresponds to their email
by parennoob 10y ago
Do any of these keyservers perform email verification? It would go a good way towards some kind of verification that a user's GPG key corresponds to their email. Otherwise, anyone can generate a key with any email address and push it up to the servers. The standard way of verifying it (key-signing parties) is somewhat difficult.
- jvdh 10y agoThey don't because GPG is ancient, and there was no proper way to do email validation back then. It is sort of better now, but still very hard to do. If you have realistic worries that someone can intercept your email, then email validation of your GPG keys is not going to help.
- jvdh 10y agoKeybase.io is the best solution that has been put forward to solve this problem.
- cookie0 10y agoOnly https://keyserver.pgp.com https://keyserver.pgp.com performs email verification, the others don't. See: https://lkml.org/lkml/2016/8/15/445 https://lkml.org/lkml/2016/8/15/445
- therealidiot 10y agoIt seems that keyserver.pgp.com won't accept keys with revoked subkeys
- cyphar 10y agoMaking users assume that emails are in _any way_ verified is dangerous because it is far too low of a bar to provide any practical security for PGP keys. Not to mention that PGP keys can be used outside the context of email (so the email could be empty or otherwise incorrect).
- mnw21cam 10y agoAgreed. The keyservers are public posting boards. You are meant to verify that the key is sufficiently signed in a chain all the way to yourself before you trust it. Anything on the keyservers that makes people think the key has already been verified is a bad thing.
- dorfsmay 10y agoFWIW, although everybody talks about their new chat system, key verification is one thing keybase.io does well.
- torre76 10y agoLooking forward to the mobile client, which is only showed on blog post, already announced from a year or so, but never seen on the stores...
- raesene6 10y agoTo me a more useful model is the one implemented by keybase, where a number of proofs are provided, tying a specific key to the user's online identity (e.g. github profile/HN profile). Many times I want to "communicate with the persion identified as X on site Y" and this allows that to occur.
- dredmorbius 10y agoI've seen keybase and 1) cannot understand it or 2) understand its use-case. I don't associate online identities with my primary communications, generally.