On 4/7/11 8:05 PM, Jan Janka wrote: > Hi Daniel, > > thanks for the answer, but it seems to me with this procedure you only > check whether the person has access to the email address, you > don't check whether this access is illegal, don't you? > > Tace care, > Jan >
Well, yes, but then you have to ask how OpenPGP protects against someone using a forged passport. Or more outlandishly, getting plastic surgery and using another person's real ID. At some point, technology can't solve the problem of authentication. In the case you proposed, you need to evaluate how much you trust Peter Hanssen in real life. If you've known him for years, it's unlikely he's just been waiting all this time to trick you into signing a key as part of some elaborate scam. Then again, if you've known him for years because you've been buying his counterfeit jeans, or he offered you $5000 dollars to buy your newborn baby, maybe you don't trust him and you don't sign the key. In the case of something like a key-signing party, (as Daniel described) you're really only confirming that (1) you've validated that they have something that you believe to be a valid government id, (2) You've validated their key's fingerprint in person, and (3) you've validated that they somehow control the attached email address. It is possible to assign different levels to your signature, so that you can distinguish between people you met at a software conference, and that guy who was your cellmate in that Turkish prison for 12 years. It's also possible to provide a link to an URL with your keysigning policy, where you can explicitly spell out the meaning of each level of certification to you. Keep in mind that the web-of-trust isn't the mafia. If you 'vouch' for someone and they turn out to be a rat, nobody's going to two bullets in your chest, and one in your head. Mistakes happen. You can always revoke your signature if you start to doubt the key's validity. You haven't made a mistake that will haunt you for the rest of your life. And if you're still worried about elaborate and obscure attack scenarios, then maybe the web-of-trust just isn't for you. This is perfectly fine. Just sign your real-life contact's keys with a local sig, which won't get exported to the keyservers. -- Grant "I am gravely disappointed. Again you have made me unleash my dogs of war."
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
