On 19/10/2026 11:27, Anton Shepelev via Gnupg-users wrote:
I should also observe that WKD/WKS is generally
considered a better alternative to centralised key
servers, as it is less vulnerable to key-spamming
attacks: <https://wiki.gnupg.org/WKD> .
WKD is generally better for the following use case:
1. example.com's domain admins support PGP
2. Bob does not already have a key for [email protected]
Bob can then use example.com's WKD server to find a plausible key for
Alice. This avoids a lot of spam issues, but at a price:
1. Relatively few domains run a WKD server
2. A lot of trust is placed in the email-domain admins
3. Alice (or an attacker who compromises her account) can prevent
distribution of updates (such as third-party revocations)
If the email provider is part of your threat model, or is just being
uncooperative, then WKD doesn't help much.
The key advantage of public keyservers is that they will distribute
updates for anyone's key, and many keyservers (such as keys.openpgp.org)
have strict antispam protections.
So I would normally recommend using both WKD and public keyservers,
wherever possible.
A
_______________________________________________
Gnupg-users mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-users
