On Sun, Oct 19, 2014 at 07:24:31PM -0700, Daniel Roesler wrote: > Thanks for the response! During the cryptoparty, I learned a lot about HKP. > > First, you're right that the DNS entry for updates often with > different A and AAAA Records, and that makes sense for the > volunteer-operated, multi-organizational infrastructure. > > Second, this thread was initiated by a UX misunderstanding. When I > publish my public key, I ran the following command: > > $ gpg --send-key 72EFEE3D > gpg: sending key 72EFEE3D to hkp server keys.gnupg.net > > I was curious about keys.gnupg.net, so I copied the domain into a > browser, and was met with a scary landing page[1]. As to be expected, > I was concerned and started asking around, and others confirmed > something strange was happening[2].
Yep, definitely is confusing and scary! I didn't mean for my long technical-historical explanation to be as dismissive of user expectations as it turned out to be. :) > The big thing that we were missing was that HKP operates over port > 11371. If we were to have visited http://keys.gnupg.net:11371/, it > would have been the standard keyserver interface. Most servers mirror > that interface on port 80, but some servers have entirely different > webservers listening to port 80 (like the one with the scary landing > page). Nice, I didn't know about the in-browser HTTP UI available on the keyserver port! > I don't think that there's anything particularly insecure with this > DNS round robin setup, but it is very confusing for new users and > comes off as pretty sketchy. I know we can't and shouldn't enforce > that the keyserver should have a port 80 mirror, so how about changing > the UX to set expectations better? > > Would the experience be better if "gpg: sending key 72EFEE3D to hkp > server keys.gnupg.net" was changed to "gpg: sending key 72EFEE3D to > hkp server keys.gnupg.net:11371"? Would it be better to show the IP of > the particular server that was used (e.g. "104.37.104.142:11371")? That sounds like a really good idea, I like it! Further discussion probably belongs on the gnupg-devel mailing list, http://lists.gnupg.org/mailman/listinfo/gnupg-devel looks like a patch like the following (against git://git.gnupg.org/gnupg.git master) should do the trick. (warning, not even test compiled.) diff --git a/g10/keyserver.c b/g10/keyserver.c index 1b2e128..48d0e07 100644 --- a/g10/keyserver.c +++ b/g10/keyserver.c @@ -1746,9 +1746,10 @@ keyserver_put (ctrl_t ctrl, strlist_t keyspecs, else { if (keyserver->host) - log_info (_("sending key %s to %s server %s\n"), + log_info (_("sending key %s to %s server %s:%s\n"), keystr (keyblock->pkt->pkt.public_key->keyid), - keyserver->scheme, keyserver->host); + keyserver->scheme, keyserver->host, + keyserver->port ? keyserver->port : ""); else log_info (_("sending key %s to %s\n"), keystr (keyblock->pkt->pkt.public_key->keyid), -andy _______________________________________________ Messaging mailing list [email protected] https://moderncrypto.org/mailman/listinfo/messaging
