--uQr8t48UFsdbeI+V
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Mon, 17 Sep 2001 at 16:12:25 -0400, Jean-Sebastien Morisset wrote:
[...]
> What do you guys do? Put up with the warning? Sign the key even if
> you're not sure? Use the X-PGP-Fingerprint header as a second
> validation? Use fingerprints in signatures?
>=20
> We should have a little poll. :-)
I put up with the warnings until i can verify a key, as doing otherwise
defeats their purpose, and the web of trust.
Like other have said, using fingerprints from the email header as
validation is a really bad idea, as they're exactly as easy to forge as
the signature itself.
I'm not of the meeting-in-person-or-over-the-phone-is-the-only-way
school though, as even that can be forged with a bit of planning and
luck. (Someone's phone can be answered by a malicious person
impersonating him, and you won't even know the difference if you haven't
heard either party's voice before, or an impersonator could show up at
an informal key-signing party without the real person's knowledge, and
so on.) It's also in many cases difficult to organise meatspace
meetings, with people situated all over the world and all that.
So i think the most realistic way to verify keys is to get fingerprints
from as many independant sources as possible, and basing your overall
trust on the sum of each individual source's trust, if that makes sense.
For example, if i can obtain matching fingerprints for many of the
FreeBSD core team members' public keys via:
- the various online mirrors of the FreeBSD Handbook
- a copy of the same handbook from an official release CD
- their personal homepages
- multiple mailing list postings
I'll consider the key trusted, without the slightly inconvenient step of
flying abroad and organising a meeting.
So the key (no pun intended) to making your public key easily and
securely verifiable is to have as many redundant copies of it spread all
over the place as you can. The more difficult it is for an imposter to
`fake' all the copies at once (or sequentially, while you're checking
them), the better.
--=20
Piet Delport <[EMAIL PROTECTED]>
Today's subliminal thought is:
--uQr8t48UFsdbeI+V
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
iD8DBQE7pq4EzRUP82sZFCcRAiQHAJ43xR3LC8BGZ5aWJa6PmTafxc3y/gCdFw09
25WU0PO5+uOSpFozgqqwrX4=
=4IfA
-----END PGP SIGNATURE-----
--uQr8t48UFsdbeI+V--
