Timeline for Shouldn't GPG key fetching use a secure connection?
Current License: CC BY-SA 3.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 17, 2018 at 4:43 | comment | added | forest |
FWIW, I've seen keyservers with hkps:// for the protocol.
|
|
| Oct 1, 2013 at 17:11 | history | edited | Thomas Pornin |
edited tags
|
|
| Jan 4, 2013 at 7:18 | comment | added | humanityANDpeace | The alertness which is reflected in the question is great. The concern that is raised here is imho not to be neglected. After all spoofing+MITM keyserver-client communication can be a valueble way for attacks (and a possible one - given a lack signatures to make a trusted path). | |
| Jun 16, 2011 at 7:45 | vote | accept | LanceBaynes | ||
| Jun 16, 2011 at 7:45 | answer | added | LanceBaynes | timeline score: -8 | |
| Jun 5, 2011 at 11:23 | history | edited | AviD♦ |
edited tags
|
|
| Jun 3, 2011 at 16:27 | answer | added | Jeff Ferland♦ | timeline score: 3 | |
| Jun 3, 2011 at 15:35 | comment | added | nealmcb | I updated my answer. Note that a key does not refer to any particular keyserver, and when you check the key and the signature path from your trusted key to any given key, gpg doesn't need to trust any keyserver. So don't worry about that, even if someone does do a MITM on the keyserver. Though I do address other reasons why you would want a secure connection. Let me know if it isn't clear. | |
| Jun 3, 2011 at 7:06 | history | edited | LanceBaynes | CC BY-SA 3.0 |
added 381 characters in body
|
| Jun 3, 2011 at 6:54 | comment | added | LanceBaynes | i updated it! thx | |
| Jun 3, 2011 at 6:53 | history | edited | LanceBaynes | CC BY-SA 3.0 |
added 36 characters in body; added 4 characters in body
|
| Jun 2, 2011 at 20:24 | vote | accept | LanceBaynes | ||
| Jun 2, 2011 at 20:24 | |||||
| Jun 1, 2011 at 19:07 | vote | accept | LanceBaynes | ||
| Jun 2, 2011 at 20:24 | |||||
| May 31, 2011 at 4:28 | vote | accept | LanceBaynes | ||
| Jun 1, 2011 at 19:07 | |||||
| May 31, 2011 at 1:56 | answer | added | Daniel Miessler | timeline score: 3 | |
| May 29, 2011 at 14:25 | history | tweeted | twitter.com/#!/StackSecurity/status/74843690677436416 | ||
| May 29, 2011 at 0:24 | comment | added | nealmcb | Again, you're not clarifying what kind of "security" you're focused on. It's important to clarify what assets, threat model, etc. as the faq advises. Do you care if someone knows whose keys you're looking for? Or just whether you know who is responsible for some pgp-signed software you downloaded? Really - please read the faq. If it isn't clear, ask questions about it in meta.security.stackexchange.com. Without clarity on that stuff, we all risk just going around in circles. | |
| May 28, 2011 at 21:50 | answer | added | Thomas Pornin | timeline score: 17 | |
| May 28, 2011 at 20:59 | answer | added | Bruno | timeline score: 10 | |
| May 28, 2011 at 18:07 | history | edited | nealmcb | CC BY-SA 3.0 |
retag
|
| S May 28, 2011 at 18:06 | history | suggested | Bruno Rohée | CC BY-SA 3.0 |
typo in title
|
| May 28, 2011 at 17:52 | review | Suggested edits | |||
| S May 28, 2011 at 18:06 | |||||
| May 28, 2011 at 17:22 | answer | added | nealmcb | timeline score: 24 | |
| May 28, 2011 at 16:22 | history | asked | LanceBaynes | CC BY-SA 3.0 |