Timeline for Shouldn't GPG key fetching use a secure connection?
Current License: CC BY-SA 3.0
25 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2021 at 7:18 | history | edited | CommunityBot |
replaced http://tools.ietf.org/html/draft with https://datatracker.ietf.org/doc/html/draft
|
|
| Oct 7, 2021 at 6:58 | history | edited | CommunityBot |
replaced http://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
|
|
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Sep 6, 2013 at 13:06 | history | edited | nealmcb | CC BY-SA 3.0 |
more on privacy
|
| Sep 6, 2013 at 12:58 | history | edited | nealmcb | CC BY-SA 3.0 |
parcimonie and privacy
|
| Sep 4, 2013 at 22:42 | comment | added | Terrel Shumway | Imagine someone sends you a signed then encrypted email. Your mail client happily retrieves the key for the signature. Evan is watching the traffic and sees the key fly by. Now he knows 1) that you can read messages encrypted with the key he sent to, 2) that you did read that particular message, and 3) the approximate time you read it. If this kind of confirmation attack worries you, use hkps and Tor to get keys, and don't do it automatically. parcimonie is a tool that works to solve this problem. | |
| Jan 5, 2013 at 18:01 | comment | added | nealmcb | @humanityANDpeace If you don't have a trusted path, then what are you trusting? Anyone can put any key with any name they want on any keyserver. So even with a secure communications link to a given keyserver, you can't simply trust the bits it is giving you. You need to either find a trusted path, or you need to use some out-of-band method to create one by verifying keys, and adding signatures to them (or making them trust anchors) when warranted. If you don't want to to that, then the web of trust is not for you. | |
| Jan 4, 2013 at 7:12 | comment | added | humanityANDpeace | @nealmcb: If I do not have signatures which allow me to make a trusted path (to the public key received) then I dare there is benefit me<->keyserver com encryption. I am sad people (mostly those who are already well in the WoT) tend to neglect those use cases where there are too little signatures on hand and hence the secure keyserver connection can prevent a MITM (which in that case is possible). | |
| Jun 3, 2011 at 15:30 | history | edited | nealmcb | CC BY-SA 3.0 |
address updated question
|
| Jun 2, 2011 at 17:37 | history | edited | nealmcb | CC BY-SA 3.0 |
added 75 characters in body; Post Made Community Wiki
|
| Jun 2, 2011 at 14:39 | history | edited | nealmcb | CC BY-SA 3.0 |
malware certificate
|
| Jun 1, 2011 at 19:07 | vote | accept | LanceBaynes | ||
| Jun 2, 2011 at 20:24 | |||||
| May 28, 2011 at 21:27 | history | edited | nealmcb | CC BY-SA 3.0 |
path examples; added 2 characters in body
|
| May 28, 2011 at 21:05 | comment | added | nealmcb | Hopefully my latest edit clarifies that. But note that you're still not clarifying your assets, threat model, etc. as the faq advises. Really - please read the faq. If it isn't clear, ask questions about it in meta. Without clarity on that stuff, we all just go around in circles. | |
| May 28, 2011 at 21:04 | history | edited | nealmcb | CC BY-SA 3.0 |
clarity on paths; added 94 characters in body; added 33 characters in body
|
| May 28, 2011 at 20:46 | comment | added | LanceBaynes | so because hkp uses only HTTP then it could be a target of mitm, and the actual key could be modified so that using hkp in reallity isn't secure? | |
| May 28, 2011 at 20:36 | comment | added | Rory Alsop♦ | +1 : I hadn't seen the draft-shaw doc before. Quite useful. | |
| May 28, 2011 at 19:17 | history | edited | nealmcb | CC BY-SA 3.0 |
added 128 characters in body; added 6 characters in body
|
| May 28, 2011 at 18:13 | history | edited | nealmcb | CC BY-SA 3.0 |
added 46 characters in body; deleted 4 characters in body; edited body
|
| May 28, 2011 at 18:05 | history | edited | nealmcb | CC BY-SA 3.0 |
added 186 characters in body; added 95 characters in body
|
| May 28, 2011 at 17:59 | history | edited | nealmcb | CC BY-SA 3.0 |
added 76 characters in body; added 1 characters in body
|
| May 28, 2011 at 17:53 | history | edited | nealmcb | CC BY-SA 3.0 |
added 129 characters in body
|
| May 28, 2011 at 17:39 | history | edited | nealmcb | CC BY-SA 3.0 |
rfc 4387; added 4 characters in body
|
| May 28, 2011 at 17:28 | history | edited | nealmcb | CC BY-SA 3.0 |
added 398 characters in body; added 3 characters in body; added 42 characters in body
|
| May 28, 2011 at 17:22 | history | answered | nealmcb | CC BY-SA 3.0 |