Skip to main content
edited tags
Link
AviD
  • 73.6k
  • 24
  • 141
  • 222
edited tags
Link
AviD
  • 73.6k
  • 24
  • 141
  • 222
Tweeted twitter.com/#!/StackSecurity/status/76655684887920640
edited body
Source Link
Iszi
  • 27.2k
  • 18
  • 103
  • 163

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my e-mail addresses from being too public, so as to avoid unwanted spam.

Along this train of thought, I began to wonder: If (feel free to correct me if I'm wrong) a PGP key is really meant to be a representation of my personal identity, does it really need to be associated with every e-mail address I'm going to use? Does it even need to be associated with an e-mail address at all? If not, what are the pros and cons of either implementation?

By my understanding, if someone receives a message that has my digital signature on it they should (in theory) be able to verify that the message came from me regardless of the sending address. Similarly, if someone wants to send an encrypted e-mail to me, they can (in theory) do so with my public key and be assured that no matter where that e-mail goes, only I will be albeable to read it.

So, what's the real deal here?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my e-mail addresses from being too public, so as to avoid unwanted spam.

Along this train of thought, I began to wonder: If (feel free to correct me if I'm wrong) a PGP key is really meant to be a representation of my personal identity, does it really need to be associated with every e-mail address I'm going to use? Does it even need to be associated with an e-mail address at all? If not, what are the pros and cons of either implementation?

By my understanding, if someone receives a message that has my digital signature on it they should (in theory) be able to verify that the message came from me regardless of the sending address. Similarly, if someone wants to send an encrypted e-mail to me, they can (in theory) do so with my public key and be assured that no matter where that e-mail goes, only I will be albe to read it.

So, what's the real deal here?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my e-mail addresses from being too public, so as to avoid unwanted spam.

Along this train of thought, I began to wonder: If (feel free to correct me if I'm wrong) a PGP key is really meant to be a representation of my personal identity, does it really need to be associated with every e-mail address I'm going to use? Does it even need to be associated with an e-mail address at all? If not, what are the pros and cons of either implementation?

By my understanding, if someone receives a message that has my digital signature on it they should (in theory) be able to verify that the message came from me regardless of the sending address. Similarly, if someone wants to send an encrypted e-mail to me, they can (in theory) do so with my public key and be assured that no matter where that e-mail goes, only I will be able to read it.

So, what's the real deal here?

Source Link
Iszi
  • 27.2k
  • 18
  • 103
  • 163
Loading