3 added 41 characters in body
source | link

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?

To explain what I mean, take the following two examples:

Validating the person: "I trust that the key 0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.

Validating the email address (UID): "I trust that the key 0x559E3EE8 belongs to bob.stanford@examplecorp.com; I don't know who he is in real life, but we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?

To explain what I mean, take the following two examples:

Validating the person: "I trust that the key 0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.

Validating the email address (UID): "I trust that the key 0x559E3EE8 belongs to bob.stanford@examplecorp.com; we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?

To explain what I mean, take the following two examples:

Validating the person: "I trust that the key 0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.

Validating the email address (UID): "I trust that the key 0x559E3EE8 belongs to bob.stanford@examplecorp.com; I don't know who he is in real life, but we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."

2 Change "know" to "trust"
source | link

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?

To explain what I mean, take the following two examples:

Validating the person: "I knowtrust that the key 0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.

Validating the email address (UID): "I knowtrust that the key 0x559E3EE8 belongs to bob.stanford@examplecorp.com; we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?

To explain what I mean, take the following two examples:

Validating the person: "I know that the key 0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.

Validating the email address (UID): "I know that the key 0x559E3EE8 belongs to bob.stanford@examplecorp.com; we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?

To explain what I mean, take the following two examples:

Validating the person: "I trust that the key 0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.

Validating the email address (UID): "I trust that the key 0x559E3EE8 belongs to bob.stanford@examplecorp.com; we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."

1
source | link

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?

To explain what I mean, take the following two examples:

Validating the person: "I know that the key 0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.

Validating the email address (UID): "I know that the key 0x559E3EE8 belongs to bob.stanford@examplecorp.com; we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."