28

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my e-mail addresses from being too public, so as to avoid unwanted spam.

Along this train of thought, I began to wonder: If (feel free to correct me if I'm wrong) a PGP key is really meant to be a representation of my personal identity, does it really need to be associated with every e-mail address I'm going to use? Does it even need to be associated with an e-mail address at all? If not, what are the pros and cons of either implementation?

By my understanding, if someone receives a message that has my digital signature on it they should (in theory) be able to verify that the message came from me regardless of the sending address. Similarly, if someone wants to send an encrypted e-mail to me, they can (in theory) do so with my public key and be assured that no matter where that e-mail goes, only I will be able to read it.

So, what's the real deal here?

Improve this question
1
  • 2
    On the subject of spam, I found this. It is the PGP Global Directory FAQ, and it claims that "gathering email addresses from the PGP Global Directory [is] one of the least effective ways of harvesting email addresses for spammers." See the second-to-last question, which addresses your concern. (Of course, this may vary depending on the keyserver.)
    – Brian McCutchon
    Commented Jun 4, 2015 at 2:16

2 Answers 2

Reset to default
12

Depends on how you are using PGP.

From version 10.0 of the PGP Desktop client, the encryption and decryption is seamless and automatic from an Outlook rich client.

If your email address is the same as what is in your PGP key then you can email with a simple rule like anything you set Sensitivity to Confidential > Encrypt. Any encrypted received to this email address will also be decrypted automatically. When rolling out to non-technical users we found this a major benefit.

You can always not associate your real email address with PGP key and encrypt the contents manually. Or put the data in a document, encrypt that and email in clear text. Vise versa for receiving encrypted email.

You are right it does not effect signing. Although again if you submit it with an email address to the open PGP global server, it gets signed by that key and if the receiving party has imported the PGP global key, they will get a nice blue border around the email saying this email signature has been verified. Otherwise it will be red and say this the signature cannot be verified. Does not effect cryptographic validity of the signature just the UI experience

So it is a really a convenience vs. email enumeration trade-off. Considering that email address is used as a username in many services, and at least gmail spam filtering is extremely good (I also use the unsubscribe.com service because I'm lazy). Personally I would not have a problem with associating my email address with my PGP key and publishing to the global server.

Improve this answer
5

If you don't want to use PGP for giving normal email correspondents confidence, you can put any identifying info in there you like - alternate email, web url, phone number, or none at all. You basically generally want to use it to claim a unique identity attribute.

Note that you're also typically asking others who sign your key to vouch for whatever you put there. They can verify a name via a photo id, and an email by sending you something. Good signers would want evidence that you controlled a web site, etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .