7

I'm toying with the idea of creating a pair of OpenPGP keys, and I'm wondering if I should include a picture or two. I know it will make my key a lot bigger, but is it still worth it?

I'm thinking of adding a passport-photo of myself.

I'm also wondering if I should also add a picture of a scan of my signature (you know, the old type - made with pen on paper). Would that be useful? Would it add risk?

  • Why would you want to add those? To increase security or for other reason? – Neil Smithline Sep 14 '15 at 23:13
  • 6
    For the record, I would tend to avoid making pictures of my signature public. – KnightOfNi Sep 15 '15 at 1:53
  • 2
    If the key is already referencing your real life identity, I see no issue with adding a photo and I would actually recommend it. However, if your key is a generic, pseudonymous identity then a photo will obviously reduce your privacy. – André Borie Sep 15 '15 at 14:01
6

Pictures would add additional information on your identity: similar to providing information on your name, location, place and date of birth, they might help others in identifying you (and distinguishing from people with similar names). A picture of you (and your signature, which seems an interesting idea) might help at verifying people meet with the right ones (or have a document really issued by you) when meeting: whether this is a real world problem, might be subject of discussion.

Compare your OpenPGP key with "extended" identity information with a digital identity card/passport.

Anyway, the risks of doing so are rather obvious. There is no risk to the "technical" security of your key, signatures on your images are just further signatures, exactly the same as the ones on your other user identities. For sure, there is a risk of identity theft, though: as all other information on your person, these could be used to impersonate your identity. If you've already put your photo on social media accounts, and your signature to your CV you put online, those information are public anyway, and all you do is giving a statement "these are really my picture and signature".

2

Whether or not it increases risk depends on what you consider risk. Adding photo may make identifying your key easier. If you add photo to your public key though, you need to consider that your photo will be public, some people consider that to be a privacy issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.