Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I just stumbled upon this comic and I'm not sure if I understand what's going on. I googled and I figured that somehow people can sign other people's public keys and then they that person is genuine.
I wanted to ask what exactly does that mean, what would be the consequences and how does that comic relate to real world. For example, do people accidentally sign those keys?
As explained over at explain xkcd, key signing parties are a way to meet a lot of people and check their IDs easily in order to sign their (GPG) public keys.
Signing public keys is essentially vouching for the identity of the key holder, as not everyone can make sure it's actually the key of the real person they'd like to talk to.
Thus, the so called "web of trust" is a way to establish trust in otherwise unknown keys - if a lot of people signed the key, the idea is those can not all be fooled, identity-wise.
Hence, signing a strangers key without checking their ID (or somehow else establish trust in that this key belongs to that person) is a bad thing for the web of trust.
Additionally, there might be a word play regarding "key signing parties" and "key parties", the latter being a lifestyle party where men put keys in a bowl and women draw keys as random from that bowl, leaving the party with the key's owner.
