2

enter image description here

I just stumbled upon this comic and I'm not sure if I understand what's going on. I googled and I figured that somehow people can sign other people's public keys and then they that person is genuine.

I wanted to ask what exactly does that mean, what would be the consequences and how does that comic relate to real world. For example, do people accidentally sign those keys?

2

1 Answer 1

2

As explained over at explain xkcd, key signing parties are a way to meet a lot of people and check their IDs easily in order to sign their (GPG) public keys.

Signing public keys is essentially vouching for the identity of the key holder, as not everyone can make sure it's actually the key of the real person they'd like to talk to.

Thus, the so called "web of trust" is a way to establish trust in otherwise unknown keys - if a lot of people signed the key, the idea is those can not all be fooled, identity-wise.

Hence, signing a strangers key without checking their ID (or somehow else establish trust in that this key belongs to that person) is a bad thing for the web of trust.

Additionally, there might be a word play regarding "key signing parties" and "key parties", the latter being a lifestyle party where men put keys in a bowl and women draw keys as random from that bowl, leaving the party with the key's owner.

2
  • How do you know that the key belongs to that person though? I mean, I guess it's not written on the key, nor their ID, is it? Apr 26, 2016 at 15:20
  • There are different approaches: send a mail and let it show you. If they attached a picture to the key, compare it. Check the name attached to the key. Maybe check an ID to make sure the person is actually who they say they are; comparing key fingerprints.
    – Tobi Nary
    Apr 26, 2016 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.