4

Let's assume, that my PGP key has been signed by some number of people and vice-versa. Also, that the keys and signatures were published to the keyserver.

My understanding is that a random person knowing my public key, should be able to find out who I've met or at least had enough contact to convince them to trust me. But are there any other information which could be used in a malicious way, that one could conclude from the Web of Trust?

  • Any answer to this would surely be a guess? It totally depends on who signed it and how unique that set of people is. If, for example, it were signed by all heads of state for the G9, that probably tells someone a lot about you. Similarly, if all the signers were from your family. – Julian Knight Jan 13 '17 at 15:17
  • Well, surely the interpretation of data would be different depending on them. I rather meant if there would any data associated with me other than the signature itself. Like timestamps or other computer specific information. – Jakub Jan 13 '17 at 15:23
  • Other than timestamps, I don't think there is anything else. Timestamps could also leak information in the same way as the signers. If all your signing timestamps occurred within a few minutes, that might indicate it happened in person for example. I'm sure there are better examples but hopefully you get the drift. How practical is that? Not terribly I would guess except in certain very limited cases. – Julian Knight Jan 13 '17 at 15:34
  • @JulianKnight I don't see anyone contesting your comment. Maybe you should post it as an answer? – Jakub Jan 13 '17 at 21:30
2

Not sure this is the best of answers but as nobody else has yet stepped up ...

It totally depends on who signed it and how unique that set of people is. If, for example, it were signed by all heads of state for the G9, that probably tells someone a lot about you. Similarly, if all the signers were from your family.

Timestamps could also leak information in the same way as the signers. If all your signing timestamps occurred within a few minutes, that might indicate it happened in person for example. I'm sure there are better examples but hopefully you get the drift.

How practical is that? Not terribly I would guess except in certain very limited cases.

2

Well, the web of trust allows someone to map out relationships between people. That's a privacy issue and may tell people things about you that you weren't ready to share.

One example: Say you're a gay man living in Saudi Arabia. You obviously want to hide that you're gay, so you use PGP to encrypt mails to your romantic partners.

You all sign each others keys, building a web of trust, but you don't think to use anonymous e mail addresses.

Now one of you makes a mistake and is picked up by the police. He manages to throw his laptop into the next river, and he's not easily intimidated, and he used gmail over ssl, so nobody knows who he communicated with. BUT the police finds his key on a public keyserver, looks at the signatures, follows the web of trust/writes down the e-mail addresses, and pays all of you a visit.

That's probably a bit far-fetched, but if I were a forensic analyst, I'd probably look for public keys just as a matter of course, as one stop on my checklist (owning a public key would imply that there was encrypted communication, and I'd probably want to know who with, so signatures would be interesting. Now in my country digital forensic analysts are my friends, but in Saudi Arabia I imagine they might turn out to be a very dangerous enemy).

Another scenario might be that you actually DID use an e-mail address that couldn't be traced back to you, and didn't leave any obvious information in your public key, but then told your family to use that key to communicate safely with you. Unknown to you, two or three family members signed your key with theirs. Wham, you're no longer anonymous. Now your identity can be found by following the signatures of your family members.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.