0

When I generate key it has my email address attached to it. Does it mean, when I publish my public PGP key people also see my email attached to it? From what public keys I saw so far it seems to me everybody can see the address, but I am somehow not sure.

3

Yup, absolutely. PGP was not designed for anonymity -- quite the opposite in fact, it's designed so you can prove that you are who you say you are, and so people you've never met in person can easily look up your key and send you secure email. The idea of "anonymous PGP keys" doesn't really make sense.

Name and email address are required fields when creating a new key, and they get embedded into the key (along with a photo if you want). There is of course nothing stopping you from putting garbage into these fields if you are trying to hide your identity, but the better PGP clients I've used automatically use the To: and From: fields in the email to decide which keys in your PGP contacts list encrypt for / verify against. Putting in a garbage email address might actually make your key very difficult to use.

For example you can easily find my PGP key by searching my name or email address on the public pgp key servers, this is how the system is designed to work:

pub  4096R/62F715FD 2015-02-24 Mike Ounsworth <ounsworth@gmail.com>

You are not required to publish your key to a key server (but the more you use it, the higher the chance that one of your friends' clients will automatically publish it for you).

  • Yes that is what I encountered. The address I have tied with my key is not the one which I use for SENDING email, just for RECEIVING from public places. I have the separate RECEIVING email to avoid spam (in case of spam I can just destroy the public inbox). But I am facing small issue in Apple Mail, where it does not connect the key (public address) and my sending address, because they are different. Unfortunate – Mailo Světel Aug 22 '17 at 13:10
  • 1
    @Mailo – You can add more addresses to a PGP key. I don't think spammers harvest these things because anybody savvy enough to have a PGP key is also savvy enough not to fall for a scam (unless you're a potential high-profile target). I have addresses in my public key that have never received mail. – Adam Katz Aug 23 '17 at 17:09
  • @AdamKatz My concern is not scam, but spam. I am able to distinguish what is real communication and what is not, but I would like to avoid the need for "distinguishing" ;) – Mailo Světel Aug 24 '17 at 15:39
  • I was referring to spam. Spam attacks are often scams. My point is that there are few potential spam victims among PGP addresses, so it's not valuable to harvest. Spammers want suckers and impulsive people, not people who hand-copy long strings of hex code to meticulously get identity management just right. – Adam Katz Aug 24 '17 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.