0

If a public PGP key can be retrieved, but there is no known path of trust from the sender to the receiver: Is is better to encrypt the message using the key on spec or to not encrypt at all?

2 Answers 2

3

Assuming that the key is completely untrustworthy to the point that anyone can decrypt the message, then it can't be any less secure (technically) than unencrypted.

The main risk is psychological, in that you may come to trust the untrusted key.

0

You should always encrypt -- it can't be less secure than unencrypted anyway.

Even if there is no known path from sender to receiver, and even if you're afraid of a MiTM attack -- it's still better to encrypt that leave it in the clear.

However, the more important question is whether to send the message at all, or how you could create a chain of trust with the receiver/sender, rather than if you think encrypting is better than leaving it in the clear.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.