4 ms·
> If you actually email the users, I guarantee they'll tell you that isn't their real public key. Have you tried emailing them to test your theory?
by gherkin0 10y ago
> If you actually email the users, I guarantee they'll tell you that isn't their real public key.
Have you tried emailing them to test your theory?
- jsmthrowaway 10y agoI did a little easier than that. I picked two people at random with vanity domains (assuming they'd advertise their key on their site) and did a keyserver lookup for them, and noticed that two keys were submitted to the keyserver on the same exact day for both of them: the broken one from this Web site, and the other one that they advertise as their PGP key. Same key type, same size, same date, same UIDs, different fingerprints. Not really data, but interesting nonetheless to OP's point (and, if true, a little more ammo in my disliking-keyservers gun). The real data is how often the exponent 281479271743489 appears on that page. That really points toward bugs in key generation, IMO. Bad gpg at some point?
- cyphar 10y agoYeah, the exponent not being prime does point toward a broken key generation algorithm.