3 ms·

This has also been discovered with the Debian project, as I submitted a while ago [1]. The really scary part is the follow-up [2]: > € gpg --search-key samu

• tomrod 10y ago
  Why is this scary?
  • ckastner 10y ago
    Because it removes many obvious tells of a deliberate key collision targeting a specific key, and thus is harder to detect. For example, pgp.mit.edu and Enigmail would currently output information for both keys that would be almost identical per 2014-08-05, the day evil32 apparently generated the keys. I say "almost" only because they didn't set the correct timestamps, and apparently did not duplicate all UIDs -- but they easily could have. The diligent PGP user will of course not fall into such a trap, but an inexperienced user easily might, and there are many of them.
    • schoen 10y ago
      The whole point of this research was to underscore that PGP key acquisition is commonly broken. You could choose to blame PGP software, users, documentation, or the web-of-trust model itself, but in any case what a significantly number of people commonly do is unsafe.