5 ms·

> gpg: Options --auto-key-retrieve and --auto-key-locate "local,wkd" are now used by default. > Note: this enables keyserver and Web Key Directory operators to

by lima 9y ago

> gpg: Options --auto-key-retrieve and --auto-key-locate "local,wkd" are now used by default. > Note: this enables keyserver and Web Key Directory operators to notice when a signature from a locally non-available key is being verified for the first time [...] I'm not sure if I agree with that decision. Many people intentionally keep their keys off the key servers, and GPG is used by many internal signing applications (internal repos, etc.) where the keys aren't public, and enabling this by default would leak lots of metadata about the internal infrastructure. Last time I checked, the key server protocol was unencrypted, I hope this is no longer the case. On the other hand, it will improve usability for "normal" usage and you'll still be prompted to verify the fingerprint for unknown keys.

scrollaway 9y ago
The many people you're talking about are still a minority. GPG direly needs better usability and this was one of the pain points, good to see it fixed.
- lima 9y ago
  No, it's the other way around. GPG is extremely wide-spread for code signing (pretty much any Linux distro uses it), but it's barely used for email encryption.
jwilk 9y ago
AIUI, this doesn't use key servers; it's a different protocol. https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD
- hdhzy 9y ago
  Exactly. It uses the same host as uid's email. So if one have key "John Doe <jd@example.com>" it'd query example.com for reference to the key. It's not a security problem unless one considers their own company's servers untrustworthy. Technical details from the RFC: > For example the URI to lookup the key for Joe.Doe@Example.ORG is: https://example.org/.well-known/openpgpkey/ https://example.org/.well-known/openpgpkey/ hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q (local part is SHA-1 encoded) Source: https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-04 https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic...
  - agroot12 9y ago
    It is a security problem for the recipient. Imagine a dissident / whistle blower / journalistic source using gpg. I could send her a message, signed with a new key, and just wait until her gpg executable contacts my server. Then I have her IP address, and if I am lucky, I can plant an exploit into the very first request response.
    - hdhzy 9y ago
      I imagine this kind of people do not run with default configuration just as they use Tails and not your regular Ubuntu install. If not they can be traced with even less obvious means, just like PGP comments: http://www.csoonline.com/article/2904395/microsoft-subnet/mistakes-that-betrayed-anonymity-of-former-dea-agent-and-silk-road-investigator.html http://www.csoonline.com/article/2904395/microsoft-subnet/mi...
lfam 9y ago
As mentioned in the linked announcement, they also added a complementary option to completely prevent gpg from talking to the network. It should address the use case you describe: * gpg: New option --disable-dirmngr to entirely disable network access for gpg.
- AckSyn 9y ago
  Would be nice if the .gnupgrc would let you enable that, leaving the default to staying off the network.
- kzrdude 9y ago
  What pointy haired boss named that option? Just reading that sentence tells us it should not be named "disable-dirmngr".
burntrelish1273 9y ago
This is subtlety riskier for people whom don't fully grasp WoT model or whom blindly trust an external source, ie keybase, without in-person key id validation. GPG/GNU/FOSS and tech meetups need to vigilantly promote GPG key-signing/sharing events more and underscore its importance. PS: I wish GPG had better marketing / public multicast/broadcast communication.

by lima 9y ago

scrollaway 9y ago

The many people you're talking about are still a minority. GPG direly needs better usability and this was one of the pain points, good to see it fixed.

lima 9y ago
No, it's the other way around. GPG is extremely wide-spread for code signing (pretty much any Linux distro uses it), but it's barely used for email encryption.

jwilk 9y ago

AIUI, this doesn't use key servers; it's a different protocol. https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD

hdhzy 9y ago
Exactly. It uses the same host as uid's email. So if one have key "John Doe <jd@example.com>" it'd query example.com for reference to the key. It's not a security problem unless one considers their own company's servers untrustworthy. Technical details from the RFC: > For example the URI to lookup the key for Joe.Doe@Example.ORG is: https://example.org/.well-known/openpgpkey/ https://example.org/.well-known/openpgpkey/ hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q (local part is SHA-1 encoded) Source: https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-04 https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic...
- agroot12 9y ago
  It is a security problem for the recipient. Imagine a dissident / whistle blower / journalistic source using gpg. I could send her a message, signed with a new key, and just wait until her gpg executable contacts my server. Then I have her IP address, and if I am lucky, I can plant an exploit into the very first request response.
  - hdhzy 9y ago
    I imagine this kind of people do not run with default configuration just as they use Tails and not your regular Ubuntu install. If not they can be traced with even less obvious means, just like PGP comments: http://www.csoonline.com/article/2904395/microsoft-subnet/mistakes-that-betrayed-anonymity-of-former-dea-agent-and-silk-road-investigator.html http://www.csoonline.com/article/2904395/microsoft-subnet/mi...

lfam 9y ago

As mentioned in the linked announcement, they also added a complementary option to completely prevent gpg from talking to the network. It should address the use case you describe: * gpg: New option --disable-dirmngr to entirely disable network access for gpg.

AckSyn 9y ago
Would be nice if the .gnupgrc would let you enable that, leaving the default to staying off the network.
kzrdude 9y ago
What pointy haired boss named that option? Just reading that sentence tells us it should not be named "disable-dirmngr".

burntrelish1273 9y ago

This is subtlety riskier for people whom don't fully grasp WoT model or whom blindly trust an external source, ie keybase, without in-person key id validation. GPG/GNU/FOSS and tech meetups need to vigilantly promote GPG key-signing/sharing events more and underscore its importance. PS: I wish GPG had better marketing / public multicast/broadcast communication.