4 ms·
Exactly. It uses the same host as uid's email. So if one have key "John Doe <jd@example.com>" it'd query example.com for reference to the key. It's not a securi
by hdhzy 9y ago
Exactly. It uses the same host as uid's email. So if one have key "John Doe <jd@example.com>" it'd query example.com for reference to the key. It's not a security problem unless one considers their own company's servers untrustworthy.
Technical details from the RFC:
> For example the URI to lookup the key for Joe.Doe@Example.ORG is: https://example.org/.well-known/openpgpkey/ https://example.org/.well-known/openpgpkey/ hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q
(local part is SHA-1 encoded)
Source: https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-04 https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic...
- agroot12 9y agoIt is a security problem for the recipient. Imagine a dissident / whistle blower / journalistic source using gpg. I could send her a message, signed with a new key, and just wait until her gpg executable contacts my server. Then I have her IP address, and if I am lucky, I can plant an exploit into the very first request response.
- hdhzy 9y agoI imagine this kind of people do not run with default configuration just as they use Tails and not your regular Ubuntu install. If not they can be traced with even less obvious means, just like PGP comments: http://www.csoonline.com/article/2904395/microsoft-subnet/mistakes-that-betrayed-anonymity-of-former-dea-agent-and-silk-road-investigator.html http://www.csoonline.com/article/2904395/microsoft-subnet/mi...