3 ms·
Your public key is always clear text, or at a minimum your public key finger print (which can be used via a key-server to find your personal information and pub
by valarauca1 8y ago
Your public key is always clear text, or at a minimum your public key finger print (which can be used via a key-server to find your personal information and public key).
So GnuPG to a degree makes it difficult to hide metadata about yourself as many tools will send your public key + data to a key server as soon as they create your key-pair. This is so when people verify you, your easier to find.
This creates a chicken-in-the-box metadata problem where for people to very your public GnuPG public-key is really you that info has to be public, but for anonymity it can't be .
- tanderson92 8y agoThis is all true, but is a different question from deniability when sending messages, and leaking metadata when sending information, which is what tptacek claimed: > ...in particular, it's difficult to send deniable messages with it. It's easy (unless tptacek is mentioning an attack I am unaware of) to ensure deniability -- encrypt but don't sign.
- jancsika 8y agoNot sure what OP was getting at (maybe the difficulty of deniability using GPG/GPG-encrypted mail defaults), but you'd still be sending to a recipient's long-lived public key. That's practically different than a system like OTR that has forward secrecy by default.
- tanderson92 8y agoSince anyone in the world can encrypt to a PGP public key, deniability is trivial. It is true that some systems (like enigmail) also encrypt to your own public key when sending messages, but this is also easily deniable.
- Dylan16807 8y agoYou usually want the recipient to be able to verify the sender, but not be able to prove it to a third party. Throwing away authentication entirely is a pretty baby-with-the-bathwater solution to deniability.