3 ms·

> We use our own server to store public keys and transmit encrypted secrets. > We chose not to use the public keyserver network until it supports deleting keys

> We use our own server to store public keys and transmit encrypted secrets. > We chose not to use the public keyserver network until it supports deleting keys and cryptographic validation. ... as well as the fact that there's no email validation, yep!

tzs 8y ago
They should add support for the OpenPGP Web Key Directory [1] system. Briefly, the idea is that the public key for user@example.com should be available at https://example.com/openpgp/hu/<blah> https://example.com/openpgp/hu/<blah> where <blah> is generated as described in the document. Gpg supports looking up keys via this since 2.1.12 [2]. An example of how to lookup and get a key this way can be seen here [3]. [1] https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-07 https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic... [2] https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD [3] https://lists.gnupg.org/pipermail/gnupg-devel/2018-June/033814.html https://lists.gnupg.org/pipermail/gnupg-devel/2018-June/0338...
- xvector 8y ago
  This is a clever idea. Unfortunately, it doesn't seem like most mail providers would store something like this.
  - paulfurley 8y ago
    I can't see Gmail doing it :) But mostly teams control their own mail domain, so they can do what they like (for example, use Fluidkeys, and we'll do WKD for them!)
- paulfurley 8y ago
  Yes! We're working on it, both client side and server side. We've got WKD working on our own hello@fluidkeys.com email address using a rather cheeky hack[1]. Server side, we're adding this to Fluidkeys Server soon. That way, teams that use Fluidkeys could redirect `<team-domain>/.well-known/openpgpkey/(.*)$` to our server, and voila, we'll serve their keys via WKD [1]: https://github.com/fluidkeys/web-key-directory/ https://github.com/fluidkeys/web-key-directory/
- Boulth 8y ago
  I was just going to ask the same question about WKD support. Having control over key distribution in an organization is a very important factor for me.

tzs 8y ago

They should add support for the OpenPGP Web Key Directory [1] system. Briefly, the idea is that the public key for user@example.com should be available at https://example.com/openpgp/hu/<blah> https://example.com/openpgp/hu/<blah> where <blah> is generated as described in the document. Gpg supports looking up keys via this since 2.1.12 [2]. An example of how to lookup and get a key this way can be seen here [3]. [1] https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-07 https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic... [2] https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD [3] https://lists.gnupg.org/pipermail/gnupg-devel/2018-June/033814.html https://lists.gnupg.org/pipermail/gnupg-devel/2018-June/0338...

xvector 8y ago
This is a clever idea. Unfortunately, it doesn't seem like most mail providers would store something like this.
- paulfurley 8y ago
  I can't see Gmail doing it :) But mostly teams control their own mail domain, so they can do what they like (for example, use Fluidkeys, and we'll do WKD for them!)
paulfurley 8y ago
Yes! We're working on it, both client side and server side. We've got WKD working on our own hello@fluidkeys.com email address using a rather cheeky hack[1]. Server side, we're adding this to Fluidkeys Server soon. That way, teams that use Fluidkeys could redirect `<team-domain>/.well-known/openpgpkey/(.*)$` to our server, and voila, we'll serve their keys via WKD [1]: https://github.com/fluidkeys/web-key-directory/ https://github.com/fluidkeys/web-key-directory/
Boulth 8y ago
I was just going to ask the same question about WKD support. Having control over key distribution in an organization is a very important factor for me.