4 ms·

I have PGP keys on the keyservers but don't actively look random people up and send encrypted mail on first contact (perhaps something that can be automated). I

I have PGP keys on the keyservers but don't actively look random people up and send encrypted mail on first contact (perhaps something that can be automated). I'm surprised how often the reply I receive when contacting some German (.de) open source person is PGP encrypted.

dgrove 8y ago
> perhaps something that can be automated This is solved using WKD. Thunderbird already supports this with enigmail enabled
- Boulth 8y ago
  Yes, WKD works well for people in control of their own domain (e.g. kernel.org uses it). For other people there is also https://autocrypt.org/ https://autocrypt.org/
fefe23 8y ago
Please sign your outgoing mails if you have a key. Of the PGP mails I get, most are just encrypted to me. That is cryptographically not a sound idea, but it also means that I cannot encrypt back, because I don't know which key to encrypt to. The keyservers do not validate anything. They are just a storage medium. In fact, for my personal e-mail address, a prankster has uploaded a rogue key. There is no process by which I can ask for its removal. People who just take the key from the keyserver have a 50% chance to send me data I cannot decrypt. This is not a PGP weakness. It has been quipped that cryptography is a method to reduce a generic problem to a key exchange problem. There is some truth to that.
- Squithrilve 8y ago
  > Please sign your outgoing mails if you have a key. It's interesting that even Edward Snowden made this mistake of sending only encrypted email. For more elaboration about this subject K-9 resources are quite good: https://k9mail.github.io/2017/01/30/OpenPGP-Considerations-Part-II.html https://k9mail.github.io/2017/01/30/OpenPGP-Considerations-P...