3 ms·

Good question. Not sure. Although I don't see why I wouldn't, if they have a PGP key listed? (I guess there is some question over whether the listed key is a

Good question. Not sure. Although I don't see why I wouldn't, if they have a PGP key listed? (I guess there is some question over whether the listed key is actually them?) But my point is that, well, email is a good way to do that, and Signal isn't, so I'm going to use email rather than Signal. Honestly, I wouldn't focus on (3), because as I see it, if you can replicate the feel of email, things like (1)-(2), so that it can replace email in contexts without (3), then (3) will just come naturally as it slowly replaces email. Edit: All this is assuming it isn't tied to a phone number or something similar, of course!

simonh 7y ago
How does one list a public PGP key, is there a verified central listing service?
- meruru 7y ago
  You can put it on your website or anywhere really. Some people use keybase.io for this.
  - jobigoud 7y ago
    You can't put it anywhere really, otherwise anyone could tie their key to your identity. Keybase.io is a good solution.
    - meruru 7y ago
      You're technically correct of course.
- roel_v 7y ago
  There used to be a bunch of those in the 90s and it was a mess.
- Leace 7y ago
  I guess they mean putting the key on a webpage or using Web Key Directory or a centralized service such as https://keys.openpgp.org https://keys.openpgp.org
- jlgaddis 7y ago
  One of the major features of PGP is that you don't have to rely on -- trust -- a "verified central listing service". The "Web of Trust" [0] fills that role: > As time goes on, you will accumulate keys from other people that you may want to designate as trusted introducers. Everyone else will each choose their own trusted introducers. And everyone will gradually accumulate and distribute with their key a collection of certifying signatures from other people, with the expectation that anyone receiving it will trust at least one or two of the signatures. This will cause the emergence of a decentralized fault-tolerant web of confidence for all public keys. [0]: https://en.wikipedia.org/wiki/Web_of_trust https://en.wikipedia.org/wiki/Web_of_trust
  - Natanael_L 7y ago
    The problem is nobody uses this right
  - zaphar 7y ago
    In practice a web of trust is only trustworthy 1 degree out from you. Just because you trust someone doesn't mean you should trust the people they trust. The web of trust is a difficult to use misfeature. In theory it's great. In practice it's unusable.
- nindwen 7y ago
  If you control your own domain, Web Key Directory [0] is a good option too. [0]: https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD

simonh 7y ago

How does one list a public PGP key, is there a verified central listing service?

meruru 7y ago
You can put it on your website or anywhere really. Some people use keybase.io for this.
- jobigoud 7y ago
  You can't put it anywhere really, otherwise anyone could tie their key to your identity. Keybase.io is a good solution.
  - meruru 7y ago
    You're technically correct of course.
roel_v 7y ago
There used to be a bunch of those in the 90s and it was a mess.
Leace 7y ago
I guess they mean putting the key on a webpage or using Web Key Directory or a centralized service such as https://keys.openpgp.org https://keys.openpgp.org
jlgaddis 7y ago
One of the major features of PGP is that you don't have to rely on -- trust -- a "verified central listing service". The "Web of Trust" [0] fills that role: > As time goes on, you will accumulate keys from other people that you may want to designate as trusted introducers. Everyone else will each choose their own trusted introducers. And everyone will gradually accumulate and distribute with their key a collection of certifying signatures from other people, with the expectation that anyone receiving it will trust at least one or two of the signatures. This will cause the emergence of a decentralized fault-tolerant web of confidence for all public keys. [0]: https://en.wikipedia.org/wiki/Web_of_trust https://en.wikipedia.org/wiki/Web_of_trust
- Natanael_L 7y ago
  The problem is nobody uses this right
- zaphar 7y ago
  In practice a web of trust is only trustworthy 1 degree out from you. Just because you trust someone doesn't mean you should trust the people they trust. The web of trust is a difficult to use misfeature. In theory it's great. In practice it's unusable.
nindwen 7y ago
If you control your own domain, Web Key Directory [0] is a good option too. [0]: https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD