4 ms·

If you just want to share your public key safely, a .well-known directory on your domain works these days: https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD

carapace 6y ago
Ah that's awesome! I've never heard of that before. Thank you!
Arkanosis 6y ago
Just a quick note on WKD since I've been bitten by this a few days ago: as soon as you set it up, some people will start using your keys automatically, without even knowing it (eg. it seems that ProtonMail automatically uses keys found on a WKD to encrypt outgoing mails). While in itself it's not a bad idea, you'd better prepare for this to avoid looking stupid like me, when you receive a casual encrypted mail and you're not able to read it (my private keys are air-gapped and until now I only expected to receive PGP-encrypted mail if it was worth the effort to read it offline).
- oefrha 6y ago
  Using WKD is also a good way to solicit useless “security”-related emails from people running questionable automated scanners.
  - JBiserkov 6y ago
    That's why we can't have nice things :-( As soon as something is well-known, it will be abused by spammers/scammers.
  - Boulth 6y ago
    I think you confused this with security.txt standard. WKD is not enumerable (unless explicitly configured like that) so the issue doesn't exist.
- AnonC 6y ago
  > ...when you receive a casual encrypted mail and you're not able to read it (my private keys are air-gapped... Could you elaborate on why you put your public key in well-known and also how (and for what purposes) you use your air-gapped private key? As an average user, I’ve always been worried about private keys being stolen or lost.
  - Arkanosis 6y ago
    I'm trying to get my public key available to others by more reliable sources than the traditional PKS, mostly because I'm signing git commits and Linux packages. I've an encryption key as well that I use to encrypt server backups, but I'm not expecting it to be used much for emails (actually, every single email I've received with sensible information was /not/ encrypted — people just don't understand / care). Not all my private keys are air-gapped, but the encryption key is, since I don't need to decrypt my backups, and don't expect to receive encrypted email very often, so why take the risk? I have an old laptop which is not connected to any network and that I only use for this now: I plug the USB key with the private key, decrypt / sign whatever I need to and that's all. It takes me a lot of time, but I don't do that more than a few times every year.
zowanet 6y ago
Also GitHub supports https://github.com/<username>.keys https://github.com/<username>.keys
- fishywang 6y ago
  I think that's only ssh keys, not including gpg keys.
  - deleted 6y ago
    [deleted]
  - vorpalhex 6y ago
    There is a messy one-liner to get public gpg keys from Github but you have to call their API and parse the JSON response using `jq` or such.
  - dkanejs 6y ago
    You can use https://github.com/<username>.gpg https://github.com/<username>.gpg
  - yencabulator 6y ago
    And once age-tool.com is ready it'll happily encrypt to SSH keys ;-)
dethos 6y ago
Thanks, this is really useful. I just used Keybase as a reliable location to store and share my public keys.

carapace 6y ago

Ah that's awesome! I've never heard of that before. Thank you!

Arkanosis 6y ago

Just a quick note on WKD since I've been bitten by this a few days ago: as soon as you set it up, some people will start using your keys automatically, without even knowing it (eg. it seems that ProtonMail automatically uses keys found on a WKD to encrypt outgoing mails). While in itself it's not a bad idea, you'd better prepare for this to avoid looking stupid like me, when you receive a casual encrypted mail and you're not able to read it (my private keys are air-gapped and until now I only expected to receive PGP-encrypted mail if it was worth the effort to read it offline).

oefrha 6y ago
Using WKD is also a good way to solicit useless “security”-related emails from people running questionable automated scanners.
- JBiserkov 6y ago
  That's why we can't have nice things :-( As soon as something is well-known, it will be abused by spammers/scammers.
- Boulth 6y ago
  I think you confused this with security.txt standard. WKD is not enumerable (unless explicitly configured like that) so the issue doesn't exist.
AnonC 6y ago
> ...when you receive a casual encrypted mail and you're not able to read it (my private keys are air-gapped... Could you elaborate on why you put your public key in well-known and also how (and for what purposes) you use your air-gapped private key? As an average user, I’ve always been worried about private keys being stolen or lost.
- Arkanosis 6y ago
  I'm trying to get my public key available to others by more reliable sources than the traditional PKS, mostly because I'm signing git commits and Linux packages. I've an encryption key as well that I use to encrypt server backups, but I'm not expecting it to be used much for emails (actually, every single email I've received with sensible information was /not/ encrypted — people just don't understand / care). Not all my private keys are air-gapped, but the encryption key is, since I don't need to decrypt my backups, and don't expect to receive encrypted email very often, so why take the risk? I have an old laptop which is not connected to any network and that I only use for this now: I plug the USB key with the private key, decrypt / sign whatever I need to and that's all. It takes me a lot of time, but I don't do that more than a few times every year.

zowanet 6y ago

Also GitHub supports https://github.com/<username>.keys https://github.com/<username>.keys

fishywang 6y ago
I think that's only ssh keys, not including gpg keys.
- deleted 6y ago
  [deleted]
- vorpalhex 6y ago
  There is a messy one-liner to get public gpg keys from Github but you have to call their API and parse the JSON response using `jq` or such.
- dkanejs 6y ago
  You can use https://github.com/<username>.gpg https://github.com/<username>.gpg
- yencabulator 6y ago
  And once age-tool.com is ready it'll happily encrypt to SSH keys ;-)

dethos 6y ago

Thanks, this is really useful. I just used Keybase as a reliable location to store and share my public keys.