3 ms·
The weakest point in this authentication is that it depends on an outdated google key which is no longer available via DNS. I was able to independently authent
by nullc 6y ago
The weakest point in this authentication is that it depends on an outdated google key which is no longer available via DNS.
I was able to independently authenticate the older google DKIM key used here by taking emails I received to a gmail account in 2015 and validating that they verify with the claimed key.
This is something that many HN users should be able to do for themselves.
Someone else also opened a pull request which include an email they received (authored by me, in fact) which was cryptographically timestamped, complete with DKIM data matching this older Google key, into the Bitcoin blockchain back in 2016.
I think unless Google wants to step forward and suggest that they lost control of their private keys it is reasonable to assume that the particular email which is the subject of this repository is authentic.
If further complete emails which are a part of this event sent via gmail are published it should be trivial to authenticate them through the same technique.