3 ms·

> Maybe it's a good idea to tag a public key with the software/version used to create it. I'm a full-disclosure guy at heart, but why would I want to advertise

• mindslight 15y ago
  Hence the 'maybe'. But what information would actually be leaked by knowing the generation software (assuming it's decoupled from the server software)? It seems if a certain implementation's keys are weak, one could simply try to exploit that over all keys. I don't need to know you're running Debian before I go scanning for those particular weak keys.
• djcapelis 15y ago
  > Wouldn't I find my own personal selfish security is maximized when I falsify that field when generating my keys? It depends if you're the type of user who would like to rely on hearing themselves that their keys are vulnerable because of the software used or if you're the type of user who would like to be informed by an automated script that their keys are vulnerable. I am guessing there are many in the latter category and a few in the former category but at the same time most of the people who decide these things will live in the former. As for you, marshray, personally, I'm going to go with yes. But does that really make things worse for those who opt in to the potential for notifications? I think you can make your security tradeoff and others can make theirs and both categories of users will end up happy.