5 ms·
The OP doesn't recall generating one. Genuine question: do you also like it when someone else generates a key for you without telling you? Personally I would ra
by kiwijamo 3y ago
The OP doesn't recall generating one. Genuine question: do you also like it when someone else generates a key for you without telling you? Personally I would rather know about it.
- int_19h 3y agoThe OP did generate one and placed it in a public registry. What they didn't do was indicate that this key should be used to encrypt email sent to them to them.
- abofh 3y agoThey published it with an precise link to their email address - what were people supposed to conclude from them publishing it - "never use this pgp key unless you've spoken to me in person?" - that... kinda defeats the whole point of publishing a key _and_ the handle by which it's looked up in the same database. If you didn't want that, you'd associate it with something else that wouldn't expect encrypted email - like a name or a GUID and point people there when they need it. They wrote in the book "me@foo.com: use key" - and then people did. If he wanted different behaviour, he could have published "someoneelse@foo.com" and then they wouldn't use it to email _him_.
- PeterisP 3y agoIn the current world an "email address" is not solely (or sometimes even primarily) for delivering email, but rather an identity or username for various systems, such as for signing git commits. So a key linked to an identity (email address) does not imply in any way that this key is also used or usable for encrypted communication.
- kelnos 3y ago> "never use this pgp key unless you've spoken to me in person?" Well, yes, actually, that is what I would expect. (Well, not necessarily in person, but via a different communication channel, even by unencrypted email.) I remember when I was first playing around with PGP more than 20 years ago. The usual convention was to talk to the other party first about encrypting your messages, and not to assume that the recipient could receive and decrypt them in all circumstances.
- lxgr 3y agoThe original PGP idea was a "web of trust", which meant doing key signing parties and you hopefully ending up with a transitive chain of trust to anybody you might want to contact. Just blindly downloading keys from a keyserver and hoping they're the real thing was not the idea.
- Arnavion 3y agoRight, but other than the bug, the feature does seem nice. I do use WKD, and although nobody has ever sent me PGP email, it's nice to know that ProtonMail users would find it convenient to do so.
- lxgr 3y agoIt’s an absolute no-go. I do have an OpenPGP key published to the key servers, mostly for toying around with GnuPG cards, but as soon as anyone starts emailing me encrypted messages without any context, I’ll delete it.
- unethical_ban 3y agoI don't understand. It's not a security risk to read an encrypted message. Why would you delete an encrypted message?
- mkl 3y agoDelete the key off the server, I think, not the message.
- lxgr 3y agoYep, that’s what I meant!
- unethical_ban 3y agoStill strange, but I know what they mean now.