5 ms·

They uploaded PGP key to open directory and then verified email, what is this as not an active decision?

• franga2000 3y ago
  It's an active decision to make their key available to people who wish to send them encrypted email. It's not a decision to receive all email in encrypted form.
  • deely3 3y ago
    Im not sure that I see logic here..
  • nkrisc 3y ago
    > It's not a decision to receive all email in encrypted form. Except, it is. You can’t control of everyone out only some will send you encrypted email.
    • lxgr 3y ago
      I mean, sure, if somebody wants to take a guess on whether I have my private key with me (or even still have access to it at all), that's on them. But if an email provider purportedly bringing email encryption to the non-GPG-trained masses does, it's a different story.
  • PKop 3y ago
    Using Proton for email means it is. Why use Proton otherwise?
• arghwhat 3y ago
  Uploading a key does not imply any decision regarding email. I may need it to sign tarballs or commits for example, and the key could very well have been lost to time. The presence of a key on a key server is in no way or form an explicit opt-in to encrypted email. That's what the CNAME is for.
  • gcr 3y ago
    Exactly. The only way this makes sense is if Google provided a way to import your PGP key into Gmail, which it doesn’t.
  • pxx 3y ago
    Except you explicitly uploaded an encryption key, not a signing key! This action broadcasts to the world the message "you can encrypt communications to this identifier using this key"! This is seriously like telling somebody that you can be contacted on a particular phone number and then getting upset that you're getting phone calls. "Who uses the phone these days," you complain, despite having set into motion the sequence of events that led to you getting a phone call! Worse, in this analogy, it's not like you even said "only text this number"; you explicitly applied metadata saying that you would be open to a phone call.
    • arghwhat 3y ago
      In your analogy, the keyserver is a phone book. You can find keys there, and yes you can try to use them, but it's not like telling someone you can be contacted on a particular phone number, but rather like them digging through a phone book and finding your name in there, possibly for an unused landline that you technically own but isn't wired up - who knows. Telling you to use a particular phone number - say through a business card, a contact page or a profile - is the analogy matching configuration of your domain to publish your intent, similar to how your domain also specify where you mail server is.