4 ms·
"Kind of defeats the point - how do you know you're downloading the private key you scanned?" Assuming that "private key" is a typo (you download public keys),
by betterunix 13y ago
"Kind of defeats the point - how do you know you're downloading the private key you scanned?"
Assuming that "private key" is a typo (you download public keys), you can just check the fingerprint of the key against the fingerprint you were given. That is easily automated.
- XorNot 13y agoThis puts us back in the same kind of problem that was being complained about though - keyservers, publishing keys etc.
- betterunix 13y agoNot really. The problem is not about publishing keys or key servers, but with the cumbersome process of having to enter a hexadecimal string (and having to check an even longer string). The point of using QR codes is to simplify things: the user just scans a QR code, and the key is fetched and assumed to be valid (i.e. no need for the user to check fingerprints).