3 ms·
I'm afraid that fundamentally doesn't work (though at first glance it does). Email is not a forum - it's person to person. When someone emails me, I might not k
by CHY872 11y ago
I'm afraid that fundamentally doesn't work (though at first glance it does). Email is not a forum - it's person to person. When someone emails me, I might not know anyone else who has also had a conversation with them.
In order for anyone to trust your key at all you need to make it available out of band.
This is because otherwise, your email provider could simply man-in-the-middle you (or them); and they have no way of working out.
The first time they email you, their key is already compromised. You then build up your trust for them; but you've trusted an attacker. The system is worse than useless.
This is worse than (say) TLS because TLS, you generally do not connect through a single access point. Email is far more centralised.
So, they need to get your key from outside the communication system, somehow.