TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: Who regrets uploading their pgp key to keyservers?

4 点作者 yakamok将近 7 年前

2 条评论

znpy将近 7 年前
Not me.<p>Why should anyone regret this?<p>Unrelated, but I have a friend that used to say that having your phone key on a keyserver and having signatures to such key on the same keyserver was a weakness because that reveals your web of trust.<p>If that is the argument coming up, I want to say the following: anyone believing that has completely missed the point of gpg, key signatures and web of trust.<p>First: trust level is not how much you trust someone. It is how much you trust that key actually belonging to the person claiming to be the owner.<p>Second: the web of trust is not about your friends circle. Is about finding a path from a key you trust to a key you are examining. To do the gpg&#x2F;pgp thing right, you should really acquire as many signatures as possible.<p>All this is clearly explained in the GNU privacy manual and I really recommend anyone to read it. It&#x27;s not very long and it&#x27;s super useful.<p>-------<p>One last thing: I am not regretting uploading my key to a keyserver because the gnu privacy manual has explained me how to handle my keys. In particular, I do not have multiple keys in my name laying around. My old key has been revoked and it clear what key should be used to speak privately with me.
评论 #17565178 未加载
1996将近 7 年前
I do for an old key. It revealed my connections and allowed people to construct a network that could have been used against me. Like when I negotiate, if they can see I know XX it may get me not so good terms.<p>Online, I suggest for opsec to be keeping identities separate. And add some randomization, things that are obviously wrong with some basic googling about you. Demographic details for example
评论 #17565184 未加载