On Fri, May 08, 2009 at 03:24:18PM -0400, Daniel Kahn Gillmor wrote: > On 05/05/2009 09:06 PM, Benj. Mako Hill wrote: > > <quote who="Micah Anderson" date="Tue, May 05, 2009 at 05:14:55PM -0400"> > >> Some people do not like it if you upload your signature on their key > >> to a keyserver. > > > > I think those people are silly and can be happily ignored. Public keys > > are designed to be signed by anybody. It's up to you which signatures > > you trust. > > I'll put it this way: i've got no problem with people uploading their > certifications of *my* key directly to the public keyservers, because i > know my key and UID, and i can recognize them. ;) > > I *do* worry about people uploading signatures related to e-mail > addresses that they haven't verified, though, and caff walks you through > the process of verifying that the e-mail address is valid (it also puts > the decision about publication in the hands of the keyholder, if you care). > > If you want people to trust your signatures, you may prefer to use caff > (or something similar) to verify the e-mail parts of the UID instead of > uploading them directly. Let me put it an even different way: I don't necessarily trust mine *own* signature unless I've sent it to the email address in the user ID I'm signing, it has been received by the person represented by the user ID, they have uploaded it to a keyserver, and I have retrieved it from the keyserver. The reason to use caff is for yourself, not anyone else. The three things you want to know for sure when signing a key/userID combo are: 1. that the name in the user ID correctly identifies the person 2. that the person is in fact in control of the email address in the user ID 3. that the person is in fact in control of the key to which the user ID is attached I take care of 1. by "checking ID". Caff takes care of 2. and 3. in one fell swoop. Caff makes a signature and sends it in an encrypted mail to the email address in the user ID *BEFORE* I ever incorporate the signature into my keyring. I only incorporate the signature once I have downloaded it from the keyserver myself, which can only happen once the signature was received by the correct person at the correct email address, and said person decrypted it with the correct key and uploaded it to the keyserver. There may be other ways to accomplish this full set, but surely not as simply and elegantly. I would personally never trust one of my own signatures unless they had gone through this whole process, and by far the easiest way to go through this process is with caff. I've written this email before, and every time I write it I'm more convinced that caff is the *only* tool that should be used for key signing. jamie.
Attachment:
signature.asc
Description: Digital signature
_______________________________________________ DebianNYC mailing list DebianNYC@vireo.org http://lists.vireo.org/cgi-bin/mailman/listinfo/debiannyc