Web Key Discovery

[Sam Bull]

On Mon, 2018-04-09 at 10:14 +0200, Bernhard Reiter wrote:
> Am Freitag 06 April 2018 17:22:18 schrieb Sam Bull:
> > > My suggestion is: As you are the only user on the server and completely 
> > > controlling it: Add a new identity each time you create a new email alias
> > > automatically on a server. If you want more security use a hardware
> > > token.
> > Wouldn't the server need to have the private key in order to add additional
> > user IDs? That would obviously be a big drop in security. 
> Yes, and no (as I've outlined).

Outlined where? I'm still not sure I understand how you would add a new ID
without a private key?

> > I already have 1000+ addresses, so it also seems a bit extreme sending a
> > PGP key with 1000s of user IDs.
> You could create a copy each time, each with only one user ID on it.

That sounds like an interesting idea.

Am I right in thinking that user IDs and the key itself, are essentially
separate things. So, if someone receives a key with user ID A, and I later
encrypt/sign with the same key but with user ID B, it won't cause any issues?
	Or would I need to add the matching user ID to the key before I
sign/encrypt?

> > > Note that someone how gets to control your server, could just create a
> > > new  email aliases and a completely new keypair they control and divert
> > > emails send to you, so you cannot defend against all of these attacks
> > > anymay.
> > If the private key is on there, then they would also be able to secretly
> > monitor all my communications.
> Yes, but if it is not on there, they would just use their own private key
> and act as a man in the middle.

Sure, but that's much easier to detect. e.g. Failing DMARC validation in both
directions all the time (if they don't have access to my email provider or DNS).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: This is a digitally signed message part
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20180409/d508a809/attachment.sig>