hashed user IDs [was: Re: Security of the gpg private keyring?]

[Ben McGinnes]

On 10/03/11 4:17 PM, Robert J. Hansen wrote:
> On 3/9/2011 10:42 PM, Ben McGinnes wrote:
>> Which brings us back to creating a pseudonym, using Tor (or other
>> anonymising services), getting a disposable mail drop (or using
>> alt.anonymous.messages) and going from there.  At the bare minimum.
> 
> Which brings us back to the elephant in the middle of the room: as
> far as I can see there's no consensus on a use case for this
> feature.

Certainly not that I've seen, I just like exploring ideas that seem
interesting or which may lead to other ideas.  I have, however,
discussed this one at length with MFPA on another list (which one or
two other readers here can attest to).

> Some people have a knee-jerk reaction to their email addresses being
> in any searchable database and want their emails obfuscated.

Meh.  I'm not in that camp, that horse has well and truly bolted.
Besides, anyone who just knows my name and domain can easily guess
which addresses will work for me.

> Against this threat, the proposed feature doesn't work: email
> addresses don't offer enough entropy and the mechanism could be
> brute-forced.

> Some people think they're going to take over the People's Republic
> of Berkeley in a military coup and need to be able to deny their
> connections to each other.  Against this threat, the proposed
> feature doesn't work very well: while you could conceivably come up
> with an email address with high enough entropy, it's easier to just
> use anonymous services and dead-drop emails.

Which, for those people who need to attain a certain degree of
deniability, this already works very well.

> Has a use case been articulated for this feature, along with how
> this feature would substantially advance the use case?  Because if
> not, one really needs to be.

I'd like to cede the floor to MFPA for this one.  If he doesn't, I
suppose I can trawl through my PGPNET folder and find our discussion.


Regards,
Ben

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20110310/1517fabe/attachment.pgp>