Why hashed User IDs is not the solution to User ID enumeration (was: Re: Creating a key bearing no user ID)

[Peter Lebbing]

On 26/01/12 02:02, MFPA wrote:
> Definitely limited; I think of it as little more than a
> privacy-enhancing defence against casual snooping rather than a
> security measure. But is it really so marginal?

If you don't solve the key enumeration problem, it seems to me you're more
enhancing the feeling of privacy people have rather than actually enhancing
their privacy.

It does not really offer privacy, it just makes people think they have privacy.
That's not Pretty Good Privacy. It's more a request "please don't look here".
Which by the way makes people curious :).

And a curious person with a mean streak might sign a key with an obscured e-mail
address with a signature saying "this is the key for expires2012 at rocketmail.com"
}:-]. Which is verifiable by hashing the e-mail address. And once "keyserver
no-modify" is implemented, he'll create a website with a dump of all the
unobscured e-mail addresses, just because he can. He's like that once he sees
something that's obscured but not really blinded.

On the other hand, I think Hauke Laging's demands are met by the idea Daniel
Kahn Gillmor came up with.

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at http://wwwhome.cs.utwente.nl/~lebbing/pubkey.txt