Proposal of OpenPGP Email Validation

MFPA 2014-667rhzu3dc-lists-groups at
Wed Jul 29 02:48:54 CEST 2015

Hash: SHA512


On Tuesday 28 July 2015 at 8:17:28 PM, in
<mid:55B7D548.4020104 at>, nico at wrote:

> AFAIK, there are not THAT many faked keys, but the
> problem exists especially for key parties of our
> internet world (a famous German magazine, at least one
> GPG tool, ...). The problem is that the German magazine
> takes this as a show stopper (both personally and
> publicly). I really want to have them back on our road
> for more encryption with OpenPGP. And the "publicity"
> we get from not validating email addresses is really a
> big problem (especially as fixing that problems sounds
> so easy and obvious). Thus, without fixing this, IMO
> the whole OpenPGP movement has a reputation problem.

I understand what you are saying. I cannot help but think they are
making a mountain out of a molehill by characterising this minor
irritation as a "show stopper". Putting something in place to
counteract the issue is one approach. Would it not be an equally-valid
approach to educate them as to why it is a non-issue, which they could
then disseminate through their magazine?

> Today, people with faked keys simply get unreadable
> emails, but don't know whether there were trolls or
> spies at work.

They can, however, search on keyservers for the key to which the
message was encrypted. Or ask the sender where they got it and to
forward a copy for inspection.

> After validating their own key, only one
> of two things can happen:
>  either the
> problem is solved or we know that the problem is more
> severe than just a work of trolls only uploading a
> faked key for fun.

Fair enough.

> But if G claims that an email address was validated
> although it was not, they express this as a public
> signature visible to the whole world. If they do that,
> people can/will find out and blame G. But that's
> something G clearly wants to avoid (they need trust by
> their customers). Thus, they have much more interest
> not to signal validation of a faked key because any
> violation here is easy to detect.

The provider could claim the user's password must have been
compromised and that was how the validation occurred without the
user's knowledge. They could even make the user jump through password
reset and security question hoops the next time they log in. Anyway,
after ten minutes public attention will switch to something else.

- --
Best regards

MFPA                  <mailto:2014-667rhzu3dc-lists-groups at>

Adults are obsolete children.


More information about the Gnupg-users mailing list