Re: kernel.org status: establishing a PGP web of trust

Krzysztof Halasa
2011-10-08T21:06:43Z

Jon Masters <jonathan@jonmasters.org> writes:

> One reason I stopped doing keysigning parties is that I
> realized they were mostly a show. You turn up and get a key signed and
> then everyone is impressed that you're in the strong set...wupdedoo.

I think there are other weaknesses than those. Examples:
- people checking the fingerprints on the keyserver, then getting the
keys later and signing without checking the fingerprints again (the
fingerprint may "change"),
- people sending the public key through email etc., and signing the key
without checking (the key may change in email).

Especially in a situation like this one, when a key signing activity is
expected, people MUST check the fingerprint against the authenticated
one WHILE signing the key. It's probably more important that the very
careful check of ID authenticity (watermarks etc).

I'd be only a little surprised if some key signing fraud resulting in
kernel.org access attempt or something similar is detected soon.

> Not
> that I've anything against signing stuff on kernel.org and trying to
> improve things (I've long directly signed everything on master with my
> own keys in slight violation of policy, but that turned out to right).

At first I thought you meant signing with your private key on master :-)
--
Krzysztof Halasa