Re: kernel.org status: establishing a PGP web of trust

[Krzysztof Halasa]

Jon Masters <jonathan@xxxxxxxxxxxxxx> writes:

> One reason I stopped doing keysigning parties is that I
> realized they were mostly a show. You turn up and get a key signed and
> then everyone is impressed that you're in the strong set...wupdedoo.

I think there are other weaknesses than those. Examples:
- people checking the fingerprints on the keyserver, then getting the
  keys later and signing without checking the fingerprints again (the
  fingerprint may "change"),
- people sending the public key through email etc., and signing the key
  without checking (the key may change in email).

Especially in a situation like this one, when a key signing activity is
expected, people MUST check the fingerprint against the authenticated
one WHILE signing the key. It's probably more important that the very
careful check of ID authenticity (watermarks etc).

I'd be only a little surprised if some key signing fraud resulting in
kernel.org access attempt or something similar is detected soon.

> Not
> that I've anything against signing stuff on kernel.org and trying to
> improve things (I've long directly signed everything on master with my
> own keys in slight violation of policy, but that turned out to right).

At first I thought you meant signing with your private key on master :-)
-- 
Krzysztof Halasa
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/