2025-04-03 09:36 UTC
Replies (8)
-
@Xeniax@mastodon.ml 2025-04-03 09:39
#survey #keyservers 🔒🔑 PART 2 of the Keyservers Study (see part 1 here: https://mastodon.ml/@Xeniax/114273355035626553) ❓QUESTION 2: HOW DO YOU MAINLY USE KEYSERVERS? ✨✨ if you have used them in the past, you can also answer here!
-
@Xeniax@mastodon.ml 2025-04-03 09:51
PART 4 OF THE KEYSERVERS STUDY (part 1 and all the explanations are here https://mastodon.ml/@Xeniax/114273355035626553) ❓QUESTION 4: FOR THOSE WHO HAVE NEVER USED KEYSERVERS. WHY HAVEN'T YOU USED THEM?
-
@Xeniax@mastodon.ml 2025-04-03 10:00
PART 5 OF THE KEYSERVERS SURVEY (Part 1 and explanations are here: https://mastodon.ml/@Xeniax/114273355035626553) ❓ QUESTION 5: FOR THOSE WHO USE KEYSERVERS. WHAT IS YOUR RISK PERCEPTION? (Multiple choice)
-
@mo@mastodon.ml 2025-04-03 09:43
@Xeniax@mastodon.ml does Synapse count as a keyserver? :ageblobcat:
-
@aspensmonster@tenforward.social 2025-04-03 10:33
@Xeniax@mastodon.ml Totally nerdsniped :D I'd love to be a part of the study. I don't think that #KeyServers are dead. I think they evolved into Verifying Key Servers (VKS), like the one run by a few folks from the OpenPGP ecosystem at https://keys.openpgp.org/about . More generally, I believe that #PGP / #GPG / #OpenPGP retains important use-cases where accountability is prioritized, as contrasted with ecosystems (like #Matrix, #SignalMessenger) where deniability (and Perfect Forward Secrecy generally) is prioritized. Further, PGP can still serve to bootstrap those other ecosystems by way of signature notations (see the #KeyOxide project). Ultimately, the needs of asynchronous and synchronous cryptographic systems are, at certain design points, mutually exclusive (in my amateur estimation, anyway). I don't think that implies that email encryption is somehow a dead-end or pointless. Email merely, by virtue of being an asynchronous protocol, cannot meaningfully offer PFS (or can it? Some smart people over at crypto.stackexchange.com seem to think there might be papers floating around that can get at it: https://crypto.stackexchange.com/questions/9268/is-asynchronous-perfect-forward-secrecy-possible). To me, the killer feature of PGP is actually not encryption per se. It's certification, signatures, and authentication/authorization. I'm more concerned with "so-and-so definitely said/attested to this" than "i need to keep what so-and-so said strictly private/confidential forever and ever." What smaller countries like Croatia have done with #PKI leaves me green with envy.
-
@edavies@functional.cafe 2025-04-03 11:55
@Xeniax@mastodon.ml Sorry, didn't do the survey as the answers didn't really fit. E.g., I do use a keyserver, sort of, but less often than once every 3 months as I only do so when I extend the expiry date of my key once every 9 months or so. I have a GPG key for email and publish it on my web site as a linked .asc file and for access via Web Key Directory. I also put it on keys.openpgp.org. I used to put it on the main (MIT and friends?) keyservers but stopped bothering when they didn't deal with the attacks blowing keys up with extra signatures or whatever that problem was. Apart from testing with various people and helping get somebody else set up to use PGP only one correspondent actually uses GPG and they got my key when I uploaded it to their site so, as far as I remember, the keyservers, WKD, etc, have been of no practical use to me. This is regrettable. https://edavies.me.uk/contact.html#crypto
-
@alexx_net@mstdn.social 2025-04-03 17:07
@Xeniax@mastodon.ml I use key servers when I need a key. Not often or regularly, but will become so if Signal ends.
-
@magitian@fedia.social 2025-04-06 13:03
@Xeniax@mastodon.ml well, isn't it convenient for Gmail to implement its shoddy "pesudo-encryption", claiming it to be end-to-end encryption?