[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [OT] : gpg fingerprint in mail's signature ? - Was: Re: RFS: gtkwhiteboard (now dfsg compatible)

On Sunday 22 June 2008, The Fungi wrote:
> On Sun, Jun 22, 2008 at 05:41:11PM +0200, Olivier Berger wrote:
> > Is there any use in adding your fingerprint to the signature ? ... It
> > seems misleading at least, if users think they can trust that... and
> > without the public key, it's useless anyway.
> It's assumed that your public key can be commonly found on public
> keyservers or by fingering your address. Putting your key
> fingerprint in your .sig is *obviously* not equivalent to
> cryptographically signing a particular message, but it does help
> others identify that they've looked up the correct key for you if
> they want to encrypt a response to you. It's only potentially
> misleading if someone doesn't understand PKI in the first place, but
> then what's the point of avoiding misleading someone about something
> they don't know how to use in the first place? 

;-) Well yes, people who are unable to make the difference between a 
cryptographically signed message and such that merely contains a key 
fingerprint at the end could not be a factor with regard to the originator 
identification and verification process, since they don't know what to verify 
anyway and since it is a well known fact that everybody can write a message 
with any free-form text appended at the end ;-)

> I don't know if the 
> extra 40 characters make my .sig obscenely larger, but if they did I
> might shorten it to a key ID instead.

In order to shorten my appendix with one line I decided on key ID only 
instead, which is enough for public key diggers.

pub key ID 0E4BD0AB 2003-03-18 <people.fccf.net/danchev/key pgp.mit.edu>

Reply to: