-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 El 02-12-2014 a las 7:53, Robin Mathew Rajan escibiĆ³: > Hello David, :) > > I already uploaded my public key to a public key server some months > ago. But there's no local Linux users group where I live! I sent > emails to some people listed at biglumber.com with my Government > issued ID card attached. But no reply came from them. :( Some of > them are CACert Assurers!
CAcert requires face to face meetings, since we (yes, I'm an assurer) must check the government issued ID and try to figure out if it has been tampered. Then we must compare the picture with your face, to make sure you are you, and not someone else with your ID. But the purpose of getting a signature in your key is to: 1.- allow the person that issues the signature to trust your key validity. 2.- allow people trusting the signature issuer's judgement to trust your key validity. So, if you get CAcert's signature, it allows people trusting CAcert procedures to consider your key as valid, but it won't have any meaning for people that doesn't trust CAcert. Several persons in this list falls in that category. A signature from a local linux users group would mean nothing to me, since I don't know any of them, and I don't know what kind of validation they do before signing a key. In other words, you want signatures, but not just any signature, you want signatures that have some meaning for the people that will be exchanging messages with you. I know when I first made my key, I wanted it signed, as if it was some kind of autograph book, but after a while you realize it just increases the key's weight. Nothing to worry too much about, since while you can't remove signatures from keyservers (and you can't prevent somebody from fetching your key from a keyserver, signing it with 200 bogus keys, and uploading it again), you can still clear your local copy of your key, and send it by email to one of your friends. And your friends can also fetch your key and clean it from all the meaningless signatures it may have (meaningless to them, as I said, it depends on each person). For some uses, I could use a key carrying only a nickname, and exchange signatures with my gaming alliance, and that would be OK, since I won't be exchanging any world domination plan with them. If I were working with a customer that is a representative of a bank, and I had to email him the user and password for the server I just setup for them, I'd require a face to face meeting to sign his key (and I wouldn't mind too much about what name is on the key, I'd care about the person that uses the key. If they key says "Barak Obama", I'd issue a local signature, so I can still use the signature to verify the key's validity, and I would not be vouching to the world the key belongs to "Barak Obama"). Or I could trust the signature already issued by my boss. By the way, that was just an example, probably any customer requesting me to give them the server login info would accept it in plain text over email, or maybe using whatsapp. If "paranoid", they may request the user name being sent by mail and the password by SMS. Yes, it's frustrating. Best Regards -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJUf4HwAAoJEMV4f6PvczxAsxsH/1+hkZvznGKT4OERtKrygsRN XUOeXz3AOM0gZZZJ6S91tLvjz7aCqtjZGVZRx7mDq0IRXdvJ8enfuysyTgPpKPfM JNE23xF2e7D12lbJR9dfSPftruOd38HqN9kIOMtI1oXa28rAgBqfV0o04Gba8JlD HsOVCrd2y+E82Ozbf79xAP7Ckg57MSBkmULpwz2cgC2b7OagSYA9hmL8uMe23Ktl LdXq/y83AEsRxAM8Drd9hw/Wvqsj6AMarTvxOz5CZFdqs4q/5X1ZsLMM4acikC+r 8ydWH3shoefASam4kfHJhXMpNLhjUWxo4mX0dcqAcjMiZjTMaMqZyJRLUR/feh0= =QTn4 -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users