On Wed, 2019-07-03 at 03:01 -0700, Mirimir via Gnupg-users wrote: > On 07/02/2019 11:42 PM, Michał Górny wrote: > > Then, they may decide to start mass poisoning other keys just to > > prove this is not the right solution. > > If what I propose is workable, attackers can poison as many keys as they > like. Until SKS keyservers go down, anyway. Until then, if the system > catches them quickly enough, they won't do widespread damage. They'll > inconvenience some people, of course, but that seems unavoidable. And as > an extra benefit, this would nuke file systems that store data in > signatures. >
I'm afraid you are underestimating those people. The way I see it, the number of poisoned OpenPGP keys will grow quick enough to remove all valid keys from SKS keyservers, and render them practically useless. -- Best regards, Michał Górny
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
