Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You shouldn't trust pgp.mit.edu, key servers are only there for easy distribution of keys (because that's easier than typing in multiple pages of base64), not for providing trust, trust is provided by the web of trust, that is to say, by the signatures of other people who have verified your identity (who in turn have signatures on their keys from yet other people who have verified their identity, and so on). Those signatures are part of the keys that get distributed through key servers, but it doesn't matter whether the key server is hostile, as the key server can not forge other people's signatures.

Also, as an aside: What went wrong there that people have a problem with "too many email addresses to check"? The great thing about email is that it is an interoperable system and you can do forwarding and stuff, so that you can easily have all your emails delivered to one common user interface, no matter how many addresses you have!? I also have quite a few addresses - but I don't "check" addresses, all my email automatically shows up in my one mutt inbox, which is the only thing I have to "check". That's very much in contrast to all those new, proprietary platforms that actively try to lock you in, among other things by forcing you to "check" every one of the platforms independently.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: