Several questions as feedback on gnupg

[JanuszA.Urbanowicz]

Johan Andersson wrote/napisa=B3[a]/schrieb:
-- Start of PGP signed section.
> On Wed, 23 Jan 2002, Loic Bernable <leto@vilya.org> wrote:
> > - A friend of mine pointed out the problem that may occur with persons
> >   who have a common name and surname. Let's suppose your name is "John =
Doe
> >   jd@yahoo.com". Now, imagine there is another John Doe, that generates
> >   a GnuPG key with *your* email address. If someone meets the latest,
> >   they could check his ID or driving license or whatsoever, but finally
> >   there would be no way for him to know it is *not* the John Doe related
> >   to the "jd@yahoo.com" address, and worse, John "Charlie" Doe's key
> >   would be legitimately signed by the third person, not yours. Is that
> >   clear enough ? :o) This can still be a problem ... Maybe one day we
> >   will have a thumbprint analysis tool that would complete our public
> >   key recording ?
>=20
> I think I see what your concern is, and I've thought about it a bit
> myself.  My name is probably one of the most common names in Sweden.
> There's probably several dozens of people named Johan Andersson in the
> small city I live.
>=20
> No documents I've read on signing keys and the web of trust have
> mentioned this.  It's been on my find-out-more-list for some time.

Use PhotoIDs. A PhotoID is a extension of OpenPGP key for,mat that uses JPG
images as a key IDs. You add a PhotoID to your key and the signer should
compare the photo with your face and sign the key if they match.

But this does not eliminate namespace clash at all. Mallory (an attacker)
could create a fake key with your photo as well as with your name and email
and do a classical MITM.

Alex
--=20
C _-=3D-_ H| Janusz A. Urbanowicz | ALEX3-RIPE | SF-F Framling |         | =
  *  =09
 ; (_O : +-------------------------------------------------------------+ --=
+~|=09
 ! &~) ? | P=B3yn=B1=E6 chc=EA na Wsch=F3d, za Suez, gdzie jest dobrem ka=
=BFde z=B3o | l_|/=09
A ~-=3D-~ O| Gdzie przykaza=F1 brak dziesi=EAciu, a pi=E6 mo=BFna a=BF po d=
no;     |   |  =20