hashed user IDs [was: Re: Security of the gpg private keyring?]

[Hauke Laging]

Am Freitag 11 März 2011 14:54:57 schrieb Robert J. Hansen:
> On 3/10/2011 3:09 PM, Hauke Laging wrote:
> > That's the technical situation today. But it is no use to announce
> > that to the whole world.
> 
> (Did you mean "not necessary" instead of "no use"?)

I meant "not useful".


> It is useful to quite a lot of people.  Look at how many people map out
> webs of trust for entirely innocent purposes.

As MFPA mentioned: This would not prevent mapping. It would (if noone fails) 
help limiting the access to the identities in the map to those who are 
supposed to be able to do that by the decision of the respective identity 
owner.


> How do you propose determining who really needs those signatures for
> validation purposes and who doesn't?  And once you've made that
> determination, how do you enforce it?

The access to signatures is not limited. Everyone decides himself which ones 
he needs. But the owner of the identity decides whom it is revealed to.


> "I'll make the certification, but I get to
> control who gets to learn about the certification."

No. You just control who can make the next step: Mapping keys to UIDs.


Hauke
-- 
PGP: D44C 6A5B 71B0 427C CED3 025C BD7D 6D27 ECCB 5814
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 555 bytes
Desc: This is a digitally signed message part.
URL: </pipermail/attachments/20110313/6579c13c/attachment.pgp>