Bootstrapping OpenPGP keys from the web (updated wiki chapter)

What in case you want to totally stay anonymous or have no trust path to a OpenPGP key?

Some people just write an unencrypted mail to the recipient and ask them to send their public key. The recipient will most likely either send its public key or at least its fingerprint.

This works against passive attacks. An observer wouldn’t know what they have been talking about in the following encrypted mails. This totally fails against active attacks. A man-in-the-middle could replace the recipient’s key with its own malicious key. The sender would use the wrong key, the man-in-the-middle would decrypt the message, read it, and re-encrypt it with the legit key and forward it to the recipient. Neither sender nor recipient would ever find out that their messages are being read by an adversary. – This is the whole reason, why the trust model path and key signing is recommended in the first place.

Read more:

https://www.whonix.org/wiki/OpenPGP#Bootstrapping_OpenPGP_keys_from_the_web

Patrick Schleizer on sabtwitterPatrick Schleizer on sabgithubPatrick Schleizer on sabfacebookPatrick Schleizer on sabemailPatrick Schleizer on sabblogger
Patrick Schleizer
Developer and maintainer at Whonix
Patrick started developing Whonix, the Anonymous Operating System in 2012, when quickly others joined efforts. He collected experiences working pseudonymous on Whonix for two years, enjoys collaboratively working on privacy preserving software.

Patrick started developing Whonix, the Anonymous Operating System in 2012, when quickly others joined efforts. He collected experiences working pseudonymous on Whonix for two years, enjoys collaboratively working on privacy preserving software.

Posted in Whonix Wiki Updates

Legal

Archives

Contribute

Would you like to contribute to the Whonix project?

Contributing can be as easy as sharing the blog over social media, volunteering, or making a monetary donation.

For more ideas on how to get involved see the "Contribute" and "Testers-Wanted" categories.

Thanks!

- Whonix Staff