<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:arial,helvetica,sans-serif;font-size:10pt">Hey,<br><br>Can someone explain what the purpose of the Key signing party is, or provide a reference to some helpful docs?<br><div> </div><div>Cheers,</div><div>Jeroen De Dauw<br></div><div> <br>Forum: <a rel="nofollow" target="_blank" href="http://code.bn2vs.com"><span style="text-decoration: underline;">code</span></a><a rel="nofollow" target="_blank" href="http://code.bn2vs.com">.bn2vs.com</a><br>Blog: <a rel="nofollow" target="_blank" href="http://blog.bn2vs.com">blog.bn2vs.com</a><br></div><div>Skype: rts.bn.vs <span style="text-decoration: underline;"></span> ; Xfire: bn2vs<span style="text-decoration: underline;"><br><br></span>Don't panic. Don't be evil.<span style="text-decoration: underline;"><br></span><span style="font-style: italic;">70 72 6F 67 72 61 6D 6D 69 6E 67 20 3</span><span
style="font-weight: bold; font-style: italic;">4 2</span><span style="font-style: italic;">0 6C 69 66 65!</span><span style="text-decoration: underline;"><br></span></div><div><br></div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt;"><font face="Tahoma" size="2"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Wouter Verhelst <wouter@debian.org><br><b><span style="font-weight: bold;">To:</span></b> FOSDEM visitors <fosdem@lists.fosdem.org><br><b><span style="font-weight: bold;">Sent:</span></b> Monday, August 24, 2009 10:09:05 AM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: [FOSDEM] Using biglumber services for the gpg Key signing party ?<br></font><br>On Mon, Aug 24, 2009 at 09:09:39AM +0200, Ludovic Hirlimann wrote:<br>> With this most of the technical parts for the organization is solved.<br>> <br>>
In order to add your key to the key ring users need to register on<br>> biglumber which some of the attendees might object. But the good news<br>> about having to register is that people then can use the biglumber<br>> escrow service - meaning that their signature will only be released and<br>> updated - only when both person that have signed have uploaded. This<br>> part of the process make the aftermath a bit longer but insures that key<br>> signing will be symetric.<br><br>Just one question: why?<br><br>Sure, it's a pity if some keys are not cross-signed. But it's not fatal<br>either, is it?<br><br>There are a few problems with your proposal:<br>- One of the things you're supposed to do when signing someone's key is<br> checking that the email addresses on the key actually belong to the<br> person owning the key. I usually do this by way of the 'caff' script,<br> which signs the key, then encrypts it to the owner's
mail address, and<br> sends the encrypted signature off. Using such an escrow service would<br> probably make this quite a bit harder, if not impossible.<br>- It requires people to jump through hoops in order to sign keys. That's<br> never a good thing, because signing keys is boring, and you want<br> people to be able to do things the way they usually do, rather than<br> the particular way this particular key signing party requires you to.<br> Otherwise they're likely to postpone it until they forget.<br>- On the subject of forgetting: receiving key signatures is an excellent<br> way to remember that you have to sign them. Having an escrow service<br> takes that away.<br><br>Of course, I stopped doing key signing parties (my key is well-connected<br>now anyway), so feel free to disregard anything I said.<br><br>-- <br>The biometric identification system at the gates of the CIA headquarters<br>works
because there's a guard with a large gun making sure no one is<br>trying to fool the system.<br> <a href="http://www.schneier.com/blog/archives/2009/01/biometrics.html" target="_blank">http://www.schneier.com/blog/archives/2009/01/biometrics.html</a><br></div></div></div><br>__________________________________________________<br>Do You Yahoo!?<br>Tired of spam? Yahoo! Mail has the best spam protection around <br>http://mail.yahoo.com </body></html>