[FOSDEM] Using biglumber services for the gpg Key signing party ?

[Wouter Verhelst]

On Mon, Aug 24, 2009 at 09:09:39AM +0200, Ludovic Hirlimann wrote:
> With this most of the technical parts for the organization is solved.
> 
> In order to add your key to the key ring users need to register on
> biglumber which some of the attendees might object. But the good news
> about having to register is that people then can use the biglumber
> escrow service - meaning that their signature will only be released and
> updated - only when both person that have signed have uploaded. This
> part of the process make the aftermath a bit longer but insures that key
> signing will be symetric.

Just one question: why?

Sure, it's a pity if some keys are not cross-signed. But it's not fatal
either, is it?

There are a few problems with your proposal:
- One of the things you're supposed to do when signing someone's key is
  checking that the email addresses on the key actually belong to the
  person owning the key. I usually do this by way of the 'caff' script,
  which signs the key, then encrypts it to the owner's mail address, and
  sends the encrypted signature off. Using such an escrow service would
  probably make this quite a bit harder, if not impossible.
- It requires people to jump through hoops in order to sign keys. That's
  never a good thing, because signing keys is boring, and you want
  people to be able to do things the way they usually do, rather than
  the particular way this particular key signing party requires you to.
  Otherwise they're likely to postpone it until they forget.
- On the subject of forgetting: receiving key signatures is an excellent
  way to remember that you have to sign them. Having an escrow service
  takes that away.

Of course, I stopped doing key signing parties (my key is well-connected
now anyway), so feel free to disregard anything I said.

-- 
The biometric identification system at the gates of the CIA headquarters
works because there's a guard with a large gun making sure no one is
trying to fool the system.
  http://www.schneier.com/blog/archives/2009/01/biometrics.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
URL: <http://lists.fosdem.org/pipermail/fosdem/attachments/20090824/d9b24cda/attachment.pgp>