[tor-talk] Another fake key for my email address
guido at witmond.nl
Mon Mar 10 12:11:13 UTC 2014
On 03/09/14 20:25, Erinn Clark wrote:
> Hi everyone,
> In September last year I discovered a fake key for my torproject.org email
> address. Today I discovered another one:
> pub 2048R/C458C590 2014-02-13 [expires: 2018-02-13]
> Key fingerprint = 106D 9243 7726 CD80 6A14 0F37 B00C 48E2 C458 C590
> uid Erinn Clark <erinn at torproject.org>
> sub 2048R/D16B3DB6 2014-02-13 [expires: 2018-02-13]
> To reiterate what I said last time this happened:
> 1. That is NOT MY KEY. Do not under any circumstances trust anything that may
> have ever been signed or encrypted with this key. I looked around and was
> unable to find anything, but nonetheless, it is out there and that is creepy.
The problem you mention here is that there is no way to verify who a
certain public key belongs to.
I could not even verify yours. I've downloaded both keys above from the
keyservers into gpg. One key has no signatures at all, the other key has
more than 30 signatures, none of those signers are known in my (small)
keyring. I'm none the wiser. And my mail reader doesn't even try to
match email-address to public key fingerprint. It won't raise an alarm
when there is a mismatch. Thunderbird/Icedove lets me do the hard work.
To play Devils' Advocate: It could be that I'm replying to an impostor
claiming to be Erinn Clark. I have no way to check. Only by
investigating the use of both keys throughout the history at the
internet archive, I might be able to discern which key belongs to Erinn
and which is the impostor.
Heck, I had an email conversation with some people of the CCC where they
used one of my gpg-keys to encrypt their message and I used a different
key to sign my reply. Their mail program didn't alert, neither did they
I don't blame them. The PGP/GPG web of trust is not designed to
introduce strangers to each other. It's designed to let people who've
met in person to encrypt their email communication. And extend that to
their circle. And when the web of trust would succeed in spanning the
globe, it would form a social graph that makes Faceboogle look like
The cause of this dual-key problem is that that an email-address is seen
as the identity, while in fact, the public key is the identity, as there
is only one private key that fits the public key.
Humans can't deal with key fingerprints. They use the email address as
What's needed is a way to let computers verify that the human readable
label (email address) is unique and maps to the same public key. This
makes the human readable name a true substitute identifier for the
I've come up with a scheme that does that. I call it
Eccentric-Authentication. It could solve the MitM problem for web-sites,
it could solve the spoiled onion exit nodes problem. And it offers
people to create new encrypted communication channels where none existed
And best, a user agent takes all the hard crypto-problems out of the
hands of the end user.
Check out: http://eccentric-authentication.org/
With regards, Guido Witmond.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 897 bytes
Desc: OpenPGP digital signature
More information about the tor-talk