Hacker News Reader

AIUI, this doesn't use key servers; it's a different protocol.

https://wiki.gnupg.org/WKD

Exactly. It uses the same host as uid's email. So if one have key "John Doe <jd@example.com>" it'd query example.com for reference to the key. It's not a security problem unless one considers their own company's servers untrustworthy.

Technical details from the RFC:

> For example the URI to lookup the key for Joe.Doe@Example.ORG is: https://example.org/.well-known/openpgpkey/ hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q

(local part is SHA-1 encoded)

Source: https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic...

It is a security problem for the recipient.

Imagine a dissident / whistle blower / journalistic source using gpg. I could send her a message, signed with a new key, and just wait until her gpg executable contacts my server.

Then I have her IP address, and if I am lucky, I can plant an exploit into the very first request response.

I imagine this kind of people do not run with default configuration just as they use Tails and not your regular Ubuntu install. If not they can be traced with even less obvious means, just like PGP comments: http://www.csoonline.com/article/2904395/microsoft-subnet/mi...

Reply on news.ycombinator.com