Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They uploaded PGP key to open directory and then verified email, what is this as not an active decision?


Uploading a key does not imply any decision regarding email. I may need it to sign tarballs or commits for example, and the key could very well have been lost to time.

The presence of a key on a key server is in no way or form an explicit opt-in to encrypted email. That's what the CNAME is for.


Except you explicitly uploaded an encryption key, not a signing key! This action broadcasts to the world the message "you can encrypt communications to this identifier using this key"!

This is seriously like telling somebody that you can be contacted on a particular phone number and then getting upset that you're getting phone calls. "Who uses the phone these days," you complain, despite having set into motion the sequence of events that led to you getting a phone call! Worse, in this analogy, it's not like you even said "only text this number"; you explicitly applied metadata saying that you would be open to a phone call.


In your analogy, the keyserver is a phone book. You can find keys there, and yes you can try to use them, but it's not like telling someone you can be contacted on a particular phone number, but rather like them digging through a phone book and finding your name in there, possibly for an unused landline that you technically own but isn't wired up - who knows.

Telling you to use a particular phone number - say through a business card, a contact page or a profile - is the analogy matching configuration of your domain to publish your intent, similar to how your domain also specify where you mail server is.


Exactly. The only way this makes sense is if Google provided a way to import your PGP key into Gmail, which it doesn’t.


It's an active decision to make their key available to people who wish to send them encrypted email. It's not a decision to receive all email in encrypted form.


> It's not a decision to receive all email in encrypted form.

Except, it is. You can’t control of everyone out only some will send you encrypted email.


I mean, sure, if somebody wants to take a guess on whether I have my private key with me (or even still have access to it at all), that's on them.

But if an email provider purportedly bringing email encryption to the non-GPG-trained masses does, it's a different story.


Using Proton for email means it is. Why use Proton otherwise?


Im not sure that I see logic here..




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: