Verify the fingerprint first, before importing it.Īlways check a given OpenPGP public key via its fingerprint.Įven 64 bits long OpenPGP Key IDs (for e.g., 0x44434547b7286901 –) probability of collision is potentially a very serious problem.
Check key fingerprints before importing.If this is not possible, then look on places like social media, personal website, blog,… which belong to the individual you want to have a key fingerprint of – as some people simply publish their public key fingerprint. It is recommended that you should do this verification in real life or over the phone. Always verify public keys with your intended recipients.You should therefore verify with the owner the full key fingerprint of their key. Do not blindly trust keys from public serversĪnyone can upload keys to public key servers and there is no reason that you should trust the given relationships (the association between the email ID and the public key).OpenPGP encryption is no exception and you must follow a few good practices to make it more secure. This blogpost will provide you with a concise list of OpenPGP encryption best practices. Strong encryption is no longer a privilege of geeks and paranoids but is becoming mainstream. However, true end-to-end encryption is not out-of-the-box and generally requires you to activate a number of switches as described in this post about Instant Messaging.
0 kommentar(er)
