Re: [LUG] Public Key Servers

[Eion MacDonald <maceion@xxxxxxxxx>]

On 08/08/2020 17:23, comrade meowski wrote:
> On 08/08/2020 17:00, maceion@xxxxxxxxx wrote:
>> To DCGLUG members
>> Public Key Servers.
>> 20200808 Some time ago, when I queried a public key (expired), I was
>> given a site from to download it; with comments about key servers being
>> unreliable.
>>
>> While researching a matter for a PRC friend, I came across the Beijing
>> LUG.
>> Interestingly their warrant canary shows a lot of stuff about obtaining
>> correct key from key servers to check their warrant canary signers.
>>
>> I read and learnt some things. (PS I checked one key,
>> PPS They are very wary about membership and check in person before
>> joining and if members asked to show smartphone Corvid-19 tracer, which
>>   can give location history, they abandon indoor meeting (usually a cafe
>> with WiFi announced on morning of meeting) and meet in open air
>>
>> Any comment from you knowledgeable folk about key servers?
> 
> Yeah, proper security is hard even if you know what you're doing.
> 
> Hardly surprising considering the level of their chief "enemy" is full
> on Nation State but the BLUG are having a pretty good go at it, I'm
> impressed. I'm sure your friend knows this all too well but when the
> adversary is more than capable of disappearing people off the streets
> it's gonna take a lot more than a warrant canary and some PGP keys to
> keep them out of trouble.
> 
> It's not difficult to compromise key signers and warrant holders if
> you're prepared to literally hold a gun to someone's head...
> 


Yes, all understood as cartoon

https://xkcd.com/538/

They assume as basic undertaking all is compromised , but they stick out
as  the do not use WeChat or QQ.


-- 
regards
Eion MacDonald

-- 
The Mailing List for the Devon & Cornwall LUG
https://mailman.dcglug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq