News for hackers. Stuff that matters.

A comment on Show HN: Send encrypted secrets from the command line. Parent comment

Re:Show HN: Send encrypted secrets from the command line by tzs on Thursday January 10, 2019 @12:40PM (#18875958)
They should add support for the OpenPGP Web Key Directory [1] system. Briefly, the idea is that the public key for [email protected] should be available at https://example.com/openpgp/hu/<blah> where <blah> is generated as described in the document.

Gpg supports looking up keys via this since 2.1.12 [2]. An example of how to lookup and get a key this way can be seen here [3].

[1] https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic...

[2] https://wiki.gnupg.org/WKD

[3] https://lists.gnupg.org/pipermail/gnupg-devel/2018-June/0338...

[ Parent | on HN ]
Re:Show HN: Send encrypted secrets from the command line by paulfurley on Thursday January 10, 2019 @12:46PM (#18876024)
Yes! We're working on it, both client side and server side.

We've got WKD working on our own [email protected] email address using a rather cheeky hack[1].

Server side, we're adding this to Fluidkeys Server soon.

That way, teams that use Fluidkeys could redirect `<team-domain>/.well-known/openpgpkey/(.*)$` to our server, and voila, we'll serve their keys via WKD

[1]: https://github.com/fluidkeys/web-key-directory/

[ Parent | on HN ]
Re:Show HN: Send encrypted secrets from the command line by Boulth on Thursday January 10, 2019 @02:20PM (#18877070)
I was just going to ask the same question about WKD support. Having control over key distribution in an organization is a very important factor for me.
[ Parent | on HN ]
Re:Show HN: Send encrypted secrets from the command line by xvector on Thursday January 10, 2019 @12:42PM (#18875974)
This is a clever idea. Unfortunately, it doesn't seem like most mail providers would store something like this.
[ Parent | on HN ]
Re:Show HN: Send encrypted secrets from the command line by paulfurley on Thursday January 10, 2019 @12:47PM (#18876037)
I can't see Gmail doing it :)

But mostly teams control their own mail domain, so they can do what they like (for example, use Fluidkeys, and we'll do WKD for them!)

[ Parent | on HN ]