Re:SKS Keyserver Network Under Attack
by lifeisstillgood on Sunday June 30, 2019 @05:28AM
(#20317259)
Agreed - It would be nice to understand the dependency chain for SKS servers
And Inwoukd also like to understand what people mean by "get rid of GPG/PGP?" - it cannot mean get rid of keypairs, so it is just replace with some "nicer" code? what is the problem?
- Many security researchers disagree with the core idea of SKS servers in general (they're essentially just undeletable online storage that anyone can write to). The distributed "Web of Trust" model itself is considered untrustworthy.
- The vulnerability is triggered by the usage of the SKS servers. This is very bad for any piece of infrastructure that relies on them, but if you're only using local keys that you imported and verified yourself, this particular attack doesn't effect you.
- The PGP format itself is cumbersome and has problems (people want shorter keys, and they want a simpler format with less variability). So while this particular vulnerability only effects SKS servers, there's still a strong movement to get rid of PGP in its entirety.
- The fact that the people behind the SKS servers are reacting negatively and angrily may be reason to be worried about GPG in general, since we don't know if the maintainers would respond the same way to other vulnerabilities that aren't restricted to SKS servers.
Similarly, thoughts or corrections welcome.