Notices by Micah Lee 🔑 (micahflee@mastodon.social), page 10

Good morning :thinkerguns:

@symroe this looks interesting and totally related to GPG Sync. I'll check it out

Does your cat like to steal your coffee too? 😻☕

@js yup. And if someone revokes their old key and switches to a new one, everyone else doesn't even have to be aware of it, they keep emailing and it just works. Or if someone's key expires and they update the expiration date, everyone else doesn't need to manually refresh that key.

The idea is to remove the complexity and hassle of key management from *everyone* to like one or two PGP nerds who like this stuff.

@js this is recommended as part of the RFC, and also what we do at FLM. It makes it so we can have an internal web of trust that scales linearly as opposed to exponentially (keysigning parties).

However it doesn't make it so everyone has everyone else's correct public key. If there's a new remote employee I haven't talked to you and I need to write them an email, with GPG Sync I can just write them an encrypted email and not think about it. Otherwise I'd have to first go find their key

Forgot about this

Qubes peeps: On September 30, Whonix 13 will no longer be supported, so make sure to upgrade to Whonix 14 soon https://www.qubes-os.org/news/2018/08/24/whonix-13-approaching-eol/

@bob not alone, because keylists are just lists of fingerprints. It still relies on keyservers to fetch the public keys.

But it will be completely compatible with whatever replacement for keyservers gets built in the future.

Here's the text of the draft RFC if you're interested in how it works or want to get involved:
https://tools.ietf.org/html/draft-mccain-keylist-01

Big thanks to @rmrm who actually wrote the RFC and did most of the work as his FLM intern project. Nat Welch and I helped a little too :).

GPG Sync is a program you install on your computer and can subscribe to keylists. It calls out to `gpg` to import all of the keys on your keylists on a regular basis.

I'm excited about keylists being an internet standard so that OpenPGP software that doesn't use GnuPG can support it too, like OpenKeychain on Android, or Mailvelope, or anything built on the new Sequoia-PGP rust library.

Also, it'd be awesome if GPG Tools, Enigmail, etc. allowed you to subscribe to keylists directly.

I sent someone a text and autocorrect changed something to "WikiLeaks" by mistake. I guess I've typed that word into my phone's keyboard a lot...