Re: [Sks-devel] [Autocrypt] [openpgp-email] Keyservers and GDPR

[holger krekel]

On Tue, Nov 06, 2018 at 18:57 +0100, holger krekel wrote:
> On Tue, Nov 06, 2018 at 17:57 +0100, Volker Birk wrote:
> > On Tue, Nov 06, 2018 at 05:27:14PM +0100, Andy Mueller-Maguhn wrote:
> > > I do roughly recal that such a verification process has been discussed for
> > > the SKS keyservers at one of the pgp-summit before, but i wonder what
> > > happened to the idea. However, if it that is “good enough” to be compliant
> > > with the GDPR i can´t say, but this sounds like a good idea in any case.
> > 
> > I'm not of the opinion that key servers are a good idea at all. It's
> > a pity that people still follow this wrong idea.
> 
> I happen to be similarly skeptical of key servers and don't want
> to spend much effort with helping to evolve the concept. 
> I might be wrong, though, and there are good uses that solve real
> security issues for people.  When i say "real security issues"
> i mean those who otherwise are oppressed and imprisoned for real,
> not in some potentiality.  It's about real outcomes for people
> and not some security ideal. 
> 
> Some folks certainly think key servers are useful and i respect them.
> And also, who knows, i might be missing something.  I admit that
> so far the arguments pro key servers (eg revocation) have
> not made me lean more towards going for it. 

Just to be clear, i am refering to key server usage for e2e email.

For supporting Debian and similar other ecosystems key servers 
have served quite well as far as i understand.  And then, reconciling
key servers with the GDPR for public signing and verification
infrastructure seems like a good idea (including revocation i guess).

holger

signature.asc
Description: PGP signature