Import keypair issue

[whiteout-io]

Import keypair issue

[tanx]

Hi @shytikov,

thanks for your feedback. When installing whiteout mail your public key is authenticated and uploaded to the whiteout key server in the background.

If you send an email from the email account you're using to [email protected] we can authenticate you and reset your account by deleting the public key from the server. After that just reinstall the app and you can generate or import a new keypair.

[tanx]

Have you uploaded the public key only? Why to you need this information on your server? It was completely implicit for me.

One big UX problem with PGP ist that users are exposed to the
complexity of exchanging their public key. With whiteout we want to
make this as simple as possible. That's why we exchange keys
automatically between whiteout users.

How can I be sure extension haven't uploaded my private key as well? :)

Our client is completely open source. Apps form the chrome app store
are signed executables which can be validated against our releases on
GitHub: https://github.com/whiteout-io/mail-html5/releases

If you need set of public keys for search purposes, why don't you use public keyring servers for that?

We have our own key server that allows for authenticated uploads of
keys. Wikipedia has a great explanation of why public PGP keyservers
are problematic:
http://en.wikipedia.org/wiki/Key_server_(cryptographic)#Problems_with_keyservers

For me it looks like you might become man-in-the-middle one day...

Users can verify that they have the correct PGP key by comparing
fingerprints. Also here is some more technical info if you're
interested: https://github.com/whiteout-io/mail-html5#privacy-and-security

Kind regards,
Tankred

[shytikov]

Thank you for your reply, sorry I've deleted my own message before — since I have found answers on my questions by myself. Except keyservers :)

Thank you for the link about them — I have never faced with such issues, but you're right it all makes sense.