Hacker News Reader

Comment by Boulth | Hacker News Reader

It's nice to see their own keyserver.

I wonder though if it wouldn't be more practical to support the Web Key Directory protocol [0]. WKD is both more secure than HKP (as it's always over HTTPS and authenticates user's domain), it's enabled by default in a growing number of email clients (Enigmail, GPG for Outlook, KMail) and providers (kernel.org [1], posteo.de), it's used by GPG when locating a key and the setup is incredibly easy (just put binary key in one location).

(to check it out try `gpg --locate-key torvalds@kernel.org` in modern GnuPG)

From my perspective it looks like a perfect match for ProtonMail for both use cases: exposing @protonmail.ch users' keys and fetching keys of contacts on other servers.

[0]: https://wiki.gnupg.org/WKD

[1]: https://www.kernel.org/category/signatures.html

View on HN

We'll probably do this soon, HKP is older and more broadly supported at the moment so it got built first.

Got it, thanks for the reply and for considering modern features!

That makes sense, thanks. I'd love to see support for RFC-7929 at some point too.

https://tools.ietf.org/html/rfc7929

It has the advantage of not relying on the Certificate Authority system, and not requiring a full web stack (which some email clients and servers wouldn't want to open themselves up to). DNSSEC also allows Authenticated Denial of Existence, so that unavailability of a server isn't treated as meaning the user doesn't have a key in the directory.

For reference, this technology is also already supported by GnuPG and Posteo.de:

https://posteo.de/en/blog/new-posteo-public-key-directory

> It has the advantage of not relying on the Certificate Authority system

I wouldn't say it's an advantage, while CA system has many flaws at least it's monitored somehow (for example via Certificate Transparency) while putting keys in DNS would require the app to validate records (does GnuPG do that?), not to mention the queries are not encrypted (so are visible to any hop) and could be transparently replaced by your government or TLD operator. Many DNS providers do not allow adding "exotic" records.

For further info see e.g.: https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...

> and not requiring a full web stack (which some email clients and servers wouldn't want to open themselves up to).

Email clients and servers that do PGP usually have "full web stack" already to connect to keyservers.

Additionally while DANE or PKA lookups can be enabled in GnuPG only WKD is enabled by default ("auto-key-locate" is "local,wkd").

Nice nick by the way :)

Reply on news.ycombinator.com