[ale] PGP / GPG Keysigning party... Upload your key now!

Michael H. Warfield mhw at WittsEnd.com
Sat Nov 19 10:15:00 EST 2011


On Fri, 2011-11-18 at 15:38 -0500, David Tomaschik wrote: 
> On Fri, Nov 18, 2011 at 12:41 PM, JD <jdp at algoloma.com> wrote:
> >> What are the general guidelines for proof of identification?  I know
> >> that a lot of people have passports, though I do not.  Should I bring
> >> extra things over and above my driver's license, such as bank account
> >> records or something, or would my state-issued license be good enough
> >> for this type of thing?
> >
> > ID requirements are a personal thing. Whatever you decide is "good enough."
> >
> > Some people will sign a key after seeing 1 form of ID plus a credit card with
> > the same name on it. Is that sufficient proof?
> >
> > Don't feel pressured to sign anyone's keys.  Whatever you decide is "sufficient
> > proof of identity" is good enough.
> >
> > If you don't feel comfortable signing my key for any reason, I won't be hurt. It
> > is all good.  Similarly, don't be hurt if I elect to not sign your key.
> >
> > I will bring 2 forms of government photo ID.

> The only thing I'd like to add to this is -- be reasonable in your
> expectations.  I once had someone at a keysigning demand notarized
> birth certificate PLUS 2 forms of current government issued-id.  I'm
> not bringing all that.

> I like to see 1 Government ID + 1 anything else (school ID,
> credit/debit card, etc.).  I will most likely bring 2 government IDs,
> which I hope will suffice for most people.

Even that's not necessary.  PGP keysignings have generally only require
1 piece of government photo identification (drivers license or
passport).  That's all we've done at the IETF, that's all we've done at
FIRST, it's all we've done at USENIX and it's all we've done at past ALE
keysignings.  That's what was specified in the earliest instructions for
putting on keysigning events.  You can ask for more if you like, but
that's all that's ever been specified for PGP keysignings.

That being said...  If we were holding this in conjunction with one of
the SSL WoT events like StartSSL / CAcert, those types of things do
require two pieces of identification, at least one of which is a
government issued photo id.  I participated in one of those at USENIX
LISA a few years back where it was a combined CAcert verification and
PGP keysigning.  It's tempting to do something like that but we would
need at least 3 more "assurers" in addition to me to do the CAcert
verifications and submit them.  I think some of us talked about that the
last time we had a PGP keysigning.  That's not the same process though
they can be done together and it is more hassle getting the necessary
people and forms together to do it.  I don't believe we have the time to
make the arrangements at this point.

http://www.cacert.org/

> -- 
> David Tomaschik, RHCE, LPIC-1
> System Administrator/Open Source Advocate
> OpenPGP: 0x5DEA789B
> http://systemoverlord.com
> david at systemoverlord.com

Regards,
Mike
-- 
Michael H. Warfield (AI4NB) | (770) 985-6132 |  mhw at WittsEnd.com
   /\/\|=mhw=|\/\/          | (678) 463-0932 |  http://www.wittsend.com/mhw/
   NIC whois: MHW9          | An optimist believes we live in the best of all
 PGP Key: 0x674627FF        | possible worlds.  A pessimist is sure of it!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 482 bytes
Desc: This is a digitally signed message part
Url : http://mail.ale.org/pipermail/ale/attachments/20111119/76510c5c/attachment.bin 


More information about the Ale mailing list