verify fingerprint after recv-key about riseup_help

[micah]

Elijah Sparrow [email protected] writes:

Currently, the openpgp best practices state:

Do not blindly trust keys from keyservers.

Anyone can upload keys to keyservers and there is no reason that you should trust that any key you download actually belongs to the individual listed in the key. You should therefore verify with the individual owner the full key fingerprint of their key. You should do this verification in real life or over the phone. Once you have verified the key fingerprint that you need, you may download the key from the keyserver pool:

gpg --recv-key 'fingerprint'

I thought that --recv-key is never enough, because the keyserver is not bound to return, necessarily, a key that matches the fingerprint and gpg does not actually confirm the fingerprint before importing.

Shouldn't this be like so?

gpg --recv-key '<fingerprint>'
gpg --fingerprint '<fingerprint>'

Yes... the key retrieval could be hijacked in transfer, the keyserver
may give you a key you don't want in response to your query, and then
gnupg will happily not check that (unless they've fixed that in the new
version).

After receiving the key, you must carefully check the fingerprints
manually, sadly. This is why projects like monkeysign will retrieve the
key and then explicitly call --sign-key with the full fingerprint,
which will fail if the wrong key was returned by the keyserver.

ps - I am not sure if this reply will go to github, it added this
"noreply' address to the To line, so I've cc'd elijah directly.

[elijh]

please review #146