HOWTO: Keysigning parties

The further mainstreaming of geekdom: who needs Tupperware parties when you can have a keysigning party? This HOWTO has the compleat formula for throwing an event that's both educational and privacy-enhancing!

3.3 What Participants Should Not Bring to the Party

1. A Computer

3.4 Why you should not bring a computer to the party

You should not bring a computer to the party because binary replacement or system modifications are very easy ways to compromise PGP systems.

If someone where to bring a portable computer and everyone used that computer to sign the other keys at the party, no one would know if the machine had been running a key stroke logging utility, a modified version of GPG,a modified version of the Linux kernel, or a specially modified keyboard, any of which could be used to capture the secret keys of those who used the computer.

The use of a computer at the party would also leave you open to more simple attacks like shoulder-surfing, or more complex attacks like weak secret key generation, secret key modification, or even infection with virii that modify your GPG binaries to leak future secret keys discretely.

Link

Discuss

(Thanks, John!)