<p>When you sign someone's key, you are publicly saying that you trust that it does belong to them and not an impostor. People who use your public key can see the number of signatures it has. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, into a giant Web. The more signatures a key has, and the more signatures its signers' keys have, the more trustworthy that key is.</p>
-<p>People's public keys are usually identified by their key ID, which is a short string of 8 digits like 92AB3FF7 (for Adele's key). You can see your key ID on the right in OpenPGP → Key Management in your email program's menu.</p>
-<p>It's good practice to share your key ID, so that so that people can double-check that they have the correct public key when they download yours from a keyserver. You may also see public keys referred to by their key fingerprint, which is a longer string of digits, like DD878C06E8C2BEDDD4A440D3E573346992AB3FF7. The key ID is just the last 8 digits of the fingerprint.</p>
+<p>People's public keys are usually identified by their key fingerprint, which is a string of digits lik DD878C06E8C2BEDDD4A440D3E573346992AB3FF7 (for Adele's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to OpenPGP → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint, so that so that people can double-check that they have the correct public key when they download yours from a keyserver.</p>
+
+<p>You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like 92AB3FF7 for Adele. The key ID is visible directly from the Key Management Window. This key ID is like a person's first name (it is a good shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion.</p>
+
</div><!-- End .section-intro -->
<div id="step-sign_real_keys" class="step">
<div class="main">
<h3><em>Important:</em> check people's identification before signing their keys</h3>
- <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
+ <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Ask them to show you their ID (nunless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
</div><!-- End .main -->
</div><!-- End #step-sign_real_keys .step-->
<p>When you sign someone's key, you are publicly saying that you trust that it does belong to them and not an impostor. People who use your public key can see the number of signatures it has. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, into a giant Web. The more signatures a key has, and the more signatures its signers' keys have, the more trustworthy that key is.</p>
-<p>People's public keys are usually identified by their key ID, which is a short string of 8 digits like 92AB3FF7 (for Adele's key). You can see your key ID on the right in OpenPGP → Key Management in your email program's menu.</p>
-<p>It's good practice to share your key ID, so that so that people can double-check that they have the correct public key when they download yours from a keyserver. You may also see public keys referred to by their key fingerprint, which is a longer string of digits, like DD878C06E8C2BEDDD4A440D3E573346992AB3FF7. The key ID is just the last 8 digits of the fingerprint.</p>
+<p>People's public keys are usually identified by their key fingerprint, which is a string of digits lik DD878C06E8C2BEDDD4A440D3E573346992AB3FF7 (for Adele's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to OpenPGP → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint, so that so that people can double-check that they have the correct public key when they download yours from a keyserver.</p>
+
+<p>You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like 92AB3FF7 for Adele. The key ID is visible directly from the Key Management Window. This key ID is like a person's first name (it is a good shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion.</p>
+
</div><!-- End .section-intro -->
<div id="step-sign_real_keys" class="step">
<div class="main">
<h3><em>Important:</em> check people's identification before signing their keys</h3>
- <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
+ <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Ask them to show you their ID (nunless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
</div><!-- End .main -->
</div><!-- End #step-sign_real_keys .step-->
-Subproject commit e69e712d11c753b9bb8a5c383c9f7a8644bde7c1
+Subproject commit bcf35a0d86c7843a58dbeef7cb9e52051891568d
<p>When you sign someone's key, you are publicly saying that you trust that it does belong to them and not an impostor. People who use your public key can see the number of signatures it has. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, into a giant Web. The more signatures a key has, and the more signatures its signers' keys have, the more trustworthy that key is.</p>
-<p>People's public keys are usually identified by their key ID, which is a short string of 8 digits like 92AB3FF7 (for Adele's key). You can see your key ID on the right in OpenPGP → Key Management in your email program's menu.</p>
-<p>It's good practice to share your key ID, so that so that people can double-check that they have the correct public key when they download yours from a keyserver. You may also see public keys referred to by their key fingerprint, which is a longer string of digits, like DD878C06E8C2BEDDD4A440D3E573346992AB3FF7. The key ID is just the last 8 digits of the fingerprint.</p>
+<p>People's public keys are usually identified by their key fingerprint, which is a string of digits lik DD878C06E8C2BEDDD4A440D3E573346992AB3FF7 (for Adele's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to OpenPGP → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint, so that so that people can double-check that they have the correct public key when they download yours from a keyserver.</p>
+
+<p>You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like 92AB3FF7 for Adele. The key ID is visible directly from the Key Management Window. This key ID is like a person's first name (it is a good shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion.</p>
+
</div><!-- End .section-intro -->
<div id="step-sign_real_keys" class="step">
<div class="main">
<h3><em>Important:</em> check people's identification before signing their keys</h3>
- <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
+ <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Ask them to show you their ID (nunless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
</div><!-- End .main -->
</div><!-- End #step-sign_real_keys .step-->
projects / enc.git / commitdiff