[WHIMSY-274] Switch to hkps://keys.openpgp.org for downloading keys

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Component/s: SecMail
• Assignee: Craig L Russell
• Reporter: Matt Sicker
• Created: 30/Jun/19 01:23
• Updated: 08/Jul/19 00:23
• Resolved: 08/Jul/19 00:23

Description

https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

The SKS keyserver pool is now infected with some bad certificates which can cause a denial of service attack to gpg (and likely other similar tools). It sounds like it would be prudent to either disable downloading keys or switch to a safer keyserver for now.

Ideally, users should be able to upload their own GPG keys, and that uploader could automatically filter out these types of malicious keys. This would be a separate feature, though, but now it seems more useful.

Issue Links

• links to: GitHub Pull Request #69