Re: [gentoo-nfp] Re: PGP fingerprints of Foundation members (item for Trustees meeting)

[Matthew Thode]

On 17-08-04 05:51:38, Andreas K. Huettel wrote:
> > > >Apparently, the Foundation only has a list of PGP key IDs in
> > > >https://wiki.gentoo.org/wiki/Foundation:Member_List. Even worse, most
> > > >IDs listed there are only 32 bit IDs, providing no security at all.
> > > >
> > > >I would like to ask the Foundation to keep a list with the (160 bit)
> > > >PGP fingerprints of its members. (For developers, this information
> > > >should be readily available in LDAP.)
> > > >
> > > >Ulrich
> >
> > What do we need to prove?
> >
> > That the the key belongs to a given individual or just that the key on the
> > vote is the same as the key used for the membership application.?
> >
>
> That the key on the vote is the same as the key used for the membership
> application.
>
> This is impossible without the full fingerprint.
> And with only the short keyid it's trivial to hack.
>
> --
> Andreas K. Hüttel
> dilfridge@g.o
> Gentoo Linux developer (council, perl, libreoffice)
>

I think we should just record the full key id, would we still need to
also have the fingerprint in that case?

-- 
Matthew Thode (prometheanfire)