pull down to refresh
473 sats \ 38 replies \ @Natalia 24 Feb 2024 \ parent \ on: The Curious Case of Digital Signatures crypto
deleted by author
Yes. The "asc" is the (detached) signature.
The hardest part is verifying the public key but most people just skip that lol
reply
now I finally understand what you mean here, why not just put each dev's key in GitHub 😨
reply
Best way is to spread your key fingerprint around imo.
If you only use one site as the source of trust, it's a single point of failure. Even if it's Github.
I have to do that myself, still figuring things out around PGP keys
deleted by author
reply
To be fair, I think if the instructions mention to import the key from a site like Keybase like Sparrow does, I think it's fine. Most important thing is to not import the public key from the same site you received everything else and I think if people just follow instructions, they automatically do that.
It just makes me feel uneasy if people are not aware that this is important. The why's and so on.
reply
deleted by author
reply
Haha yes. Like a secret key hidden in plain sight.
reply
deleted by author
reply
Wait, no. The dev signs the software (or whatever). The signature IS the hash "encrypted" with the private key.
reply
deleted by author