Post #2336639

2026-05-06 18:53 UTC

@grawity@social.treehouse.systems I've opened a ticket for this to be discussed after the WG adopts the draft. I have in the meantime thought of one concrete downside, which is that AI scrapers might try to enumerate the prefix space. The near-certainty of obtaining multiple GB of useless garbage has not stopped them doing equally stupid things elsewhere, which is why I think it is a reasonable concern. But not necessarily a fatal one. Thanks for the suggestion! ❤️ https://gitlab.com/andrewgdotcom/draft-gallagher-openpgp-hkp/-/work_items/51

Replies (1)

@grawity@social.treehouse.systems 2026-05-06 19:55

@andrewg@mastodon.ie well, if they request e.g. a 16-bit prefix, they can't realistically bruteforce the remaining 144 bits (for every single of the retrieved keys) to determine valid fingerprints... they can hold on to the data, but it is useless until the fingerprint is published elsewhere (at which point it's just as easy to fetch the individual certificate by fingerprint) (I'd expect the server to refuse prefixes past some maximum length, like 20 or 32 bits, where it would stop being "privacy preserving" due to matching too few keys... but imo even with long prefixes of e.g. (x-64) bits it would be cheaper to find some other way of enumerating fingerprints (or really, scraping emails))

Open ##2336640