Author: Mike Hearn 2013-04-10 10:02:09
Published on: 2013-04-10T10:02:09+00:00
In a discussion thread, Mike Hearn explains that all mails he sends are signed automatically by Gmail using either the gmail.com consumer key or the google.com corporate key. Although it is not signing in the GPG web of trust sense, realistically the Gmail DKIM keys are much safer than any key he could create/maintain. Additionally, his ability to sign mail as hearn at google.com is controlled by hardware second factors and various other rather intense security systems which he cannot discuss. He has considered just not having the additional Bitcoin-key based signatures at all, but it would help keep continuity in the case that he leaves Google or if there's a DKIM key rotation. In response to this message, Andy Parkins points out that Hearn didn't sign his email and suggests that it is not yet secure.
Updated on: 2023-06-06T14:49:31.164594+00:00