3

Public OpenPGP key servers synchronize their public keys with each other and as far as I know anyone could set up their own keyserver and synchronize it with other keyservers.

This made me wonder if that results in spammers potentially doing just that to gain valid email addresses to send spam mail to.

Is this a valid concern or would the effort to set this up be a reason why spammers wouldn't do it?

1 Answer 1

4

Yes, the key server records are public and spammers do scan those. You will have to expect spam sent to mail addresses on public key servers.

You do not even have to set up a key servers, the dumps are available for download. By setting up a key server, you can not only look through the user IDs stored in keys, but also can collect additional mail addresses from search queries you receive (some mail clients automatically look up keys for all recipients).

At the same time, usual counter measures like rewriting several parts of the address to prevent automatic scanning also prevents searching for the address, so it also prevents look ups based on the mail address. Spam is a lost war, filter incoming mail instead.

1
  • Thanks for your reply, I really like the last sentence. I guess these days, it's just a matter of time till you get spam email.
    – comfreak
    Apr 11, 2016 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .