Monero: Improving pgp security

[mendisobal]

I suggest adding the fluffypony.asc signature key and SHA256 sums on Monero binaries to txt domain record getmonero.org
The substitution can be recognized by the changed serial number of the zone.

[fluffypony]

My full GPG key is in the Monero source tree, which already provides an out-of-band record. I don’t think GPG-over-DNS is a standard, otherwise that certainly be novel, but largely pointless as we already use DNSSEC-signed TXT records of the file hashes for the auto-updater, no GPG needed.

[wartjugger]

My full GPG key is in the Monero source tree, which already provides an out-of-band record. I don’t think GPG-over-DNS is a standard, otherwise that certainly be novel, but largely pointless as we already use DNSSEC-signed TXT records of the file hashes for the auto-updater, no GPG needed.

I've imported your key from https://github.com/monero-project/monero/blob/master/utils/gpg_keys/fluffypony.asc
When I try to verify the signed message in https://web.getmonero.org/downloads/hashes.txt I get "Key NOT valid" as the status.

[dEBRUYNE-1]

@wartjugger - Are you following these guides?

https://src.getmonero.org/resources/user-guides/verification-windows-beginner.html (Windows)

https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html (Linux & Mac OS)

[wartjugger]

@wartjugger - Are you following these guides?

https://src.getmonero.org/resources/user-guides/verification-windows-beginner.html (Windows)

https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html (Linux & Mac OS)

Ok, it's working with the Linux guide. I was using GNU Privacy Assistant without setting a trust level.

[moneromooo-monero]

No bug here.