Comment on Secure website-authentication using GPG keys

rjl@comlab.ox.ac.uk
Sun, 30 Dec 2007 15:30:36 +0000

One of the bigger problem with this I can foresee is userA putting userB's public key in their own account - this would lead to duplicate keys. Although this would effectively lock userA from his own account, allowing userB to possibly log in as him.

You solve that problem by requiring userA to sign userB's public key with userB's private key.