Chapter 2 of 6 / is this the real one
There is no signed message anywhere
A page telling you which addresses to use, with nothing signed on it, has not made a claim you can test. That is not an accusation against whoever published it. It is a statement about what you are able to establish, which is nothing.
What a signed block looks like
Four lines frame it. One says a signed message begins, one says the signature begins, one says it ends, and between them sits the text plus a block of base64. The text is readable by anyone. Signing is not encryption and does not hide anything.
| What you find | What it means |
|---|---|
| Armour lines present | It is at least the right shape. Now check it |
| No block at all | No claim has been made. Treat the page as unclaimed |
| A screenshot of a block | Worthless. You cannot verify an image |
| A block that fails to verify | Copy it again from the source before concluding anything |
Why a copy fails when nothing is wrong
A signature covers the exact bytes, so a block that went through a forum quote box, a chat client that reflows lines, or a copy that grabbed only the visible part will fail while being perfectly genuine. This is the most common false alarm in the whole subject. Copy it again from the source before you draw any conclusion at all.
Reading the result
| Result | Meaning | What to do |
|---|---|---|
| Bad signature | The text was altered or invented | Leave. This one is unambiguous |
| No public key | Signed by a key you do not hold | Get the right key after checking its fingerprint, never the one offered on the page |
| Good signature, key you do not recognise | The maths works against somebody else key | Leave. The word good appears, which is why this catches people |
| Good signature, old date inside | It verifies and the statement is months old | Treat as unconfirmed. See the next page |
The habit inside the habit
Read which key signed and what date is inside the text before you read the word good. Two seconds, and between them those two questions close both of the ways a verification can succeed while telling you nothing useful.
Getting a fingerprint in the first place
- Collect the value from several places that would have to be attacked separately. Three pages by one operator are one source, and so are three that copied a fourth.
- Compare them in full rather than by the first and last groups.
- Write it down outside the browser, in a file you control or on paper.
- Note the date you pinned it, so a future change is a change rather than a vague impression.
About an hour, once, and every check afterwards costs under a minute. Do it on an ordinary day rather than during an outage, when sources agree less and everybody is in a hurry.