Online Identity Verification

How to reliably set up verification for your online identity (Email and Socials).

Terminology:

1. Creating a private OpenPGP key

Make sure gnupg is installed (additionally install gpg-tui):

    bash
  
1

sudo pacman -S gnupg gpg-tui

We will add your official Emails and Socials to this key later

Generate a private key:

    bash
  
1

gpg --full-generate-key

I recommend a full generation and going with the defaults.

Deleting a key: gpg --delete-secret-key [FPR or Email])

Listing all secret keys:

    bash
  
1

gpg --list-secret-keys

Listing all public keys:

    bash
  
1

gpg --list-public-keys

This way you can check out all your keys and their fingerprint (FPR)

    bash
  
1

gpg --edit-key [FPR]

or interactively:

    bash
  
1

gpg-tui

Selecting an uid:

    gpg
  
1

uid [number]

Deleting an uid:

    gpg
  
1

deluid

Add secondary Emails to your encryption key:

    gpg
  
1

adduid

Set primary Email!

    gpg
  
1
2
3

uid [number]
primary
save

Add identity claim to your private key:

    gpg
  
1

notation

At this point I recommend to create an Keyoxide Profile for online identity verification and easier claim of multiple accounts.

Get your key fingerprint and add this into the notation: proof@ariadne.id=https://keyoxide.org/aspe:keyoxide.org:FPR.

This will link your Keyoxide Profile to your OpenPGP Key (both ways). Remember to add the PGP Key to Keyoxide as well.

Add some services and complete your Keyoxide Profile afterwards.

You are totally free to add your accounts to your PGP Key instead but Keyoxide is easier to maintain in my opinion.

Quick upload:

    bash
  
1
2

gpg --send-keys [FPR]
gpg --keyserver hkps://keys.openpgp.org --send-keys [FPR]

For example:

    bash
  
1

gpg --send-keys LD2C49IENMLNS287A12AC5D8CB1846291B4819D

Be careful where you export the keys into!

Export secret key into file:

    bash
  
1

gpg --armor --export-secret-keys --output private.asc [Email-address or KEYID]

Export public key to upload later:

    bash
  
1

gpg --armor --export --output public.asc [Email-address or KEYID]

Upload your public key public.asc to OpenPGP

Go to https://keyoxide.org/FPR and check your profile.

Change FPR to your key fingerprint or paste your fingerprint directly here Keyoxide .

Then add your Keyoxide link to your socials to proof your identity. (e.g. Mastodon)

Last step: Check if Keyoxide realises the linked PGP Key and Socials: https://keyoxide.org/aspe:keyoxide.org:FPR

Congratulations, you are now verified on Mastodon, have an encrypted Mail and you claimed the accounts you use online.

Also look into Keybase !

References: