At 2:25 3/11/96, savron@world-net.sct.fr wrote:
I began testing PGP a few days ago ( I'm a PGP newbie ) and I found that it gives out the key ID of an encrypted message . From this you can get the identification of the recipient of the message , if it's someone who has publicaly distributed his key (keyserver , homepage ...) . So even if you are unable to decode the message you can find who is the recipient of a given message . I think this is a big privacy problem .
There is little that can be done about this. There must be something in the message to identify who it is intended to be read by. As someone else has stated, you can always set up private keys to be used to send to you that are different from your Public KeyID for cases where you want to hide your identity or that of the party you are communicating with.
The problem is carried along when you encrypt a message for multiple recipients , you get the key IDs of all the recipients and same problem as above . I think something like 'blind email copy' should be used , because the recipients don't have to know the identity of each other .
If you want to hide the recipient list, then send separate messages to each recipient - each of which is only encrypted to that one respective recipient.