Four-word check

Confirm a new key with four words

The first time a contact’s signed email arrives, Fromensics shows four words that name their key. Call them on a number you already have and ask them to read you their four words. If they match, their signed emails show as verified from then on.

What you’ll see

New key

Confirm it’s Northstar Supply.

Northstar Supply signed this email with a key you haven’t confirmed yet. Call them and ask them to read you their four words.

bold
cove
dawn
fern

The words matchNot nowThey don’t match

Use a number you already have for Northstar Supply, not one from this email.

When you see it: the first signed email from a key you haven’t confirmed arrives.

After The words match

Northstar Supply is now trusted.

Their signed emails will show as verified. If their key ever changes, we’ll ask you again.

Phone: Number you calledOptional

Save

We’ll show this number if an email from Northstar Supply ever looks wrong.

When you see it: you choose The words match. The report stays open, so you can go back to the email.

If the words don’t match, choose They don’t match. Then it isn’t their key, and their emails signed with it won’t show as verified. Not now leaves the key unconfirmed, so you can call them later.

Your own four words

Find them in Settings → Signing → Your four words. “When a contact calls to check it’s you, read them these. They name the key on this computer.”

Keys from a verification link

A key added from someone’s verification link goes to Pending until you confirm its fingerprint: “Read the fingerprint to them on a call or in person. Nothing is trusted until you confirm.” Choose Confirmed by phone or Ignore.

If you ever rotate your own key, your contacts must confirm the new words, unless you share your new card.

Questions

Why a phone call?

Anyone can make a key that claims an address. A call you start, on a number you already have, is the part a scammer can’t fake from inside an email.

What happens if their key changes later?

Fromensics shows Don’t pay. This email was changed. and asks you to call. See changed after signing.

Verified sendersKnow an email is really from them, not a hijacked mailbox.Sign your emailsA quiet line that proves an email came from you.Check a signatureCheck a “Signed with Fromensics” email, no install needed.