HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
robertdavidgraham
hunter-dkim
Python2020–2025
robertdavidgraham / hunter-dkim

hunter-dkim

Discusses how to verify DKIM signatures in old emails, namely one of the Hunter Biden emails in the news

24Distinct people
29Mentions
0Explicit recommenders
101GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Discusses how to verify DKIM signatures in old emails, namely one of the Hunter Biden emails in the news

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:45:45 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year29 dated mentions

Observed mentions: 2020-10-30 04:59:25 UTC to 2025-10-02 19:14:11 UTC.

0510152020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 17 mentions; 3 submissions, 14 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC17314
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC606
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC303
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC202
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC101

What Hacker News says

17 sources
I believe you are referring to this quote (correct me if not): "In fact, in the early DKIM configurations were kind of a joke: mail providers chose DKIM signing keys that were trivial for motivated attackers to crack. Back in 2012 a security researcher named Zachary Harris pointed out that Google and several other companies were using using 512-bit RSA to sign DKIM. He showed that these keys could be “cracked” in a matter of hours on rented cloud hardware, and then used these keys to forge emails from Larry and Sergey. Providers like Google reacted to the whole “Larry and Sergey” embarassment in the way you’d expect. Without giving the implications any serious thought, they quickly ramped up their keys to 1024-bit or 2048-bit RSA. This stopped the forgeries, but inadvertently turned a harmless anti-spam protocol into a life-long cryptogra
Read the rest
phic authenticity stamp — one that can be used to verify the provenance of any email dump, regardless of how it reaches the verifier." Note that the "few hours" attack here is only relevant if they were using easily crackable 512-bit keys. The author of this article suggests (and I agree) that the 1024 or 2048 bit RSA keys are not easily crackable. (see https://crypto.stackexchange.com/a/42830) Maybe you are suggesting that someone could sign emails using the old crackable 512-bit keys. And they could, although we should disregard this as "not verification" given the weak keys. The article links to https://github.com/robertdavidgraham/hunter-dkim#short-dkim-... - which verifies an email using a since-rotated 2015 key (which was 2048 bits), although that github erroneously states that Google was using 1024 bit before that (they were using 512). I would concede that the notion of "sometimes we should disregard some DKIM verifications based on the key length" is not easy to grasp and that email verification stories in the media could become muddier and harder to present. I would hope that interviewing experts gets you a reasonable estimation of how likely an email is to be legitimate.
In Ok Google: please publish your DKIM secret keys
Okay, sure, Trump misrepresented that maybe -- although his tax returns are typical of someone with lots of depreciable real estate, and don't have much evidence of fraud. But let's talk about other so-called trump 'lies'. What about the continued doubts by the NYT that there would soon be news about a working coronavirus vaccine at the end of October, early November? What about the Steele Dossier that is now known to have been paid for by Russia (which Trump said at the beginning, but was claimed to be a lie)? What about the forced firing via threat of withholding aide of the Ukrainian prosecutor by Joe Biden, who denied being involved with his son's business dealings in the Ukraine? We were told that was lies, but there is indisputable DKIM evidence that an e-mail from Burisima to Hunter Biden thanked him for meeting his father while h
Read the rest
e was in office (https://github.com/robertdavidgraham/hunter-dkim). Are those lies too? Sure Trump lies, like any other politician. But sometimes he tells the truth, and the truth is so ludicrous, that it seems like lies, but when it finally comes out that it was true, we all sit and say to ourselves... maybe we should believe the guy. But I mean... continue on with the denial, you'll just turn more formerly anti-Trump people into pro-Trumpers.
In Times Change: Inside the New York Times’ Heated Reckoning With Itself
They've validated 1. of the emails, not "some": https://github.com/robertdavidgraham/hunter-dkim And frankly, possession of a single legitimate email's source text, for an intermediate-profile individual from a corporate account, doesn't somehow prove anything else (which again: is zilch - nothing else about this story is verifiable - it reeks of an intelligence op, especially since Rudy Giuliani is known by the FBI to be routinely in contact with known Russian intelligence operatives).
In Biden wins White House, vowing new direction for divided U.S.
For context, this idea of publishing the secrets has come up again recently after DKIM was used to prove the authenticity of the “smoking gun” Hunter Biden email. [1] More generally, non-repudiation is a great feature if that’s what you’re going for. Often times it’s not actually what you needed at the time, but gets thrown in anyway because it’s harder to design a signing protocol without that property than with it. So in the sense that non-repudiation isn’t a core requirement of DKIM you’d like to have the crypto algorithm which meets just the DKIM requirement and no more — yes, this email definitely came from an authorized server and hasn’t been tampered with, but without inherently proving that the email is not a forgery years later. On the other hand, DKIM having this property is actually extremely useful and nice to have a lot of th
Read the rest
e time, not the least of which in the Hunter Biden case, or for the purpose of authenticating any particular historical email. [1] - https://github.com/robertdavidgraham/hunter-dkim
In DKIM: Show Your Privates
I am sorry you feel that way. I am struggling to see how I can bridge this gap. This is the link verifying the “opportunities” email. It also explains DKIM issues with other emails. https://github.com/robertdavidgraham/hunter-dkim I am truly having trouble understanding how this is a conspiracy theory. The alternative seems to require a massive conspiracy involving foreign intelligence agencies planting false information with true information - I mean, you don’t doubt the pictures, right? Moreover, the “false” information is not anything groundbreaking, it’s almost all the same information already reported by mainstream outlets with a few new bits added. And they somehow convinced other correspondents on the emails to come forward and speak lies? publicly. How is this not conspiratorial thinking? Do you approach Trump stories with the sam
Read the rest
e level of skepticism? For example, how do we know the tax returns are real? Absolutely nobody has confirmed them except anonymous sources speaking to the NYT.
In My Resignation from the Intercept
> To be clear, giuliani has refused to give the contents to anyone in the press. I can't speak for Giuliani, and I agree that his involvement in this is strange, but NYP, Daily Caller, and National Pulse have all offered to share the contents of the drive with other journalists. I don't know to what extent they have been taken up on it. > The Daily Caller (an extension of the Trump campaign) isn't to be trusted. No rational person would expect this to prove anything. To assume that the news agencies that ran with the Steele dossier or the "Fine People" hoax have some fundamentally higher standard of journalistic standards than smaller right-wing publications is a bit rich. But I fully realize you wouldn't trust them directly. The point is that it's not just the reputation of these outlets now, but people without a partisan axe to grind
Read the rest
like Robert Graham[1] and Tony Bobulinski who are providing evidence for the authenticity of the emails recovered. > Also, Hunter's emails and photos were circulated in Ukraine last year to the highest bidder. Irrelevant. All evidence so far points to the laptop (which is genuinely Hunter Biden's) being the source of these emails. The DOJ has already acknowledged that it received (what I believe is the original) laptop drive, and they have been pursuing an active criminal investigation against Hunter since last year. The DOJ, State Department, and DNI all have said there is no evidence of foreign involvement, and even a Washington Post journalist has acknowledged that this likely isn't the result of foreign interference. > And no one is buying it. Wishful thinking. [1]https://github.com/robertdavidgraham/hunter-dkim
In My Resignation from the Intercept
It would have been much better if they responded to the factual claims Greenwald laid out in the article they refused to publish. I read that article, and his argument for why the Biden emails pass at least the plausibility bar sound reasonable. BTW, the DKIM signature on at least one of the emails has been verified: https://github.com/robertdavidgraham/hunter-dkim EDIT: OK, rather than downvoting, which isn't going to change my mind, why don't you help address his points? If you change my mind, I'll go try to change other people's minds. "The Hunter Biden documents have at least as much verification as those other archives [the Panama Papers, Wikileaks war logs, Podesta / DNC emails from 2016] that were widely reported. There are sources in the email chains who have verified that the published emails are accurate. The archive contains
Read the rest
private photos and videos of Hunter whose authenticity is not in doubt. A former business partner of Hunter has stated, unequivocally and on the record, that not only are the emails authentic but they describe events accurately, including proposed participation by the former Vice President in at least one deal Hunter and Jim Biden were pursuing in China. And, most importantly of all, neither Hunter Biden nor the Biden campaign has even suggested, let alone claimed, that a single email or text is fake." Add to that that at least one email has had its DKIM signature verified (see the link above). I hate Trump and think a second term would be an unmitigated disaster for our democracy. Even if the worst of the allegations or insinuations were true I think Biden would be better for our country than Trump. If I were an editor of a newspaper, I'd certainly think twice before publishing something like this, even if I thought they were accurate. But I would never throw shade on a fellow journalist for writing something like this. And as a voter, if I'm going to choose the lesser of two evils, I want to know just how evil the lesser one is.
In My Resignation from the Intercept

Showing the 15 most recent of 17 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.