jbash: Identity and authentication

Greetings. I am jbash, aka John Robert Bashinski, aka "jxbashx@jxbasxhx.com". Everybody calls me just "jbash" (one word, pronounced "jaybash").

The page you're reading is http://jbash.com/. It's meant to identify me to you, and to help you to be sure you're really dealing with me.

Others among the 8 billion people on this planet use the name "jbash" or very similar names. They are not me and I don't know them.

This page used to live at http://jbash.velvet.com. I no longer own, operate, or otherwise control the velvet.com domain, and none of the Web-based services there are "mine".

Email and PGP

Be suspicious of any unusual or sensitive mail from me that isn't PGP-signed. I do occasionally send unsigned messages from my phone. I also sometimes leave messages unsigned if I think some broken filter may drop them because of the signatures.

Chat ("Instant Messaging")

Be suspicious of any unusual or sensitive IM that claims to come from me and doesn't use cryptographic authentication.

Domain names

No-longer-used domain names

Social networks, etc

I don't use these accounts much and rarely check most of them. I prefer to be contacted through my own jbash.com services

Old and possibly dead


Wallets previously listed on this page may have been retired. If you want to send me cryptocurrency, contact me for a current address.


As of 2021-07-10, I have no affiliations. When I do have affiliations, nothing I say or do should be treated as being in my official capacity at any of my affiliated organizations, unless either it's sent from that organization's domain, or it explicitly states that I'm acting in my official capacity. I won't do the latter without doing the former unless I have an obvious good reason.

If you want to communicate with me in my official capacity at an affiliated organization, please use the contact information associated with that organization.

Former Affiliations

Cryptographic data

This file

The directory at https://jbash.com/indexsigs contains detached OpenPGP signatures for the file containing the HTML text of this Web page. There are signatures made with several of my past and present keys.

This file itself is at https://jbash.com/ . The server should sign its traffic, including this file, with a key certified by a Let's Encrypt certificate, and cross-verified with a TLSA record.


I use or have used the following PGP keys:

Type Fingerprint Comment
RSA/4096 07D7 44A7 EFA8 F420 3405 17BE 8F93 F169 37EA 58BD Used for personal business after 2013-01-06 (with velvet.com and jbash.com email addresses). Use this key.
RSA/4096 D274 B620 D920 CCE6 E99C FAAA B6A8 618F C360 E351 Used for Cisco business after 2013-01-06 (with cisco.com email address). This key signs the personal one, and itself has more signatures than the personal one. I am no longer affiliated with Cisco.
DSA/1024 EDEB 56E6 2B18 AE11 177F FE92 76AF B635 BD26 37C5 Used for Canadian Polyamory Advocacy Association business after 2010-04-17. I am no longer affiliated with the CPAA.
DSA/1024 1111 70DF 6D0C 6A44 70D8 646A F8AE 45B4 A753 D462 Personal business 2003-11-01 through 2013-01-06.
DSA/1024 527C 07F7 CE44 C04A 7160 487B 4176 2225 F77F 25B6 Cisco business 2003-11-01 through 2013-01-06.
DSA/1024 44A5 3DA9 07D3 2DFF 4FF7 778E 6158 16C5 3ACE 55FE Used 1997-08-11 through 2003-11-01 together with 270076FD.
RSA/1024 D8 24 C9 85 77 31 31 C4 1F A8 03 DE 93 15 69 F0 Generated 1994. Many old signatures.

All of my PGP keys are on the public keyservers.


All of my personal domains are signed with DNSSEC, and most of the domains I host for other people are also signed.

X.509 CA

I now use Let's Encrypt certificates for most services visible to the public, backing them up with DNSSEC-signed TLSA records. Some certificates internal to the "kdjf.net" domain are signed with a private CA, but you probably will not encounter such certificates.