Phuctor is an online app with a simple enough concept – gather as many PGP keys as possible and check to see if there are different users using the same RSA modulo. Given the probabilities of such a collision (especially with keys greater than 1024 bit) are remote such a collision could indicate that a flawed implementation of PGP was used to generate your key or the matching keys were generated on hardware with a broken CS-PRNG.
Phuctor is a combined project of Stanislav Datskovskiy and Mircea Popescu (the latter guy is uh, infamous in the bitcoin world).
If you’re curious then head on down to the Phuctor website. Obviously this tool will only be useful if a large number of users submit samples. For this reason I wonder whether one of the team should contact one of the keyservers and request a dump of their database. They are generally happy enough to do this for research purposes
UPDATE: I made a 4+ GB keydump from the Internet SKS keyservers available to Stanislav a few days ago. Hopefully this significantly increases their sample size.
Mike the Crypto Goat 
The later guy is quite famous in the Bitcoin world, for a long list of reasons such as for instance being the Central Bank governor of Bitcoin.
Ahh, you took the bait! 🙂 Good to see you here Mircea. I dropped a few links to keydumps I found useful when doing a previous project on key metadata duplication in the wild (ie multiple keys for a single user) on Stanislav’s page, no doubt he will pass them on if they are of any value.
Hello!
Well, he’s the tech brains of the thing so yeah. I’ve also asked a number of the more widely used key websites for dumps, I expect to get something from that eventually (however if you can nudge Mr. Fiskerstrand that can’t hurt anything).
In my experience in dealing with MIT in the past your best bet is to simply lie and state you wish to make a key server in (insert foreign country here) as a mirror for local users and as a political statement. They don’t seem to like giving out keydumps for some reason – the only thing I can come up with is harvesting the metadata to add to a spam database (which no doubt already happens from bots crawling the web frontend – it is not like they honor robots.txt, or anything for that matter). 4+ GB of material should at least give you a decent amount of material to begin with. I may be able to better that – I shall ask around. I will add a link to your blog under your name on this article.
Eh too late to start lying now. But anyway, thanks for the help and I’m curious if this ever actually finds anything. Those “4 in 1000 keys are weak” reports seemed really scary at the time.
Well, those 3.42 million keys will give you a pretty comprehensive data set anyway. I imagine the results will be surprising!
It occurs to me it’d probably serve your readers better to link to the relevant article (http://trilema.com/2013/snsa-rsa-public-key-factorisation-webservice/) than to the blog generally.
Done.