Take a leaf out of urbit's book, and convert hex strings into readable nonsense syllables that are a lot easier for humans to compare.
UTF-8 v9.0 contains 1085 emoji, that should be even easier to compare than random symbols.
Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
21–30 of 131 posts
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#22Earlier quoted context omitted.
This is just turning one hash into another, so would be just as easy to brute force.
The point is to turn one fairly big hash into a representation where humans can easily spot the differences.
Pretty sure most of the time people only read the first few and last words and e.g. don't concern if the words in the middle are in correct order. Not sure about the size of that dictionary, but it would seem to greatly diminish the entropy.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#23I've attended security conferences in the past two years wherein representatives of companies that claim to see 80+ percent of all Internet traffic in their threat intel offerings who were presenting about Android malware reverse engineering used short IDs in their slide deck and business cards. When I mentioned Evil32 to them, they looked at a loss. https://evil32.com If this is news to you, don't feel bad. Many inf…
[deleted]
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#24Seems some people are playing havoc with key ids.
I got a mail earlier today I couldn't decrypt for unclear reasons. Now I understand why: It seems it was encrypted with a copy of my public key that is on the keyserver colliding with the keyid of my real key.
Right now there is a revoked copy of my key there: https://pgp.mit.edu/pks/lookup?search=hanno%40hboeck&op=inde...
What's exactly going on here? Other commentors indicate that someone uploaded keys from the evil32 page to the keyservers. Have the authors of evil32 now used their private keys to revoke them?
Anyway, the conclusion seems obvious: Keyids are dead, use full fingerprints. Latest gpg 2.1 versions already show full fingerprints by default.
I still had a short keyid on my webpage, will change that now.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#25Earlier quoted context omitted.
The point is to turn one fairly big hash into a representation where humans can easily spot the differences.
Pretty sure most of the time people only read the first few and last words and e.g. don't concern if the words in the middle are in correct order. Not sure about the size of that dictionary, but it would seem to greatly diminish the entropy.
It doesn't. The dictionary is exactly the same size as the input data. It's lossless.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#26Take a leaf out of urbit's book, and convert hex strings into readable nonsense syllables that are a lot easier for humans to compare.
UTF-8 v9.0 contains 1085 emoji, that should be even easier to compare than random symbols.
I'm not sure if you're sincere but I don't think emoji would be easier to compare. +Might be less friendly to screen reader users?
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#27Earlier quoted context omitted.
The point is to turn one fairly big hash into a representation where humans can easily spot the differences.
Pretty sure most of the time people only read the first few and last words and e.g. don't concern if the words in the middle are in correct order. Not sure about the size of that dictionary, but it would seem to greatly diminish the entropy.
It's asking for a solution with more gestalt impact. Turn the key into a painting or some sort of visualization.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#28Linus' fake key [1], as well as all the others from the random sample I took, have been revoked as of today.
[1] http://pgp.mit.edu/pks/lookup?op=vindex&search=0xEA185A5E76E....
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#29Take a leaf out of urbit's book, and convert hex strings into readable nonsense syllables that are a lot easier for humans to compare.
UTF-8 v9.0 contains 1085 emoji, that should be even easier to compare than random symbols.
Other possible alternatives (somewhat more limited in number so longer strings) would be box drawing characters[0] or game blocks (mahjong[1], tiles[2] or cards[3]).
[0] https://en.wikipedia.org/wiki/Box_Drawing
[1] https://en.wikipedia.org/wiki/Mahjong_Tiles_(Unicode_block)
[2] https://en.wikipedia.org/wiki/Domino_Tiles
[3] https://en.wikipedia.org/wiki/Playing_cards_in_Unicode#Playi...
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#30Earlier quoted context omitted.
UTF-8 v9.0 contains 1085 emoji, that should be even easier to compare than random symbols.
I'm not sure if you're sincere but I don't think emoji would be easier to compare. +Might be less friendly to screen reader users?
I hate to say it, but comparing two, long hash values via a screen reader doesn't seem viable for humans, regardless of emoji.
Maybe an auralizer to turn the hash into a short piece of music?