41–50 of 131 posts
Take a leaf out of urbit's book, and convert hex strings into readable nonsense syllables that are a lot easier for humans to compare.
UTF-8 v9.0 contains 1085 emoji, that should be even easier to compare than random symbols.
Do Debian or any of the *BSDs yet default to including a font that supports emoji?
All the fake keys that I've seen mentioned are from the data set at https://evil32.com . It appears a couple of researchers decided, back in 2014, to demonstrate this issue by cloning the entire strong set of the PGP web of trust (not just Linus' key, but basically everyone who uses PGP/GPG for Free Software development - myself included). It would appear that sometime quite recently, someone decided it would be fun…
At this point this is INSANE that GnuPG still defaults to short IDs...
With GnuPG 2.1 listing of keys shows the fingerprint.
All the fake keys that I've seen mentioned are from the data set at https://evil32.com . It appears a couple of researchers decided, back in 2014, to demonstrate this issue by cloning the entire strong set of the PGP web of trust (not just Linus' key, but basically everyone who uses PGP/GPG for Free Software development - myself included). It would appear that sometime quite recently, someone decided it would be fun…
At this point this is INSANE that GnuPG still defaults to short IDs...
Linus' fake key [1], as well as all the others from the random sample I took, have been revoked as of today. [1] http://pgp.mit.edu/pks/lookup?op=vindex&search=0xEA185A5E76E... .
Earlier quoted context omitted.
At this point this is INSANE that GnuPG still defaults to short IDs...
It doesn't anymore. With GnuPG 2.1 listing of keys shows the fingerprint.
For desktop usage many prefer GnuPG 2.0, because they fear compatibility issues that the new 2.1 key storage format could have with 3rd party software, and you can't go back (at least this is the reason why the Homebrew maintainers still default to 2.0, but at least not to version 1 anymore since a few days).
So you have a mess of 3 stable versions, all used by many at the same time.
Take a leaf out of urbit's book, and convert hex strings into readable nonsense syllables that are a lot easier for humans to compare.
Earlier quoted context omitted.
The point is to turn one fairly big hash into a representation where humans can easily spot the differences.
Pretty sure most of the time people only read the first few and last words and e.g. don't concern if the words in the middle are in correct order. Not sure about the size of that dictionary, but it would seem to greatly diminish the entropy.
The upside to showing a larger hash is that humans are very good at roughly comparing two things. The difference in casing is probably enough to trigger a conscious check. A visual hash is still better.
Earlier quoted context omitted.
It doesn't anymore. With GnuPG 2.1 listing of keys shows the fingerprint.
But for server installations (auto-signing, checking, etc.) you are often directed to GnuPG 1 because "less dependencies". Also "apt install gnupg" / "dnf install gnupg" both give you version 1 on the most recent Ubuntu/Fedora. For desktop usage many prefer GnuPG 2.0, because they fear compatibility issues that the new 2.1 key storage format could have with 3rd party software, and you can't go back (at least this is…
Earlier quoted context omitted.
At this point this is INSANE that GnuPG still defaults to short IDs...
I remember reading that they updated it to be full key a few versions ago. I can't seem to find the actual link for that..
Earlier quoted context omitted.
UTF-8 v9.0 contains 1085 emoji, that should be even easier to compare than random symbols.
I think emoji would be hard to compare. A lot of very similar little faces. Is that a wink or a blink or a frown? An example of urbit's rendering of a 128-bit number into textual form is "racmus-mollen-fallyt-linpex--watres-sibbur-modlux-rinmex". While it might be gibberish, it's gibberish that even a screen-reader program could take a swing at, and humans can easily read.
https://www.npmjs.com/package/proquint
Proquint (5 letters per 16 bits) is tighter than Urbit's `@p` (6 letters per 16 bits). The Urbit form was designed for synthetic names and restricts itself to phonemes that sound comfortable and natural to English speakers. (Not to say that English should be the universal language, it's actually a terrible language to make everyone learn, just that it is.)
Word lists work reasonably well, but they're quite bulky and they don't take advantage of the human hardware accelerator for learning new words. When you have a GPU, use it. These kinds of synthetic strings also make great passwords, BTW.
(Disclaimer: Urbit guy here.)