A thorough PGP tutorial
futureboy.us
A thorough PGP tutorial
1–10 of 115 posts
Re: A thorough PGP tutorial
#2I like it, it's quite a bit more then a tutorial.
Re: A thorough PGP tutorial
#3[deleted]
Re: A thorough PGP tutorial
#4Scary bit is it's not server on HTTPS, which is probably a must-have for sites that publish public-key information. Much easier to MITM attack the site and claim to be posting "his" public key and email address while really publishing your own info, etc.
A great tutorial, however. Very accessible in my opinion and considering it's purpose my previous paragraph is more of an aside.
Re: A thorough PGP tutorial
#5Scary bit is it's not server on HTTPS, which is probably a must-have for sites that publish public-key information. Much easier to MITM attack the site and claim to be posting "his" public key and email address while really publishing your own info, etc. A great tutorial, however. Very accessible in my opinion and considering it's purpose my previous paragraph is more of an aside.
That's the purpose of key signing. The author--like almost all PGP users--has gotten his key signed by third parties. This means that its integrity can be verified. E.g., if a man in the middle were to intercept the HTTP response and change the contents of the key, it would lack the signatures.
Still, I suppose it's possible for an adversary to work around this as well. If you can find enough people who are 1) willing to falsely sign a key, and 2) trusted by others, you can have these people sign a spoofed key. But then these people would be putting their reputations on the line, and the probability of being exposed is high. Thus the cost of the attack is high.
The lesson being: If you're emailing info that is valuable enough to warrant such a costly attack, verify the key through some other means. Meet the message recipient in person, for example. And consider a thorough security audit of everything in your digital and physical life. You're obviously operating in a far more dangerous world than I do. There are probably many vulnerabilities available to attackers that have nothing to do with your email.
Re: A thorough PGP tutorial
#6Scary bit is it's not server on HTTPS, which is probably a must-have for sites that publish public-key information. Much easier to MITM attack the site and claim to be posting "his" public key and email address while really publishing your own info, etc. A great tutorial, however. Very accessible in my opinion and considering it's purpose my previous paragraph is more of an aside.
That's the purpose of key signing. The author--like almost all PGP users--has gotten his key signed by third parties. This means that its integrity can be verified. E.g., if a man in the middle were to intercept the HTTP response and change the contents of the key, it would lack the signatures. Still, I suppose it's possible for an adversary to work around this as well. If you can find enough people who are 1) willin…
Of course, you're entirely correct in that :)
My warning was truly an aside, and given the nature of a large group of visitors, of course a handful might not follow best practices and verify the signatures, etc.
Re: A thorough PGP tutorial
#7Earlier quoted context omitted.
That's the purpose of key signing. The author--like almost all PGP users--has gotten his key signed by third parties. This means that its integrity can be verified. E.g., if a man in the middle were to intercept the HTTP response and change the contents of the key, it would lack the signatures. Still, I suppose it's possible for an adversary to work around this as well. If you can find enough people who are 1) willin…
Of course, you're entirely correct in that :) My warning was truly an aside, and given the nature of a large group of visitors, of course a handful might not follow best practices and verify the signatures, etc.
Ah, good point. I see what you mean--if someone is just learning about PGP the first time, they might not know about issues surrounding key integrity, and the need for trusted 3rd-party signatures.
Re: A thorough PGP tutorial
#8It could be my version of GPG, but the following does not work for me:
gpg --armor --export --sign
I changed to
gpg --armor --export
and it works. Just pointing this out as a typo.
Re: A thorough PGP tutorial
#9The barriers to modern cryptography seem to be far more social and psychological than technical.
It seems as though many of the web-of-trust issues that impeded PGP 15+ years ago could be helped by current day social networking practices, if a social network pushed it. PGP/GPG could be used under the hood, as long as the user never has to deal with an actual file anywhere unless they wanted to.
The consequences of evil twin attacks [1] may be worse, but if the 'verify' action was not as casual as mere friending, then perhaps it would be less susceptible.
Are any startups working from this angle?
[1] http://my.safaribooksonline.com/book/-/9781597495455/chapter...
Re: A thorough PGP tutorial
#10This is a very nice tutorial.
A very small (but rather important, depending on occasion/readership) detail:
[...]
gpg --encrypt --sign --armor -r recipient@email -r your@email.com filename
[...]
-r recipient Specifies recipients of the message. You must already have private keys of the people listed. [...]