The GNU Privacy Handbook (1999) • Hacker News Board

Re: The GNU Privacy Handbook (1999)

#11

Post by Karunamon » Sun, Sep 11, 2016, 6:06 PM UTC

robryk wrote: post #10

piplgobde wrote: post #9

Earlier quoted context omitted.

There is NitroKey[0], which seemed to me like a good alternative to Yubikey, but I haven't ordered either yet so I can't say I have first-hand experience. But much luck if you decide to go with it, something I'm looking more and more into, especially since I too use password-store and it would be good having an easier to use setup that is still secure. [0] https://www.nitrokey.com/

Nitrokey claims on their homepage that the firmware of the Storage version of NitroKey can be updated by software. This seems to mean that there's someone out there with a key that can sign arbitrary code that can be loaded as an update and gains access to the crypto material on the device.

I had a look through their instructions and I'm not sure if there is a signing process that happens. You have to enable firmware access from the app, and then it's a bog standard DFU flash to load the new firmware.

Re: The GNU Privacy Handbook (1999)

#12

Post by hkjgkjy » Sun, Sep 11, 2016, 7:05 PM UTC

carlesfe wrote: post #5

Wow, this is so old (1999) it's terrible. It recommends generating DSA keys. Interesting as a historic artefact, but please don't follow this guide, search for something more recent.

I'd be curious to read what article is better, so you who search, please share your findings

Re: The GNU Privacy Handbook (1999)

#13

Post by tombrossman » Sun, Sep 11, 2016, 7:33 PM UTC

hkjgkjy wrote: post #12

carlesfe wrote: post #5

Wow, this is so old (1999) it's terrible. It recommends generating DSA keys. Interesting as a historic artefact, but please don't follow this guide, search for something more recent.

I'd be curious to read what article is better, so you who search, please share your findings

For always up to date guides try the CryptoParty Handbook: https://www.cryptoparty.in/learn/handbook

Re: The GNU Privacy Handbook (1999)

#14

Post by Esau » Sun, Sep 11, 2016, 7:37 PM UTC

lucastx wrote: post #6

For a much more gentle (and illustrated) introduction do public-key encryption, GnuPG and how to use it with email (Thunderbird + Enigmail), see FSF's Email Self-Defense: https://emailselfdefense.fsf.org/ Tactical Tech's Security in-a-Box has more detailed, step-by-step, multiple platform guides for the same tools: https://securityinabox.org/en/guide/thunderbird/windows https://securityinabox.org/en/guide/thunderbird…

Thank you.

Re: The GNU Privacy Handbook (1999)

#15

Post by hkjgkjy » Sun, Sep 11, 2016, 7:45 PM UTC

baby wrote: post #4

first page: "You must also choose a key size. The size of a DSA key must be between 512 and 1024 bits". Definitely do not follow this guide nowadays :D

Good ol' times. Wonder if one can make a Google query to get old keys, ripe for cracking

Re: The GNU Privacy Handbook (1999)

#16

Post by RoxetteGirl » Sun, Sep 11, 2016, 9:59 PM UTC

thks interesting

Re: The GNU Privacy Handbook (1999)

#17

Post by robryk » Mon, Sep 12, 2016, 8:38 PM UTC

Karunamon wrote: post #11

robryk wrote: post #10

Earlier quoted context omitted.

Nitrokey claims on their homepage that the firmware of the Storage version of NitroKey can be updated by software. This seems to mean that there's someone out there with a key that can sign arbitrary code that can be loaded as an update and gains access to the crypto material on the device.

I had a look through their instructions and I'm not sure if there is a signing process that happens. You have to enable firmware access from the app, and then it's a bog standard DFU flash to load the new firmware.

Does it require you to perform any physical actions on the dongle? If not, why can't I straightforwardly extract keys if I own the machine the dongle is attached to?