This does not go into the Web of Trust and having your key signed, maybe the most complicated part of PGP, and perhaps also its most important feature.
Web of Trust isn't too useful if you don't know how to sign a message or check a signature.
Encryption with Gnu Privacy Guard (GPG)
11–20 of 31 posts
Re: Encryption with Gnu Privacy Guard (GPG)
#12This does not go into the Web of Trust and having your key signed, maybe the most complicated part of PGP, and perhaps also its most important feature.
Web of Trust isn't too useful if you don't know how to sign a message or check a signature.
Specifically "check a signature". Even everyone that knows how to sign fail to really check anything. Honestly, if it aint boiled down to a green or red icon then people are going to misuse, assume security when its not, or just click "yes".
If you get a new public key for someone, and it's signed by someone else you don't know (most of the time this is the case) are you going to bother to utilise that signature to increase the trust? No. Are you going to assume increased trust somehow regardless? Yes. FAIL.
Modify it further, if it is signed by someone you do know what are the chances your UI is going to give you any sort of indication that this is more trusted that other message workflows? And if it doesn't give you any indication (most leave it up to you to check) who's gonna bother to look just passed "your friend " ASCII and actually check the key? no one. FAIL.
PGP WoT fails miserably.
Re: Encryption with Gnu Privacy Guard (GPG)
#13Best blog on using GPG that I have seen. Thanks!
Re: Encryption with Gnu Privacy Guard (GPG)
#14This does not go into the Web of Trust and having your key signed, maybe the most complicated part of PGP, and perhaps also its most important feature.
Web of Trust isn't too useful if you don't know how to sign a message or check a signature.
I don't know if it's very useful even if you do know how to sign keys and verify signatures.
Re: Encryption with Gnu Privacy Guard (GPG)
#15Earlier quoted context omitted.
Web of Trust isn't too useful if you don't know how to sign a message or check a signature.
Specifically "check a signature". Even everyone that knows how to sign fail to really check anything. Honestly, if it aint boiled down to a green or red icon then people are going to misuse, assume security when its not, or just click "yes". If you get a new public key for someone, and it's signed by someone else you don't know (most of the time this is the case) are you going to bother to utilise that signature to i…
I use PGP extensively. However, I haven't bothered with the web of trust, for the same reason I don't publish my address book for everyone to read, privacy.
Re: Encryption with Gnu Privacy Guard (GPG)
#16Earlier quoted context omitted.
Web of Trust isn't too useful if you don't know how to sign a message or check a signature.
Specifically "check a signature". Even everyone that knows how to sign fail to really check anything. Honestly, if it aint boiled down to a green or red icon then people are going to misuse, assume security when its not, or just click "yes". If you get a new public key for someone, and it's signed by someone else you don't know (most of the time this is the case) are you going to bother to utilise that signature to i…
btw, how is a person signing a key in the usual WoT model supposed to know whether or not the email address specified in the key uid is actually controlled by the person standing in front of them at the key signing party with passport and key fingerprint in hand? Even if you carefully follow the recommended key signing procedure the binding which actually matters for exchanging encrypted email has very poor validation (or none at all).
Re: Encryption with Gnu Privacy Guard (GPG)
#17On all the encryption tutorials I found they always assume 2 and only 2 people trying to talk privately.
I wonder how would one encrypt a conversation between say 15 people.
Re: Encryption with Gnu Privacy Guard (GPG)
#18On all the encryption tutorials I found they always assume 2 and only 2 people trying to talk privately. I wonder how would one encrypt a conversation between say 15 people.
Multiple -r's:
gpg -e -r recipient1@example.com -r recipient2@example.com
That products some ciphertext which can be decrypted by either recipient.
Re: Encryption with Gnu Privacy Guard (GPG)
#19On all the encryption tutorials I found they always assume 2 and only 2 people trying to talk privately. I wonder how would one encrypt a conversation between say 15 people.
Multiple -r's: gpg -e -r recipient1@example.com -r recipient2@example.com That products some ciphertext which can be decrypted by either recipient.
Thank you. Does it weaken the encryption strength ?
Re: Encryption with Gnu Privacy Guard (GPG)
#20Earlier quoted context omitted.
Specifically "check a signature". Even everyone that knows how to sign fail to really check anything. Honestly, if it aint boiled down to a green or red icon then people are going to misuse, assume security when its not, or just click "yes". If you get a new public key for someone, and it's signed by someone else you don't know (most of the time this is the case) are you going to bother to utilise that signature to i…
btw, how is a person signing a key in the usual WoT model supposed to know whether or not the email address specified in the key uid is actually controlled by the person standing in front of them at the key signing party with passport and key fingerprint in hand? Even if you carefully follow the recommended key signing procedure the binding which actually matters for exchanging encrypted email has very poor validatio…
Best practice is to send an encrypted message to that address in order to confirm the owner controls it.