Earlier quoted context omitted.
To send messages, use a secure messenger, like Signal or Wire. Don't use PGP.
Okay, and to sign commits or emails? To encrypt files?
Don't encrypt and sign emails.
SKS Keyserver Network Under Attack
111–120 of 197 posts
Re: SKS Keyserver Network Under Attack
#112I believe this is a project trying to replace the old school key servers. https://github.com/google/keytransparency/
Is there any piece of distributed internet infrastructure that Google is not trying to replace?
Probably not, it does make sense for Google though that they do not want to be stuck with mission critical stuff they don't have the final authority on and which is ... obscure in both code and people.
Re: SKS Keyserver Network Under Attack
#113Earlier quoted context omitted.
Okay, and to sign commits or emails? To encrypt files?
Don't encrypt and sign emails.
This is not a realistic solution.
SMS-sized messages are the least hard part of this for me. What I want is to be able to point at a file or folder on my computer and say, "sign that with a public key so I can prove I wrote it" or "encrypt that with someone else's public key so only they can read it". At that point, I don't necessary care all that much about how the file gets sent over the network.
It doesn't need to be integrated into email, but it does need to be a low-level enough operation that I can use it on an arbitrary block of text, file, or folder of any size. Is there a replacement that does that?
I use Signal, and it's great. But Signal is not a replacement for PGP, it's a replacement for one, very specific use-case for PGP.
Re: SKS Keyserver Network Under Attack
#114> unusual programming language called OCaml
> obscure programming languages
Huh, I knew OCaml was less popular; I did not know it was "obscue". Doesn't Facebook use OCaml?
Re: SKS Keyserver Network Under Attack
#115Can somebody explain to me a legitimate use for a single key cross signed by e.g. 100,000 other keys? Is the goal group communications?
I get that arbitrary limits are bad. And that an attack on a system can be converted to an attack on a key, I'm not seeking mitigation in this question.
I just want to understand in some six degrees of Kevin bacon manner, if there is a real use for a single large sign set rather than eg a merkle tree of decomposed subsign sets?
Re: SKS Keyserver Network Under Attack
#116Earlier quoted context omitted.
Don't encrypt and sign emails.
This is not a realistic solution. SMS-sized messages are the least hard part of this for me. What I want is to be able to point at a file or folder on my computer and say, "sign that with a public key so I can prove I wrote it" or "encrypt that with someone else's public key so only they can read it". At that point, I don't necessary care all that much about how the file gets sent over the network. It doesn't need to…
I haven't used it for this, but I think Keybase might be a good system for filling the role of keyservers. If you just want encrypted messaging, it has it. But you can also store your PGP key in there and people can trust it if they trust Keybase's other proofs (which are not necessarily a leap of faith, you can go to the source and verify them).
Re: SKS Keyserver Network Under Attack
#117Earlier quoted context omitted.
Don't encrypt and sign emails.
This is not a realistic solution. SMS-sized messages are the least hard part of this for me. What I want is to be able to point at a file or folder on my computer and say, "sign that with a public key so I can prove I wrote it" or "encrypt that with someone else's public key so only they can read it". At that point, I don't necessary care all that much about how the file gets sent over the network. It doesn't need to…
You asked (among other things) how to send messages securely without PGP. Don't use PGP to send secure messages; use a secure messenger, like Signal or Wire.
Someone else asked how to email securely without PGP. Email isn't secure with PGP. Don't use PGP to send encrypt emails, and don't use email to send secure messages; use a secure messenger, like Signal or Wire.
I acknowledge there are use cases not well covered by secure messengers. The current state of file encryption, which is practically the "hello world" of encryption problems, is a travesty. If you're simply looking to sign something, and later verify that it was you who signed it, use minisign. But that's a very narrow use case.
Re: SKS Keyserver Network Under Attack
#118A bit more[1] on consequences of this attack, gist from the same author. [1] https://gist.github.com/rjhansen/f716c3ff4a7068b50f2d8896e54...
This seems a bit "shoot the messenger" to me. If anything I think those efforts should be applauded as the signal flares they are: "this is broken and it's only a matter of time until it has real world consequences".
Seriously. The original post states at least three times they knew about the issue for over a decade. At what point does "full disclosure" become valid if not after over a decade of warning?
Re: SKS Keyserver Network Under Attack
#119Earlier quoted context omitted.
To send messages, use a secure messenger, like Signal or Wire. Don't use PGP.
Okay, and to sign commits or emails? To encrypt files?
To sign or encrypt emails you could use S/MIME. It is much more widely supported than PGP for signing and encrypting emails as well.
Re: SKS Keyserver Network Under Attack
#120I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…
indeed: https://gist.github.com/rjhansen/f716c3ff4a7068b50f2d8896e54...
A vulnerability in mission-critical software has been known for years, and they're mad that finally someone got fed up enough to publicly draw attention to it in a way that couldn't be ignored or dismissed by the maintainers?
I don't think it's the EFF putting activists at risk here.