Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Creating the perfect GPG keypair

alexcabal.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Creating the perfect GPG keypair

#21

Post by morgante »

konstruktors wrote: post #12
tokenizerrr wrote: post #9

Earlier quoted context omitted.

And then you drop your key and lose it. Or it gets ran over by a car or something. Now what? I love my Yubikey, but I generated the keys on it on an air-gapped machine and wrote them to two DVDs and the Yubikey. Unless you can get everyone to send you messages to encrypt them to both your main key and your secondary backup key you will regret not having backed up your primary key.

> And then you drop your key and lose it. Or it gets ran over by a car or something. Now what? You can't have both, I think. With a physical key your only concern is the physical security of the key. One should print out the revocation certificate, though. I don't think many people lose their home keys or get them run over by a car. It's just a matter of making that a priority.

People lose their home keys all the time. Certainly more often than they lose their computers.

Re: Creating the perfect GPG keypair

#22

Post by Tepix »

I can't believe they use an existing domain, shire.org for their example.

I'm one of the owners of a domain name that's people use as dummy address when they sign up for stuff. I can't stand getting mail like that.

There is a reserved name for examples, it's EXAMPLE.COM.

Re: Creating the perfect GPG keypair

#23

Post by pmoriarty »

tptacek wrote: post #16
beefhash wrote: post #3

And the length of this is exactly the reason why Johnny still can't encrypt and doesn't want to know how. Getting things right, including disaster recovery, should be done correctly and silently by default.

I agree. Almost nobody who uses GPG does any of this. I think people should use GPG without any of the extra options, bells, and whistles. If they really need advanced usage stuff, they should use something better than PGP.

This makes me wonder why GPG isn't more secure by default. If these are the "perfect" settings, why aren't they the defaults?

What happened to making the right thing to do the easiest thing to do?

Re: Creating the perfect GPG keypair

#24

Post by justifier »

venomsnake wrote: post #5

I can see a subtle problem with that scheme - the attacker will be able to read also all of your future communication.

so you cron the process over periods of time and update all files' encryption?

at some point you need to acknowledge that there is one ultimate limitation to encryption: if you want to ever see the contents of an encrypted file then someone else will also be able to

the only way to completely 'secure' information is to destroy it, and even then you have to do so meticulously

Re: Creating the perfect GPG keypair

#25

Post by grhmc »

pmoriarty wrote: post #20

You may want to reconsider sending email that's merely encrypted as it will single you out as an encryption user and perhaps increase your likelihood of being found interesting (should you care about such things). In addition to encryption you may want to use steganography[1] and do so in a way that will hopefully withstand traffic analysis.[2] Some other things to consider: A - Remember that no matter what faith in…

> kept in jail until you cough them up

My understanding is this is contempt of court in the US, which comes with 6 months in jail at a time, at which point the prosecutors have to proactively request the renewal of your imprisonment, and usually don't.

Re: Creating the perfect GPG keypair

#26

Post by eliteraspberrie »

beefhash wrote: post #3

And the length of this is exactly the reason why Johnny still can't encrypt and doesn't want to know how. Getting things right, including disaster recovery, should be done correctly and silently by default.

Not just Johnny, I've been using GPG for a decade and I have to rummage through the 2000 line manual page almost every time.

Re: Creating the perfect GPG keypair

#27

Post by wdewind »

tptacek wrote: post #16
beefhash wrote: post #3

And the length of this is exactly the reason why Johnny still can't encrypt and doesn't want to know how. Getting things right, including disaster recovery, should be done correctly and silently by default.

I agree. Almost nobody who uses GPG does any of this. I think people should use GPG without any of the extra options, bells, and whistles. If they really need advanced usage stuff, they should use something better than PGP.

> something better than PGP

Correct me if I'm wrong, but it seems like a lot of the issues are in implementing PGP in email, not in the cryptography itself. If you made a messaging app that automatically used best practices PGP without any of the email holes/workflow issues, would there still be something significantly better for data at rest?

Re: Creating the perfect GPG keypair

#28

Post by mschuster91 »

konstruktors wrote: post #12
tokenizerrr wrote: post #9

Earlier quoted context omitted.

And then you drop your key and lose it. Or it gets ran over by a car or something. Now what? I love my Yubikey, but I generated the keys on it on an air-gapped machine and wrote them to two DVDs and the Yubikey. Unless you can get everyone to send you messages to encrypt them to both your main key and your secondary backup key you will regret not having backed up your primary key.

> And then you drop your key and lose it. Or it gets ran over by a car or something. Now what? You can't have both, I think. With a physical key your only concern is the physical security of the key. One should print out the revocation certificate, though. I don't think many people lose their home keys or get them run over by a car. It's just a matter of making that a priority.

> I don't think many people lose their home keys or get them run over by a car.

All it needs is some idiot emptying his drink over your pants to fry an USB device. Or a drunk driver crashing into your bike and breaking the device.

Print out your passphrase-protected keyset, put it together with an encrypted copy of your most common passwords (I know no one uses a dedicated password for every site!) and your KeePass/Keychain/... database in a bank safe and one in your home's safe.

Put the password to said DBs in your will (or deposit it at a notary's office), so that in case you die your relatives will be able to shut down your online presence, but not if either the bank, your safe or the notary get busted.

Re: Creating the perfect GPG keypair

#29

Post by StavrosK »

Tepix wrote: post #22

I can't believe they use an existing domain, shire.org for their example. I'm one of the owners of a domain name that's people use as dummy address when they sign up for stuff. I can't stand getting mail like that. There is a reserved name for examples, it's EXAMPLE.COM.

Every domain except for example.com is an existing domain.

Re: Creating the perfect GPG keypair

#30

Post by everfree »

ytjohn wrote: post #17
beefhash wrote: post #3

And the length of this is exactly the reason why Johnny still can't encrypt and doesn't want to know how. Getting things right, including disaster recovery, should be done correctly and silently by default.

I think for gpg and encrypted communications to take off, it has to come in the form of an easy to use app combined with a service offering, similar to how TextSecure/Signal works. Though it should use GPG and have a variant for Android, iOS, and native desktop clients. The cloud service offering should be email and instant messaging, email, and some levels of sync (but not the private key). It should be/do: - Open s…

   - Open source
   - Generate a private key as part of the setup
   - Upload your public key to the public key servers
   - Access camera to read a key (qr code) from another device
   - Display QR code of your private key (so you can sync it
    to another device)
   - Display a QR code of your public key (so someone you meet in
    public can copy it and you can then trust that key)
^ Keybase [1] has a mobile app in the works that will theoretically be able to do all of this. I'll be curious to see how it comes along.

- [1] https://keybase.io/

Post reply on HN