Isn't this article just a reformulation of the Debian Wiki?
Creating the perfect GPG keypair
31–40 of 40 posts
Re: Creating the perfect GPG keypair
#32And the length of this is exactly the reason why Johnny still can't encrypt and doesn't want to know how. Getting things right, including disaster recovery, should be done correctly and silently by default.
I think for gpg and encrypted communications to take off, it has to come in the form of an easy to use app combined with a service offering, similar to how TextSecure/Signal works. Though it should use GPG and have a variant for Android, iOS, and native desktop clients. The cloud service offering should be email and instant messaging, email, and some levels of sync (but not the private key). It should be/do: - Open s…
I am merely a user, not a contributor yet. But I would say a solid base, and not a full implementation of your wanted features list, is in OpenKeychain.
Projects like this are why I continue to use Fdroid, Cyanogen AOSP, and believe the open source movement on mobile is worth the hassle. Oh yea, that and Password Store.
Re: Creating the perfect GPG keypair
#33Earlier quoted context omitted.
> And then you drop your key and lose it. Or it gets ran over by a car or something. Now what? You can't have both, I think. With a physical key your only concern is the physical security of the key. One should print out the revocation certificate, though. I don't think many people lose their home keys or get them run over by a car. It's just a matter of making that a priority.
> I don't think many people lose their home keys or get them run over by a car. All it needs is some idiot emptying his drink over your pants to fry an USB device. Or a drunk driver crashing into your bike and breaking the device. Print out your passphrase-protected keyset, put it together with an encrypted copy of your most common passwords (I know no one uses a dedicated password for every site!) and your KeePass/K…
Yes, people do use different passwords for each site, and you should, too. :)
Re: Creating the perfect GPG keypair
#34Earlier quoted context omitted.
> I don't think many people lose their home keys or get them run over by a car. All it needs is some idiot emptying his drink over your pants to fry an USB device. Or a drunk driver crashing into your bike and breaking the device. Print out your passphrase-protected keyset, put it together with an encrypted copy of your most common passwords (I know no one uses a dedicated password for every site!) and your KeePass/K…
Yes, people do use different passwords for each site, and you should, too. :)
We all have those legacy accounts flying around somewhere ;)
Re: Creating the perfect GPG keypair
#35My GPG keys are protected by a passphrase and that has, so far, deemed enough subjective security in order to allow me to rather liberally store copies of the keys as backups on computers and servers I use. It may depend on your personal security requirements whether that is not enough.
Re: Creating the perfect GPG keypair
#36Some time ago I too resolved to do this properly and with my limited bash-fu wrote a script to automate the process of installing GPG to a master USB key you can physically secure which can be used to drop a subkey on a PC. Most of the stuff you see in GPG tutorials can be done with a short gpg --batch.
Here's the (67 Lines of Code) script: http://pastie.org/10631164 It's not really prepared for public release so forgive some ungainly code.
Re: Creating the perfect GPG keypair
#37I wonder how much of the commands do this, do that, can be put in a batch file? Seems much easier to comment and distribute that than to follow a blog post over once every few months to rotate your key.
Would anyone know if and how much can be done in such a way? Is the bath-mode only capable of instructing the generation of a single key? Must we resort to other programmatic invocations of gpg?
Re: Creating the perfect GPG keypair
#38Why is the author so concerned about the laptop getting stolen? Even if you know nothing about GPG, your laptop should be encrypted. Even if you somehow can't use full-disk encryption, your private key should be protected with an equally strong passphrase. The thief gets nothing but a useless chunk of base64-encoded blob.
Now of course this doesn't mean that subkeys are unnecessary, but the author should probably find a more realistic threat model that readers who are already privacy-conscious can more easily sympathize with.
Re: Creating the perfect GPG keypair
#39Earlier quoted context omitted.
I think for gpg and encrypted communications to take off, it has to come in the form of an easy to use app combined with a service offering, similar to how TextSecure/Signal works. Though it should use GPG and have a variant for Android, iOS, and native desktop clients. The cloud service offering should be email and instant messaging, email, and some levels of sync (but not the private key). It should be/do: - Open s…
I am merely a user, not a contributor yet. But I would say a solid base, and not a full implementation of your wanted features list, is in OpenKeychain. http://www.openkeychain.org/ Projects like this are why I continue to use Fdroid, Cyanogen AOSP, and believe the open source movement on mobile is worth the hassle. Oh yea, that and Password Store. https://github.com/zeapo/Android-Password-Store/
Yup, we are working on the remaining points, see https://www.openkeychain.org/k-9/
- Dominik
Re: Creating the perfect GPG keypair
#40I can't believe they use an existing domain, shire.org for their example. I'm one of the owners of a domain name that's people use as dummy address when they sign up for stuff. I can't stand getting mail like that. There is a reserved name for examples, it's EXAMPLE.COM.
Every domain except for example.com is an existing domain.
RFC 6761 has the details:
example.com, example.net and example.org for second level domains and the top level domain "invalid."