Just make the keys 256 characters and add an ASCII art penis in the front, just to make it very clear that humans should not be seeing these things.
Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
71–80 of 131 posts
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#72Earlier quoted context omitted.
The point is to turn one fairly big hash into a representation where humans can easily spot the differences.
The correct way to compare hashes is to let the computer do it. i.e. Ctrl + C, Ctrl + F, Ctrl + V "oh look it didn't find it ... they don't match", versus, "yup all 64/128/2048/n digits match, the hashes are the same".
We still need to define a hash format. Typical hex/base64 would work, but imagine someone tries to be smart and invent a dictionary word encoding with Unicode characters, and then someone brute forces another key that's actually different but will match a search with smart Unicode collation algorithms.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#73Earlier quoted context omitted.
At this point this is INSANE that GnuPG still defaults to short IDs...
It doesn't anymore. With GnuPG 2.1 listing of keys shows the fingerprint.
It's insane that it ever defaulted to short IDs, the insecurity of which was not just known, but proven by demonstration, years before GnuPG was released.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#74I don't know why more folks don't display keys and fingerprints as Base64; it seems to me that "q68RxlopcLEwq+PEeb4+QwBBGIY=" (Linus's real key) and "D2oUZTLYaa7kOPdLYhGqOwBBGIY=" (Linus's fake key) are pretty easilt-distinguishable, and not terribly verbose.
I believe miniLock also does that. Any reason why miniLock can't be used as an alternative to PGP? (for email/file encryption) https://minilock.io/
Because this isn't just about that. It's about an independently implemented web of trust. PGP has buy in from people like Linus, it has independent implementations, it is distributed, and has a strong web of trust.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#75The e-mail includes a couple of links. The linked site at http://gwolf.org/node/4070 returns "page not found?" for me currently. Here is an archived version of that page which works: http://archive.is/sSXvX
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#76Hi, Eric here, co-creator of evil32. I posted a brief note on our site about this, but here's a little more detail. I found an old (local) backup of the private keys and used it to generate revocation certificates for each key. Fortunately, there is no way for anyone else to access or regenerate the private keys for this particular clone of the strong set, and I have been very careful with my copy - it is only availa…
Sorry, whose private keys did you find a backup of?
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#77All the fake keys that I've seen mentioned are from the data set at https://evil32.com . It appears a couple of researchers decided, back in 2014, to demonstrate this issue by cloning the entire strong set of the PGP web of trust (not just Linus' key, but basically everyone who uses PGP/GPG for Free Software development - myself included). It would appear that sometime quite recently, someone decided it would be fun…
If you haven't seen it yet, a co-creator of evil32 says (https://news.ycombinator.com/item?id=12298230) that they found an old local backup of the secret keys and generated revocation certificates for all of the keys, and further promises that the secret keys never left that machine and will never use them for anything beyond the revocation certificates.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#78Seems some people are playing havoc with key ids. I got a mail earlier today I couldn't decrypt for unclear reasons. Now I understand why: It seems it was encrypted with a copy of my public key that is on the keyserver colliding with the keyid of my real key. Right now there is a revoked copy of my key there: https://pgp.mit.edu/pks/lookup?search=hanno%40hboeck&op=inde... What's exactly going on here? Other commentor…
Yes, they've been revoked. See this comment https://news.ycombinator.com/item?id=12298230
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#79I don't know why more folks don't display keys and fingerprints as Base64; it seems to me that "q68RxlopcLEwq+PEeb4+QwBBGIY=" (Linus's real key) and "D2oUZTLYaa7kOPdLYhGqOwBBGIY=" (Linus's fake key) are pretty easilt-distinguishable, and not terribly verbose.
Something I hadn't realised before now is that a PGP fingerprint has the same format as an IPv6 address, so if you just substitute colons for spaces you can display it as a hipku http://hipku.gabrielmartin.net/#0F6A:1465:32D8:69AE:E438:F74... > Hipku.encode('0F6A:1465:32D8:69AE:E438:F74B:6211:AA3B'); > Bold grouse and brass ghosts > clamp strict lean sane tart dry whales. > Fresh geese blur rust dice.
I hadn't heard of hipku before, it's quite clever. And my current IP produces a nice one.
The clever dark lamb
prowls in the ancient jungle.
Tiger lillies dance.Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#80Earlier quoted context omitted.
So the evil32 people kept the private keys. That's exciting.
Not necessarily, they might have just generated revokation certs which are separate (so that they can be used in case your private key is lost). Keeping a revokation cert would be a responsible thing to do, just in case something like this happens.
They had an old backup that contained the private keys. See this comment https://news.ycombinator.com/item?id=12298230