Hot answers tagged

73

Quote from Wikipedia: Although PGP keys are generally used with personal computers for Internet-related applications, key signing parties themselves generally do not involve computers, since that would give adversaries increased opportunities for subterfuge. Rather, participants write down a string of letters and numbers, called a public key ...


68

If you want to prove to others that you took the screenshot on a specific date and not later, you will not be able to do it yourself, you will have to rely on some common trusted third party. For low importance issues, this can be accomplished by simply posting the image on some well known public service where the date when the image has been posted will be ...


49

Uploading a hash of the screenshot to the Ethereum blockchain allows anybody in the future to make sure that the screenshot was taken before the hash was uploaded. Of course, you should choose a hash function that is cryptographically secure (and in particular, collision-resistant). If you however also need to make sure that the screenshot wasn't taken ...


31

Firstly, that statement doesn't mean "don't bring a computer"; it means " you don't need to bring a computer". Many people going to their first key signing party are likely to assume that, since the keys are intended for use on computers, they will need to bring a computer containing their keys, signatures, or encryption software. What actually happens is ...


16

Ask a mutually-trusted third-party to use their own independent equipment to make the screenshot and ask them to date and sign it (digitally or using ink) The normal way is to pay a solicitor/lawyer/notary to do this. It is trivial for you to fake a date in image metadata (EXIF etc) or in a digital signature - so you need certification by someone that will ...


10

There is no need to rely on a trusted third-party. Besides the excellent suggestion to use a blockchain (the answer by Christian), you could use a publically verifiable service like the excellent Stamper Even better, store the screenshot in several (unrelated) of these services. Even the most paranoid checker would no longer be able to complain. PunKeel on ...


7

It is a matter of speed and convenience, for the most part. Your basic options for signing a key: Both participants set up their computers next to each other, one reads off their fingerprint, the other verifies at the same time, then the key is signed immediately. One participant shows their computer screen with the fingerprint to the other, who writes ...


7

I think there are 3 parts to this question, and I think I can reasonably answer all three. I think parts 1 & 2 have been mostly answered above, but I think this will link them together. I added a related followup question: Can I prove that a file (screenshot or otherwise) was generated on or before a particular timestamp? Add a copy or secure hash of ...


3

Others have already mentioned that it sounds like you're looking for a digital signature. There's another part of your question that is important: how to actually distribute your public key (which users will use to verify your signature). A few common methods (in no particular order): Meet up in person with whomever you intend to send messages to, and ...


3

In an asymmetric algorithm you have two keys. Lets call them A and B. Whatever you encrypt with A, you have to decrypt with B. Whatever you encrypt with B, you have to decrypt with A. (This is true for not all, but most asymmetric algorithms. Also, in practical implementations it is a bit more complicated, see techrafs comment.) One of these keys are chosen ...


2

Taking a look at git signing process, it says that only commit information can be source verified by this method. After version 1.8.3, git can also sign commits and merge requests. The person who execute those operations provides the gpg key password for signing, and everyone that looks at the commit, tag and merge can see if it comes from a "trusted ...


2

Auditing and alerting is the general approach to insider threats. If you make sure that activity on sensitive systems is heavily logged and monitored, you dramatically increase the difficulty of subverting those systems. Typically, you'd log and alert on any logons, and maintain an audit log of all actions taken on the system. To protect those logs from ...


2

Perhaps you are overthinking this. When you say: Now imagine a malicious inside attacker changes the application code... You are then trying to guess what the application code will be changed to, and are trying to come up with a solution for that particular change. The problem is, if they can change the code in the first place, they can change it to ...


2

For simplicity, let's consider those that attempt to verify your screenshot dates as users. Your users cannot tell: Whether the age of the screenshot is older than age claimed by the timestamp. E.g. you may take a screenshot months ago but assign it a recent timestamp, and your users can't tell. Your users can tell: Whether the age of the screenshot ...


2

First of all, as @WhiteWinterWolf points out, this is a digital signature scheme. Digital signing is specifically for the purpose of making sure that the message is from you, not somebody else, and hasn't been modified since it was signed. Without going into the math, here's how it works: You have a message that you want the world to know came from you You ...


2

Without knowing the prevailing law where you require this, all answers are moot. For last year's Large Renewable Procurement (LRP) in Ontario, Canada, proponents had to prove that a public web page was available on a certain date. After much discussion with proponents, the agency required: a printout of the webpage, showing URL and system clock date and ...


2

I will try to simplify as much as possible The difficulty comes from some "hard to compute" operations in maths. For example, some operations are two-ways easy to compute. If I compute 5*6 = 30, it is easy to calculate x*6 = 30 (30/6 = 5). Some other operations are only one-way easy to compute: 5^6 = 15625. Ok but if I give you x^6 = 15625... how the fuck ...


1

What you are looking for is to modify the certificate in a way that it contains the ability to be a CA, i.e. set the CA flag to true. Fortunately you cannot simply modify a certificate, because any kind of modification invalidates the signature and thus nobody will trust this certificate anymore. This is essential because otherwise everybody could just ...


1

You can't do this, you will have to apply for a new certificate. There are special types of certificates that apply for multiple previously specified domains at once.


1

The piece that seems to be missing is that, for some public key crypto algorithms, the public and private keys are cryptographic inverses of one another. So, encrypt with a public key, decrypt with the private key; encrypt with a private key, decrypt with the public key. So, if I encrypt a message, or more likely, a message digest, with my private key, ...


1

Why wouldn't you take an actual photo of the screen, not a screen shot, screen capture, print screen? Take a digital camera, or smart phone, have the page up, have in the shot a copy of today's paper. Much harder to photoshop. Even better, take a video, today's paper in shot, open the browser, type in the url and show the page loading and the content in ...


1

A malicious forum administrator cannot forge the signed text in such a way that it will look like it comes from your key pair. However, a malicious forum administrator can replace both your public key and signed text, with his own public key and signed text, and display it to the person(s) you're communicating with, while still showing you your own public ...


1

Asymmetric algorithms are designed to have a pair of keys: the public key, which is disseminated to anyone, and the private key, which is retained by the individual or system that generated the key pair. The keys are special in that ONLY the private key can decrypt messages encrypted with the public key, and only the public key can decrypt messages encrypted ...


1

Using PGP, the answer is to use a signing subkey, you can then attach the subkey to an unusable ("stub") master key and use that in everyday work. If that key is lost, the certification key can be used to designate a new signing subkey; the recipient will need to update the key from a keyserver though. With X.509, no such mechanism exists. For both, you ...



Only top voted, non community-wiki answers of a minimum length are eligible