Tag Info

New answers tagged

2

I Think the questioner is living in a country like Sweden, where anyone who gets hold of your social security number, can use it to order things on post-payment in your name and have the bill sent to you instead of to delivery adress, and then you become obliged to pay the bill for someone elses Products. The recommended solution for this is Notary Public. ...


1

Identity Theft If you're scared of identity theft by people reading your documents, don't go to key signing parties. Also better don't travel, as you might have to show your passport at the airport (even to normal airline staff). I'd also consider not using credit cards any more, the cashier might copy the credit card ID, and as I experienced in the US you ...


2

At a key-signing party, you show documents, you don't hand them over, nor is there an opportunity to copy them. Someone with an eidetic memory and an evil side might be a risk. However, eidetic memory is rare in adults. (So is evil, happily.) So, specific advice in answer to your question: a key-signing party should have guests known to the host, or ...


1

Unluckily, although PGP is awesome in theory, the "real world" benefits of PGP are quite limited, if existent. If PGP was the default that everybody uses, it would rock. TLS gives you (ignoring the possibility of exploits) a secure connection to your mail server. You have the guarantee that the server you talk to is really your mail server, and that nobody ...


0

Let's start with having a look on what RFC 4880, OpenPGP considers important in the introduction (highlighting added by me): This document provides information on the message-exchange packet formats used by OpenPGP to provide encryption, decryption, signing, and key management functions. What do we need for the individual tasks? Key management ...


9

HTTPS only protects your email between you and Google. From then on it is transferred unencrypted. That means your email can be read by: Google (and they admit that they read it!) any routers between Google and the mail service of the receiver the receivers mailserver when the receiver isn't also using https, any router between their mailserver and them. ...


6

In short, PGP protects the contents of the email, both in-flight and at rest; TLS protects the communication channel while the message is transiting a network. PGP vouches for a person and an email address; TLS vouches for a server (and optionally a client).


24

There is more at risk in using SSL/TLS than potential 0-days, because there are already known attacks that can circumvent TLS. Moxie Marlinspike has been giving Def Con presentations on it since at least Def Con 17. One of the most notable tools is sslstrip, created by Marlinspike. TLS also requires a Certificate Authority trust model, which gives ...


54

SSL/TLS protects the email from tampering or eavesdropping as it transits between your computer and Google's server, and possibly during further relays to eventual recipient. And that's all it does. PGP does far more. If you're sending a signed email, the recipient can verify that the email was sent by you, and that it was not tampered with at any point ...


12

non-repudiation -- no one can forge your private key signature of a message, encryption at rest -- the message is encrypted not just in transit, but at rest as well. all of the benefits of mail over SSL/TLS sans a lot of the problems (e.g. Heart Bleed and POODLE) Just to name three.


1

When we are working with Responsible Disclosure Communication, we need balance security and convenience. Convenience for whom? For security researchers. You need to think a few things before choose: Do you need the reports so safe that you can wait to receive them? Sometimes the security researcher finds a security bug, but he is not with his PGP ...


5

Recently, our clients want to encrypt their files for one reason: " They don't want FTP server admin has access to their files". With this requirement the encryption should not be done at the server side. Otherwise an administrator could just grab the content before it gets encrypted. And of course the management of the passwords/keys should also be ...


4

My suggestion is to have your clients manage their owns encryption password or certificates. Certain FTP clients will allow the use of encryption, as an example: http://www.coreftp.com/docs/web1/FTP_Encryption.htm. I want to make sure though that you're actually using some type of encryption for the transit of their data. You don't mention it and since ...


6

They're referring to short key IDs, which are considered vulnerable to collision attacks for quite some time now. The problem is already referenced in RFC 4880, OpenPGP, 3.3. Key IDs: A Key ID is an eight-octet scalar that identifies a key. Implementations SHOULD NOT assume that Key IDs are unique. OpenPGP Fingerprints and Key IDs Each OpenPGP key ...


4

pgp.mit.edu and most other key servers are currently running the SKS key server software, which is (as of November 30th, 2014) not yet ready for the new ECC keys. There is some code, though; but it is not ready for production yet. Be aware that even if most keyservers will support it (probably rather soon), broad support for ECC keys with other OpenPGP ...


2

The .sig file is a detached signature. You use your key to sign a file to certify its authenticity. If the file is changed in any way, the verification process will fail and the party that received the file will know that it has been tampered with after you sent it out. I believe the .asc.sig you received is a certificate of that guy's public key certifying ...


0

PGP Global Directory The PGP Global Directory is a certification authority that validates that you have access to the mail address if you want it signed (but doesn't validate anything further than that). In the end, it is a kind of yellow pages for mail addresses, you can look up keys in there, and with a given chance key owner and mail address owner ...



Top 50 recent answers are included