Tag Info

New answers tagged

0

You seem to be begging the question here. I would no more try to convince my mother that she needs to use encryption than I would try to convince her she needs to use a chainsaw or an oxyacetylene torch when she shows no interest in those things. How does littering the internet with abandoned and poorly secured private key files, and littering the public ...


1

You need encryption if you don't want your sexts and other "naughty" messages becoming water cooler topics at the NSA's HQ. Not a very detailed answer, but in my opinion that's the most important problem for someone that has nothing to hide (about the other risks mentioned in the other answers - how many times did your neighbor attack your WLAN and tried to ...


1

Do you want your bank details stolen and all the money in your account removed? No? You need encryption. Do you want anyone to alter your emails so they say something rude/incriminatory/racist? No? You need encryption. Do you want people to use your network or PC to download or store illegal materials? No? You need encryption. Do you want crooks to hijack ...


2

I think the others covered signing already pretty well, so I'll present my thoughts on encryption. Possible Reasons for encryption for everyday people They would (or should) want it because pretty much nobody has nothing to hide. It doesn't have to be anything illegal. If people really think about it, they can come up with an embarrassing secret they do ...


1

I think everyone should run their own mail servers (non-locally, of course). However, barring that (and the security risks from faulty software), it's just a good idea to have all information that is on a stranger/untrusted party's computer be encrypted. That information is stored for a long time (with gmail, forever), so 10+ years in the future, things may ...


1

Even a simple user doesn't think that he needs encryption , but he actually does because sometimes and i say "sometime" , those simple messages can show the psychology of a person which can leads to exploiting them in anyway you want . also as stated above encryption validates the identity of the person you're talking to .


1

Encryption can also help validate the identity of a conversation partner. This can prevent fraud such as phishing. A simple example of this is giving your child a safeword, or instructing your employees not to heed any instructions coming from an unsigned or improperly signed source. Thus your child will not be abducted by an extended friend of the ...


30

Removing a Local-Only Signature If the signature is still only kept locally (either by never sending it to anybody or the key servers, or by even having performed an lsign which creates signatures that cannot be uploaded), you can actually delete it by running gpg --edit-key [keyid] [select a uid] delsig [go through the assistant for deleting signatures] ...


10

You can't unsign, but you can revoke your signature on their key. Once someone has synced both the original signature and the revocation, their UI should show both and will no longer use the signature in trust calculations. To do this with GnuPG: gpg --edit-key KEYID revsig <Supply a reason> gpg --send-key KEYID # Upload key to keyserver, or gpg ...


2

So your question is basically: wouldn't the attacker, if operating your entrance node, be able to correlate the IP of the sender to [the recipient's] identity by identifying the key it's encrypted with No because the entrance node does not know this key. In short, the Tor client encrypts the traffic before it is sent to the entrance node and the ...


15

To add some information to the excellent explanation of Tom, you should be careful with a BCC if you really want to make sure that the BCC is actually a BCC since you can detect from the list of encrypted session keys that the message has been encrypted with some other PGP key. To be precise, the key ID of the PGP key but since most keys are stored on a PGP ...


51

In the OpenPGP format (that PGP implements), a given email can be encrypted for several recipient with only minute per-recipient size overhead. This is because email encryption actually uses hybrid encryption: A new random symmetric key K is generated for the email to encrypt. The bulk of the email is encrypted with a symmetric encryption algorithm, using ...


3

While the other answers are correct, you don't need additional software. You can get all of this information from gpg if you add the -vv command-line switch. (This means extra verbose.) For example, the easiest way to get detailed information about an OpenPGP-formatted message is to simply type: gpg -vv And then paste the message into it (or pass a ...


0

The "length" is a formal characterization of one of the mathematical values that constitute the key pair. Thus, the public and the private key don't have independent lengths per se; the private/public key pair has a length, which, by extension, is also said to be the length of the public key and of the private key. The length is not the actual bit length of ...


2

While @schroeder's answer addresses the basic process for signature validation, there is an important step missing. The recipient needs to have a copy of your public key, received and/or validated from a trustworthy source, in order to verify your signature. Without a pre-existing trust in your public key, or in a signing authority which has validated your ...


0

The basic concept behind Digital signatures revolves around a key that only one person (or entity) possesses. That's the 'key' to the authenticity process. There are different technical methods, but they tend to work in some variation of this: a message is composed a 'hash' (a compressed snapshot) of the message is made the sender's key is used to encrypt ...


3

It can actually be done. The instructions at atom.smasher.org/gpg/gpg-migrate.txt are now out of date. Try this. As always, make backups, because it's really easy to mess it up. So these are your 'old' keys: $ gpg -K ---------------------------------- sec 2048R/712A2BBD 2013-01-29 uid Test Key 1 ssb ...


2

A flat file, IMHO, requires too much user intervention. Unless you have it under some sort of revision control ... could get unwieldy. I personally like using KeePass, which also has a few ways of doing multi-user syncing. I don't really have pros and cons for you since I don't know what your requirements are. But it seems to me that you've made up ...


3

By sharing passwords, they are already 'compromised', which might be an ok risk for your environment. You know you have to change ALL shared passwords, even the encryption key whenever you lose a member of the team, so there is not going to be a lowered workload by using either method. What you are really talking about then is simply a 'user logistics' ...


1

Yes, you can. At least you can easily recover the KeyID and with that you can recover the public key from a keyserver (if the user ever uploaded it). You can recover the KeyID using pgpdump (locally if you install it or via the website: http://www.pgpdump.net/) For example message you posted is signed by: Sub: issuer key ID(sub 16)(8 bytes) Key ID - ...


4

Yep, I actually can. With GnuPG, for example: gpg --verify file.txt (with the above file) writes, at the end Primary key fingerprint: 402C C0D3 D527 13E3 FB7C 7103 E481 84B5 B056 76B1 OpenPGP.js works too. openpgp.cleartext.readArmored( ['-----BEGIN PGP SIGNED MESSAGE-----', 'Hash: SHA1', '', '', 'I vote YES on this important measure.', '', ...


6

Yes. The format of the signature is defined in RFC 4880. If you decode the base-64 and interpret the data, you will find that the bytes 18-26 are the issuer ID in this case: ID hex: E48184B5B05676B1 which matches the "Long key ID" behind your link. If you convert the ID to base 64, you can find it in the original signature data, because 18 bytes happen to ...


0

Currently, ECC is supported in GnuPG 2.1 beta. You can compile it from source and see for yourself that the following curves are supported: nistp256 nistp384 nistp521 brainpoolP256r1 brainpoolP384r1 brainpoolP512r1 secp256k1



Top 50 recent answers are included