New answers tagged

2

If you're (somewhat) sure that the key is not compromised, I'd simply create a bunch of subkeys and move whatever keys you want to smartcards or other offline places. Adding subkeys is easily possible by using gpg[2] --edit-key and the addkey commands. The usage flags are stored in a signature subpacket, so changing them does not change the key (with ...


3

What is the most and least secure way of going about encrypting emails? There is no difference in security: both use the same cryptographic principles, they just use another method of embedding OpenPGP into e-mails. I am looking for security and have no idea which to use, though I do know HTML will not work with PGP Inline but will with PGP/MIME. PGP/...


1

If you have your publick key on key servers you can only share fingerprint, a link for download your public key is good if you haven't key on key servers or even when you have on key servers because maybe not all people use same key servers. I use fingerprint and also I have a link to my public key on my blog. gpg --recv-key ...


0

Send the key to the recipient over different channels. Send from different accounts, to different accounts. The recipient's first job is to assemble the pieces. The second job is to replace the key.


0

Two things. 1. It's the way it has always been Biometrics or hardware tokens (such as RSA SecurID) were the standard for 2FA, and then everyone got cell phones and later smart phones. Suddenly it was easy to create a second factor by sending people an email to their smartphones, or to an app on their smartphones, or an sms to older phones. That you could ...


1

For the general public, any 2-factor authentication should be understood in under 2 minutes, otherwise it will fail very quickly since few people will be able understand it. That generally requires using something people are already familiar with, or is very simple. PGP, and SSH are complex technologies that very few people, except developers and IT ...


0

The EnigForm FireFox plugin was a very promisong approach. And in combination with an OpenPGP SmartCard it was at least as secure as FIDO U2FA. It's a pitty it didn't gain widespread adoption.


4

Because additional auth factors should, ideally, be out of band. Like a phone, or token, or some kind of telepathic message. U2F is good because you CAN'T extract the private key and it requires a physical touch to the device before it will sign.


0

Well, as you can read above you can use SMTPS and STARTTLS to harden security for SMTP servers while sending mails. MITM can be mitigated with DKIM. DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message that is in transit. The organization is a handler of the message, either as its originator or as an ...


10

Lack of portability SSH and PGP are widely used, but they are not web technologies. There has been an equivalent web technology for many years - SSL client certificates. However, this is not much used. The reason is the lack of portability. If you have an SSL client certificate on your home desktop, it's difficult to move it somewhere else. So you can't ...


0

What issues might I run into if I generate and sign the notice? Not considering the practical issues with paper-based digital signatures, let's consider what an attacker could do with your signed message. Consider the attacker a man in the middle: he's broking the information between you and possible readers of the records. Obviously he cannot modify it ...


25

Let's check out what PGP and SSH actually offer for this purpose: PGP: Client must install PGP software which is not installed by default in the majority of the systems. Client must create a PGP key pair. Then he must send the public key to the server so that the server can use it later for validation. When authenticating with 2FA the server will send a ...


3

Writing a standard is easy. I thought about this very problem about ten years ago. It comes down to the human/cost factor. How do you convince a billion technologically illiterate people to update their software for no perceived benefit, and convince the thousands of developers across a smattering of platforms to implement this protocol, and millions of ...


48

It's not that hard, why isn't it standard for years? Because that would not have solved the problem that PGP is trying to solve. PGP is an end to end encryption, so if there is any way for the SMTP server to subvert the encryption, then the scheme fails. In the case of the scheme you proposed, suppose Alice (alice@charlie.com) wants to send a private ...


31

integrating PGP into SMTP. PGP is a container format for data (like mails but not restricted to mails), which adds encryption and/or signature to the data. SMTP is a transport protocol. You don't integrate container formats into transport protocols. This would be the same as saying that you should integrate Office (container for text, images...) with ...


3

Encryption is already in place during mail transit (STARTTLS in SMTP), but not sophisticated enough to protect against MITM. I believe PGP is more of an end-user experience between email clients, which is helpful if you don't have full trust of the servers involved. (PGP is sometimes susceptible to MITM to the less-than-careful user, however, like in SSH, ...


0

The four possible key "usages" are Certification: signing other keys Signing: signing data Encryption: decrypting data Authentication: signing authentication tokens When you look at your key using --edit-key, you find the usage listed behind each key and subkey. By default, all that are supported by the key type are attached to the master key (so, RSA ...


7

It is a matter of speed and convenience, for the most part. Your basic options for signing a key: Both participants set up their computers next to each other, one reads off their fingerprint, the other verifies at the same time, then the key is signed immediately. One participant shows their computer screen with the fingerprint to the other, who writes ...


31

Firstly, that statement doesn't mean "don't bring a computer"; it means " you don't need to bring a computer". Many people going to their first key signing party are likely to assume that, since the keys are intended for use on computers, they will need to bring a computer containing their keys, signatures, or encryption software. What actually happens is ...


73

Quote from Wikipedia: Although PGP keys are generally used with personal computers for Internet-related applications, key signing parties themselves generally do not involve computers, since that would give adversaries increased opportunities for subterfuge. Rather, participants write down a string of letters and numbers, called a public key ...



Top 50 recent answers are included