Reputation
956
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 9 19
Impact
~62k people reached

  • 0 posts edited
  • 0 helpful flags
  • 67 votes cast
Aug
20
awarded  Favorite Question
Jul
16
comment Why do we use passwords on sites?
@user23013: Than I need to integrate an openid library. I remember one major lib didn't work because it made assumptions that wasn't true of my site. It's probably fixed now or documented how to get around it
Jul
15
comment Why do we use passwords on sites?
Its strange logging in with FB is common and that isn't. I use a separate browser just for fb bc I don't want all this spam and tracking
Jul
15
asked Why do we use passwords on sites?
Jul
15
awarded  Caucus
Jul
8
revised Why can I sign but not encrypt?
added 339 characters in body
Jul
8
comment Why can I sign but not encrypt?
@GeraldDavis Hmmm that makes sense. I saw decrypt and verify to be similar because you're using the senders public key to decrypt the SHA. It's weird to hear signing is decrypting because you'd decrypt (sign) before encrypt (verify). But I see what you're saying (verify and encrypt both use the target public key
Jul
8
comment Why can I sign but not encrypt?
Well you said "The private key is generated on the card and never leaves the card" so importing would be out of the question as it stores a copy on your HD. Come to think about it. Isn't this all very ridiculous? If we wanted to have that level of security we could just have the RSA key only on the card. I see no reason why we can never encrypt with that key on the card (but then again I don't see a reason to encrypt) and I especially don't see a reason to have two keys for a casual users who might want to sign some source code, or text on his website.
Jul
8
comment Why can I sign but not encrypt?
AFAIK GPG automatically generates the signature keys and stores it on your HD. It has no prompts or suggestions (AFAIK) to store it externally. I'm unsure how to even use a key outside of the default location. I have only import/export and did various signs and encrypt to learn the software.
Jul
8
comment Why can I sign but not encrypt?
@GeraldDavis maybe I'm misunderstanding. When using RSA to encrypt it's something similar to encrypting an AES key and SHA of the message (along with some other data) then concatenate the (AES) encrypted message to it. Is signing just encrypting the SHA concatenate the plaintext and public key? Did you mean to say there are similarity between DECRYPT and VERIFY? I'm not sure what I am misunderstanding
Jul
8
comment Why can I sign but not encrypt?
This is a great answer. To me losing my encryption key is a bigger deal as losing my signing key (data loss). But now I see reasons why someone might care about signing. But all in all there is a copy of your key (on your laptop or where ever) and it could be as easily stolen. I don't see how multiple copies would be any different you never know which will be least secure. Even if they are stolen the passphrase should be strong enough to prevent people from signing. But you're saying for law only one copy should exist and only you should have access to it? A little strange but makes sense
Jul
8
accepted Why can I sign but not encrypt?
Jul
8
comment Why can I sign but not encrypt?
@ott--: Your question is flawed. I don't want to transfer a secret (or private) key to anyone. I want to give them a public key.
Jul
7
comment Why can I sign but not encrypt?
@deviantfan I'm not sure what you're trying to say. My entire post is about the fact I can do signing and encryption with the same RSA key. I'm asking why GPG and others don't appear to recommend doing so
Jul
7
comment Why can I sign but not encrypt?
@raz: I'm not satisfied with Thomas answer (although it doesn't mean its bad). Do you know why GPG separates the two? (I'm unsure but it looks like your comment is assuring me that everything I said is correct or mostly correct and assuring me its something GPG does for their reason which I do not know)
Jul
7
comment Why can I sign but not encrypt?
1) Why is the analogy fallowed and not work? AFAIK signatures are is a hash of the message and encrypted with the private key 2) I called it the same key hence why I am confused why we need two 3) That link made no sense. In short it doesn't explain why a key for signing not be backed up. It just says it doesn't need to bc it isnt a big deal and thats why it's separated from an encryption key. I don't see why anyone should bother separating it or why it's harmful to back up
Jul
7
revised Why can I sign but not encrypt?
added 1 character in body
Jul
7
asked Why can I sign but not encrypt?
May
31
revised How and when do I use HMAC?
deleted 1 character in body
Mar
30
awarded  Nice Question