77
votes
If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?
As Steffen already said, the Achilles' heel on your security is making sure you are talking to Joe, and Joe being sure he is talking to you. If the initial key exchange is compromised, the third party ...
- 53.5k
76
votes
Accepted
Why shouldn't I bring a computer to a key-signing party?
Quote from Wikipedia:
Although PGP keys are generally used with personal computers for
Internet-related applications, key signing parties themselves
generally do not involve computers, since ...
- 1,062
70
votes
Accepted
Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?
Yes, it's a coincidence that the first bytes appear to you as these symbols. They are part of the OpenPGP message format specification (RFC 4880) and vary depending on the packet properties.
Let's ...
- 44.6k
69
votes
Accepted
Is PGP for user authentication a good idea?
You should never try to secure a "real" web application with a scheme that you invented on your own. As such we shouldn't discuss practicalities on how you would actually implement or use such a ...
- 1,093
65
votes
Accepted
Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?
When you authenticate to Github with your SSH key, that authentication doesn't become part of the repository in any meaningful or lasting way. It causes Github to give you access for the moment, but ...
- 786
53
votes
Accepted
Why is end-to-end encryption still not default in mails?
It's not that hard, why isn't it standard for years?
Because that would not have solved the problem that PGP is trying to solve.
PGP is an end to end encryption, so if there is any way for the ...
- 31.4k
50
votes
Accepted
GnuPG decryption not asking for passphrase
Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)?
GnuPG only uses keys from your key chain, so it must be in there to use it.
...
- 24.4k
48
votes
Accepted
How to raise a key to ultimate trust on another machine?
You can set every key to ultimate trust through opening the key edit command line
gpg --edit-key [key-id]
and running the trust command. You will now be prompted to select the trust level:
Please ...
- 24.4k
46
votes
HTTPS is widely adopted, why isn't encrypted e-mail as popular?
The biggest obstacle to your proposal is user adoption and behavior change. Imagine having to explain to everyone what a public key is and how great it is to have. This is just not going to happen.
...
- 4,251
37
votes
Accepted
Is there any reason I shouldn't make a GPG-encrypted file publicly-accessible?
There is always a risk that any given cipher will be broken at some point and data like this will become truly public. So yes there are some risks but it doesn't mean you aren't making a reasonable ...
- 14.2k
33
votes
Why is end-to-end encryption still not default in mails?
integrating PGP into SMTP.
PGP is a container format for data (like mails but not restricted to mails), which adds encryption and/or signature to the data.
SMTP is a transport protocol.
You don't ...
- 198k
32
votes
Why shouldn't I bring a computer to a key-signing party?
Firstly, that statement doesn't mean "don't bring a computer"; it means " you don't need to bring a computer". Many people going to their first key signing party are likely to assume that, since the ...
- 1,766
28
votes
Accepted
What exactly is a subkey?
This post by user rjh from 2008 in the enigmail forum answers it well:
Originally in PGP 2.6, back in the early 90s, you had just one keypair
and it was used for both encryption and signing. The ...
- 1,716
28
votes
Accepted
GPG why is my trusted key not certified with a trusted signature?
The key needs to be verified. If you trust that someone's public key does in fact belong to that individual and they are in your keyring you can use your private key to sign your correspondent's ...
- 7,789
26
votes
Accepted
How do GPG smart card devices handle large GPG operations?
The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
- 46.2k
25
votes
Accepted
GnuPG asks for a key ID when sharing my public key, what is that?
OpenPGP User IDs
User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses....
- 24.4k
25
votes
Accepted
Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?
Let's check out what PGP and SSH actually offer for this purpose:
PGP:
Client must install PGP software which is not installed by default in the majority of the systems. Client must create a PGP key ...
- 198k
24
votes
Accepted
GPG masterkey and subkey for encryption and signature and default keys
If you already have an SC and E keys, and you want to remove your C ("master") key to offline storage, then all you require is a new S key (SSK1 in your example). You do not need to create a new ...
- 6,408
23
votes
Extracting the PGP keyid from the public key file
From the gpg manual (gpg (GnuPG) 2.2.11):
--show-keys
This commands takes OpenPGP keys as input and prints information about them in the same way the command --list-keys does for locally stored ...
- 341
22
votes
Accepted
How to change (sub)key usage of a PGP key?
Since GnuPG 2.2.6 there's a hidden key-edit subcommand "change-usage" which does exactly that. Relevant commit.
Let's try this subcommand with a test key. Let's create one first:
mkdir /tmp/gpg-...
- 434
22
votes
HTTPS is widely adopted, why isn't encrypted e-mail as popular?
It may seem simple, but it's not. It's actually very complicated.
There are a couple moving parts that are difficult to fix:
user education: don't count on people knowing what a keypair is, how to ...
- 53.5k
21
votes
What is a good general purpose GnuPG key setup?
Cookbook
This is a cookbook approach which exemplifies the nice answer above. It is a distilled version of Generating More Secure GPG Keys: A Step-by-Step Guide which separates all those functions ...
- 471
21
votes
How do I protect my OpenPGP key on my computer?
What's your threat model?
If your threat is that you are protecting from physical theft, then encrypting the key (using passphrase) or full disk encryption would suffice.
If your threat is a ...
- 31.4k
21
votes
Accepted
gpg --fingerprint prints out completely different fingerprint
GnuPG generally resolves subkeys to the primary key if a subkey is passed as argument. This might be especially surprising when specifying an encryption subkey: GnuPG resolves the subkey to the ...
- 24.4k
21
votes
If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?
If they decide to manipulate my initial e-mail message, changing the key I sent to Joe, then Joe's reply will be unreadable by me, since it's no longer encrypted using my public key, but Google's ...
- 198k
18
votes
Putting my PGP ID/link on printed business cards
I'd recommend putting your OpenPGP key's fingerprint in textual form and as QR code on your business card.
To do so, you would create an URI with OPENPGP4FPR as scheme and your OpenPGP fingerprint in ...
- 334
18
votes
Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?
As a general principle, well-designed binary file formats¹ will have their first few bytes be a magic number identifying the format. ELF executables' first four bytes are always 7f 45 4c 46, PNG ...
- 637
16
votes
Accepted
Which signing key should I use for certifying other peoples public keys: master or subkey?
The four possible key "usages" are
Certification: signing other keys
Signing: signing data
Encryption: decrypting data
Authentication: signing authentication tokens
When you look at your key using --...
- 1,512
14
votes
GnuPG decryption not asking for passphrase
GnuPG 2.2.15
--symmetric
-c Encrypt with a symmetric cipher using a passphrase. The default sym-
metric cipher used is AES-128, but may be chosen with the --cipher-algo
...
- 241
14
votes
Create backup Yubikey with identical PGP keys
found this blurb which says that theres a command you can run which will essentially tell your local gpg app to scan the new card and use that instead if things gel. so in the case of using a backup ...
- 249
Only top scored, non community-wiki answers of a minimum length are eligible