Skip to main content
77 votes

If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?

As Steffen already said, the Achilles' heel on your security is making sure you are talking to Joe, and Joe being sure he is talking to you. If the initial key exchange is compromised, the third party ...
ThoriumBR's user avatar
  • 54.6k
76 votes
Accepted

Why shouldn't I bring a computer to a key-signing party?

Quote from Wikipedia: Although PGP keys are generally used with personal computers for Internet-related applications, key signing parties themselves generally do not involve computers, since ...
licklake's user avatar
  • 1,062
70 votes
Accepted

Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?

Yes, it's a coincidence that the first bytes appear to you as these symbols. They are part of the OpenPGP message format specification (RFC 4880) and vary depending on the packet properties. Let's ...
Arminius's user avatar
  • 44.9k
69 votes
Accepted

Is PGP for user authentication a good idea?

You should never try to secure a "real" web application with a scheme that you invented on your own. As such we shouldn't discuss practicalities on how you would actually implement or use such a ...
averell's user avatar
  • 1,093
53 votes
Accepted

Why is end-to-end encryption still not default in mails?

It's not that hard, why isn't it standard for years? Because that would not have solved the problem that PGP is trying to solve. PGP is an end to end encryption, so if there is any way for the ...
Lie Ryan's user avatar
  • 31.5k
50 votes
Accepted

How to raise a key to ultimate trust on another machine?

You can set every key to ultimate trust through opening the key edit command line gpg --edit-key [key-id] and running the trust command. You will now be prompted to select the trust level: Please ...
Jens Erat's user avatar
  • 24.6k
47 votes

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

The biggest obstacle to your proposal is user adoption and behavior change. Imagine having to explain to everyone what a public key is and how great it is to have. This is just not going to happen. ...
Marc's user avatar
  • 4,301
37 votes
Accepted

Is there any reason I shouldn't make a GPG-encrypted file publicly-accessible?

There is always a risk that any given cipher will be broken at some point and data like this will become truly public. So yes there are some risks but it doesn't mean you aren't making a reasonable ...
Trey Blalock's user avatar
  • 14.2k
33 votes

Why is end-to-end encryption still not default in mails?

integrating PGP into SMTP. PGP is a container format for data (like mails but not restricted to mails), which adds encryption and/or signature to the data. SMTP is a transport protocol. You don't ...
Steffen Ullrich's user avatar
32 votes

Why shouldn't I bring a computer to a key-signing party?

Firstly, that statement doesn't mean "don't bring a computer"; it means " you don't need to bring a computer". Many people going to their first key signing party are likely to assume that, since the ...
micheal65536's user avatar
  • 1,766
29 votes
Accepted

GPG why is my trusted key not certified with a trusted signature?

The key needs to be verified. If you trust that someone's public key does in fact belong to that individual and they are in your keyring you can use your private key to sign your correspondent's ...
TheJulyPlot's user avatar
  • 7,829
26 votes

Extracting the PGP keyid from the public key file

From the gpg manual (gpg (GnuPG) 2.2.11): --show-keys This commands takes OpenPGP keys as input and prints information about them in the same way the command --list-keys does for locally stored ...
Traz's user avatar
  • 371
26 votes
Accepted

GPG masterkey and subkey for encryption and signature and default keys

If you already have an SC and E keys, and you want to remove your C ("master") key to offline storage, then all you require is a new S key (SSK1 in your example). You do not need to create a new ...
mricon's user avatar
  • 6,548
26 votes
Accepted

How do GPG smart card devices handle large GPG operations?

The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
CBHacking's user avatar
  • 49.5k
25 votes
Accepted

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

Let's check out what PGP and SSH actually offer for this purpose: PGP: Client must install PGP software which is not installed by default in the majority of the systems. Client must create a PGP key ...
Steffen Ullrich's user avatar
24 votes
Accepted

How to change (sub)key usage of a PGP key?

Since GnuPG 2.2.6 there's a hidden key-edit subcommand "change-usage" which does exactly that. Relevant commit. Let's try this subcommand with a test key. Let's create one first: mkdir /tmp/gpg-...
sanmai's user avatar
  • 464
23 votes

Is it possible to sign Git commits on a different computer?

If you are working for hire, a solution is to create a new PGP key just for the process, and sign it with your normal key, and sign the commits with that. In the event that your employer actually ...
bmargulies's user avatar
22 votes
Accepted

gpg --fingerprint prints out completely different fingerprint

GnuPG generally resolves subkeys to the primary key if a subkey is passed as argument. This might be especially surprising when specifying an encryption subkey: GnuPG resolves the subkey to the ...
Jens Erat's user avatar
  • 24.6k
22 votes

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

It may seem simple, but it's not. It's actually very complicated. There are a couple moving parts that are difficult to fix: user education: don't count on people knowing what a keypair is, how to ...
ThoriumBR's user avatar
  • 54.6k
21 votes

If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?

If they decide to manipulate my initial e-mail message, changing the key I sent to Joe, then Joe's reply will be unreadable by me, since it's no longer encrypted using my public key, but Google's ...
Steffen Ullrich's user avatar
18 votes

Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?

As a general principle, well-designed binary file formats¹ will have their first few bytes be a magic number identifying the format. ELF executables' first four bytes are always 7f 45 4c 46, PNG ...
zwol's user avatar
  • 657
17 votes
Accepted

Which signing key should I use for certifying other peoples public keys: master or subkey?

The four possible key "usages" are Certification: signing other keys Signing: signing data Encryption: decrypting data Authentication: signing authentication tokens When you look at your key using --...
Simon Richter's user avatar
17 votes

Is it possible to sign Git commits on a different computer?

Note that this answer takes into account your comment on an answer indicating that you cannot copy the code from the work machine you are using (which I will call, using your personal viewpoint, the &...
cjs's user avatar
  • 585
15 votes

GnuPG decryption not asking for passphrase

GnuPG 2.2.15 --symmetric -c Encrypt with a symmetric cipher using a passphrase. The default sym- metric cipher used is AES-128, but may be chosen with the --cipher-algo ...
anonymous's user avatar
  • 251
15 votes

Create backup Yubikey with identical PGP keys

found this blurb which says that theres a command you can run which will essentially tell your local gpg app to scan the new card and use that instead if things gel. so in the case of using a backup ...
MrTristan's user avatar
  • 259
14 votes
Accepted

How does GnuPG encrypt secret keys?

GnuPG 2.x has a separate gpg-agent that is the custodian of secret keys and that offers no control whatsoever over the encryption parameters of the secret keys within. Furthermore, --s2k are accepted ...
starfry's user avatar
  • 321
14 votes

How to raise a key to ultimate trust on another machine?

To change the Ownertrust trust level of a key after importing in a simplier way (without the interactive --edit-key mode) I found this way in one line using gpg --import-ownertrust: According to this ...
moocan's user avatar
  • 141
14 votes

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

It's been touched on in other answers and comments, but I think the fundamental difference between web and e-mail traffic is who the parties involved are. HTTPS actually does two things: It encrypts ...
IMSoP's user avatar
  • 3,910
13 votes

Generate new key - ECC vs RSA

It's fine to stick with RSA. ECC is more space-efficient, but it is not supported everywhere. My questions are is it safe start using ECC or should one stick with RSA for at least a few more years? ...
forest's user avatar
  • 67k
12 votes

PGP public key is visible

Public keys are intended to be published. The corresponding private key is the secure part that should not be published. The purpose of a public key is twofold: It is something anyone can use to ...
Ezekiel's user avatar
  • 223

Only top scored, non community-wiki answers of a minimum length are eligible