Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux > #39203 > unrolled thread

Marek Novotny GnuPG

Back to article view | Back to alt.os.linux

Contents

  Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 00:00 +0000
    Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-25 17:32 -0700
      Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 01:04 +0000
      Re: Marek Novotny GnuPG The Letter Q <babbaquimby@teachers.org> - 2016-09-26 11:12 -0400
    Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 03:56 +0200
    Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 10:53 +0000
      Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 05:10 -0700
        Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 05:22 -0700
          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 05:45 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 10:10 -0700
              Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 10:54 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 11:27 -0700
              Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-27 18:40 +0000
              Re: Marek Novotny GnuPG Bit Twister <BitTwister@mouse-potato.com> - 2016-09-27 18:41 +0000
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 12:06 -0700
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 10:14 -0700
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 10:38 -0700
              Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 11:44 -0700
                Re: Marek Novotny GnuPG Melzzzzz <Melzzzzz@zzzzz.com> - 2016-09-27 19:00 +0000
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 12:20 -0700
                    Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-28 00:04 +0200
                      Re: Marek Novotny GnuPG Richard Kettlewell <invalid@invalid.invalid> - 2016-09-27 23:21 +0100
                        Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 15:35 -0700
                        Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-28 00:44 +0200
                          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 15:58 -0700
              Re: Marek Novotny GnuPG "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2016-09-27 19:24 -0400
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 01:06 -0700
                  Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 10:38 +0000
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 11:21 -0700
              Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 10:31 +0000
                Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 11:24 +0000
                  Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-28 16:08 +0200
                    Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 19:55 +0000
                      Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 13:11 -0700
                        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 22:04 +0000
                          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 16:11 -0700
          Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:27 +0000
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 06:59 -0700
        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:25 +0000
      Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 15:26 +0200
        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:33 +0000
          Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 15:40 +0200
            Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:48 +0000
        Re: Marek Novotny GnuPG Richard Kettlewell <invalid@invalid.invalid> - 2016-09-26 14:39 +0100
          Re: Marek Novotny GnuPG Snit <usenet@gallopinginsanity.com> - 2016-09-26 07:00 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 07:26 -0700
              Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 14:53 +0000
              Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 14:59 +0000
                Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 15:01 +0000
              Re: Marek Novotny GnuPG Snit <usenet@gallopinginsanity.com> - 2016-09-26 07:34 -0700
                Re: Marek Novotny GnuPG Peter Köhlmann <peter-koehlmann@t-online.de> - 2016-09-26 18:24 +0200
                  Re: Marek Novotny GnuPG Snit <usenet@gallopinginsanity.com> - 2016-09-26 09:30 -0700
          Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 16:31 +0200
            Re: Marek Novotny GnuPG Richard Kettlewell <invalid@invalid.invalid> - 2016-09-26 15:59 +0100
              Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 19:45 +0200
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 14:29 -0700
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 14:37 -0700
                    Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 15:17 -0700
                      Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 23:27 +0000
          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 15:00 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 15:34 -0700
              Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-27 15:58 +0200
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 07:11 -0700
      Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 14:14 +0000
        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 14:57 +0000
          Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 15:09 +0000
            Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 15:14 +0000
            Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 15:18 +0000

Page 3 of 4 — ← Prev page 1 2 [3] 4  Next page →

#39226

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Carlos E.R. wrote:
> On 2016-09-26 12:53, Dan Purgert wrote:
>
>> Nice, have thought about seeking it out off and on myself.  Seems like
>> now's as good a time as any to enable it.  (Here's hoping it pulls the
>> right key, so I don't look like a moron).
>
> You have to upload it to one keyserver.
>
> cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281
> gpg: requesting key 1279A281 from hkp server pgp.mit.edu
> gpgkeys: key 8E11DDF31279A281 not found on keyserver
> gpg: no valid OpenPGP data found.
> gpg: Total number processed: 0
> cer@Telcontar:~>
>
> Till you do, we can not check it.
>

Odd, since it should've already been out there as of writing that
message. Oh well, it's there now.

- -- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJX6SNDAAoJEI4R3fMSeaKBPOsH/1KpVyfCDhVRQWTczKUkVFbo
EUTJ7TsNgeje6TEjrchfdGUJ1/tt4aXWBhXCoxNQXS0spfN6RuG8jet+KpWzqz0W
UKzdOnqf/UOAzS698DDiKHqaJ8pT76SPxryu9u6pvfQzOuooYubmNAAvpQy0OK3x
8PoQCECApZl/xQYh1GxMkjr7d96D8HY8kzrGd1nKWp0gMhKbsbKuoMaVnVqgm6X1
SaNi+EhutTr9EDRbkl0/C3VQLqRYB0/aipKKsG5NEd8k9cxheHeg7hHCpzy7SHQo
hJfUuJ/dKWO7IND9FluKth5ZWHCFb51Txmfx91DUqBJ/INh1EJPDQBLYqi720YM=
=l2fS
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#39229

On 2016-09-26 15:33, Dan Purgert wrote:
> Carlos E.R. wrote:
>> On 2016-09-26 12:53, Dan Purgert wrote:
> 
>>> Nice, have thought about seeking it out off and on myself.  Seems like
>>> now's as good a time as any to enable it.  (Here's hoping it pulls the
>>> right key, so I don't look like a moron).
> 
>> You have to upload it to one keyserver.
> 
>> cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281
>> gpg: requesting key 1279A281 from hkp server pgp.mit.edu
>> gpgkeys: key 8E11DDF31279A281 not found on keyserver
>> gpg: no valid OpenPGP data found.
>> gpg: Total number processed: 0
>> cer@Telcontar:~>
> 
>> Till you do, we can not check it.
> 
> 
> Odd, since it should've already been out there as of writing that
> message. Oh well, it's there now.

Yes, I tried a minute ago and got it :-)

This time via a menu in Thumbleweed I had not noticed. Automatic.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#39230

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Carlos E.R. wrote:
> On 2016-09-26 15:33, Dan Purgert wrote:
>> Carlos E.R. wrote:
>>> You have to upload it to one keyserver.
>>> Till you do, we can not check it.
>> 
>> 
>> Odd, since it should've already been out there as of writing that
>> message. Oh well, it's there now.
>
> Yes, I tried a minute ago and got it :-)
>
> This time via a menu in Thumbleweed I had not noticed. Automatic.
>
Perfect.  Seems the original upload errored when sending the key to
MIT.  Thanks for nothing, ISP.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJX6Sa9AAoJEI4R3fMSeaKBTYAH/iqQdYdqKMQf2h7gdeAgalAV
pQ/QLc18PpnPFzqLK2Zyz9bMgsiheWyadr6zPDgkQ7LY/zx5CHlD24mwnOMYJgxD
BR/lzVOGt7umrM8cmgt7YpoOy74MdKJx718ccMN/YUj8Lpa2KYaHkV1SIGibtra6
vdhTzarhu81I02XRuK3Gwe1A49v9uz9tPgzAdkkRcOs9FwktTueY85W6eYZsrqtz
IHaaPMZzRxg685tHDaV9xjZtdX28pztirgTNrilUOMnByHRpMUCEV8pweupbyamz
5JVY9/AIRstbnysc7Y9dVwhWuCUljBaQ5dmAPqSyFFiQsyQWgyafUNDCLD2IX5w=
=i29r
-----END PGP SIGNATURE-----

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39227

"Carlos E.R." <robin_listas@invalid.es> writes:
> On 2016-09-26 12:53, Dan Purgert wrote:
>> Nice, have thought about seeking it out off and on myself.  Seems like
>> now's as good a time as any to enable it.  (Here's hoping it pulls the
>> right key, so I don't look like a moron).
>
> You have to upload it to one keyserver.
>
> cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281

I very strongly recommend that you use the full keyid, in all contexts,
not the truncated 64-bit form.

Only 32-bit IDs have been publicly broken[1], but the 64-bit IDs look
disinctly fragile - a colleague recently estimated it would cost about
GBP250K using AWS, a figure that can be expected to fall with time (in
absolute terms; the GBP may lose value faster, given current policy
directions).

[1] “Broken” here means constructing an attacker-controlled private key
    that yields the same ID.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#39232

On 9/26/16, 6:39 AM, in article 87fuom93wk.fsf@LkoBDZeT.terraraq.uk,
"Richard Kettlewell" <invalid@invalid.invalid> wrote:

> "Carlos E.R." <robin_listas@invalid.es> writes:
>> On 2016-09-26 12:53, Dan Purgert wrote:
>>> Nice, have thought about seeking it out off and on myself.  Seems like
>>> now's as good a time as any to enable it.  (Here's hoping it pulls the
>>> right key, so I don't look like a moron).
>> 
>> You have to upload it to one keyserver.
>> 
>> cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281
> 
> I very strongly recommend that you use the full keyid, in all contexts,
> not the truncated 64-bit form.
> 
> Only 32-bit IDs have been publicly broken[1], but the 64-bit IDs look
> disinctly fragile - a colleague recently estimated it would cost about
> GBP250K using AWS, a figure that can be expected to fall with time (in
> absolute terms; the GBP may lose value faster, given current policy
> directions).
> 
> [1] ³Broken² here means constructing an attacker-controlled private key
>     that yields the same ID.

There is a trade-off here. A lot of messages here are going to be quite
short... is it worth having so much noise to message? I suppose it comes
down to how important one sees their message as being... and how much one
thinks someone is likely to work to forge them.

As it stands, it seems the forger can only do a piss-poor job and use Google
Groups... easy to see. I think the real focus here would be to reduce the
chance of someone getting confused between the two.


-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#39234

Snit wrote:
> As it stands, it seems the forger can only do a piss-poor job and use Google
> Groups... easy to see. I think the real focus here would be to reduce the
> chance of someone getting confused between the two.

I think the current signing activity is temporary for purposes of 
testing, as would be done in a group such as alt.security.pgp.  I 
believe that there is general agreement that clearsigning as an 
anti-sporgery tactic isn't the best solution, which solution depends on 
the particular 'situation' including the adversary.

In the case of Marek's messages, he is using a pay news server and a 
valid From, which combine to make his headers sufficiently unique to not 
be easily 'strongly' spoofed/forged.

Many people use a free news server and an invalid From email, making 
them more vulnerable to sporgery games, depending on the adversary.

Not only does clearsigning create baggage/clutter, but the current 
technique also messes up/ affects/ the sig delimiter.

-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39238

On 2016-09-26, Mike Easter <MikeE@ster.invalid> wrote:
> Snit wrote:
>> As it stands, it seems the forger can only do a piss-poor job and use Google
>> Groups... easy to see. I think the real focus here would be to reduce the
>> chance of someone getting confused between the two.
>
> I think the current signing activity is temporary for purposes of 
> testing, as would be done in a group such as alt.security.pgp.  I 
> believe that there is general agreement that clearsigning as an 
> anti-sporgery tactic isn't the best solution, which solution depends on 
> the particular 'situation' including the adversary.
>
> In the case of Marek's messages, he is using a pay news server and a 
> valid From, which combine to make his headers sufficiently unique to not 
> be easily 'strongly' spoofed/forged.
>
> Many people use a free news server and an invalid From email, making 
> them more vulnerable to sporgery games, depending on the adversary.
>
> Not only does clearsigning create baggage/clutter, but the current 
> technique also messes up/ affects/ the sig delimiter.

I also do not plan on signing every message. Here, Only in cases where
what I am saying I want the user to be able to verify it. Like when
saying that I am being forged. That particular post would be signed.
Other conversation need not be. 

As I said from the start, I don't think a lot of people verify anyway.
And the signature is unwanted baggage in a place like this. Still it is
interesting to learn GnuPG. I started learning a few of the commands and
can now import IDs via the command-line, so I no longer feel it is
needed to post a link to the public key. I have a more secure
Thunderbird email client as a result.

I watched Snowden over the weekend. After watching that, I'm glad I
don't have cameras in every laptop bezel and perhaps a little more
encryption here and there is not a bad thing anyway. 

very slight spoiler on Snowden beyond this so stop here if you don't want
to read that....



There is a part where Snowden needs to gain a little dirt on someone and
he visits someone who creates intel he might be able to use. Snowden
wants to leave the room while the guy creates this intel but the guy
says, you see the end result anyway, shouldn't matter if you see how I
gather it. 

So they take the guys name, and pop it into a search app which draws
connections between the target and people he's interacted with and
people those people have interacted with. That alone reaches about 2.5
million people. 

One of then is in her apartment and they just pop her laptop camera on,
which does not activate the laptop camera light and start to record her.
They then go into the daughter, who has a boyfriend who is 18, while she
is 15. And they discover that the boy and his family are illegals.
Bingo. Instant dirt. So the government takes action against those people
to leverage the daughter against the dad. 

And right there I felt like, everything I do is easily accessible. I am
sure it is powerful enough that whatever stupid things I do aren't
enough. 

-- 
Marek Novotny
https://github.com/marek-novotny

[toc] | [prev] | [next] | [standalone]

#39241

Mike Easter wrote:
> Snit wrote:
>> As it stands, it seems the forger can only do a piss-poor job and use Google
>> Groups... easy to see. I think the real focus here would be to reduce the
>> chance of someone getting confused between the two.
>
> I think the current signing activity is temporary for purposes of 
> testing, as would be done in a group such as alt.security.pgp.  I 
> believe that there is general agreement that clearsigning as an 
> anti-sporgery tactic isn't the best solution, which solution depends on 
> the particular 'situation' including the adversary.

Yeah, only time will tell.  Thing is, it's trivial to NOT sign as well
(although, since slrn hangs onto the key for 5 minutes, this'll probably
be signed).


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39242

Dan Purgert wrote:
> Mike Easter wrote:
>> Snit wrote:
>>> As it stands, it seems the forger can only do a piss-poor job and use Google
>>> Groups... easy to see. I think the real focus here would be to reduce the
>>> chance of someone getting confused between the two.
>>
>> I think the current signing activity is temporary for purposes of 
>> testing, as would be done in a group such as alt.security.pgp.  I 
>> believe that there is general agreement that clearsigning as an 
>> anti-sporgery tactic isn't the best solution, which solution depends on 
>> the particular 'situation' including the adversary.
>
> Yeah, only time will tell.  Thing is, it's trivial to NOT sign as well
> (although, since slrn hangs onto the key for 5 minutes, this'll probably
> be signed).

Ah, no, it's just that "yes" is the default option to the "send this
message signed?" enquiry that slrn makes when posting.

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39248

On 9/26/16, 7:26 AM, in article e4spfrFkap9U1@mid.individual.net, "Mike
Easter" <MikeE@ster.invalid> wrote:

> Snit wrote:
>> As it stands, it seems the forger can only do a piss-poor job and use Google
>> Groups... easy to see. I think the real focus here would be to reduce the
>> chance of someone getting confused between the two.
> 
> I think the current signing activity is temporary for purposes of
> testing, as would be done in a group such as alt.security.pgp.  I
> believe that there is general agreement that clearsigning as an
> anti-sporgery tactic isn't the best solution, which solution depends on
> the particular 'situation' including the adversary.
> 
> In the case of Marek's messages, he is using a pay news server and a
> valid From, which combine to make his headers sufficiently unique to not
> be easily 'strongly' spoofed/forged.
> 
> Many people use a free news server and an invalid From email, making
> them more vulnerable to sporgery games, depending on the adversary.
> 
> Not only does clearsigning create baggage/clutter, but the current
> technique also messes up/ affects/ the sig delimiter.

Makes sense. And I think in his case he is legitimately being forged (albeit
poorly) -- and I do get the desire to want to make it so people do not
confuse the two. If the "games" continue I will set my Usenet client to mark
the forger posts as read. I certainly do not agree with Marek on everything
but these stupid trolling game are just idiotic nonsense.


-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#39250

The lying imbecile Snit Michael Glasser babbled:

> On 9/26/16, 7:26 AM, in article e4spfrFkap9U1@mid.individual.net, "Mike
> Easter" <MikeE@ster.invalid> wrote:
> 
>> Snit wrote:
>>> As it stands, it seems the forger can only do a piss-poor job and use
>>> Google Groups... easy to see. I think the real focus here would be to
>>> reduce the chance of someone getting confused between the two.
>> 
>> I think the current signing activity is temporary for purposes of
>> testing, as would be done in a group such as alt.security.pgp.  I
>> believe that there is general agreement that clearsigning as an
>> anti-sporgery tactic isn't the best solution, which solution depends on
>> the particular 'situation' including the adversary.
>> 
>> In the case of Marek's messages, he is using a pay news server and a
>> valid From, which combine to make his headers sufficiently unique to not
>> be easily 'strongly' spoofed/forged.
>> 
>> Many people use a free news server and an invalid From email, making
>> them more vulnerable to sporgery games, depending on the adversary.
>> 
>> Not only does clearsigning create baggage/clutter, but the current
>> technique also messes up/ affects/ the sig delimiter.
> 
> Makes sense. And I think in his case he is legitimately being forged
> (albeit poorly) -- and I do get the desire to want to make it so people do
> not confuse the two. If the "games" continue I will set my Usenet client
> to mark the forger posts as read. I certainly do not agree with Marek on
> everything but these stupid trolling game are just idiotic nonsense.
> 
> 
Lets not forget that it was *you* who did the forging.

Do you really think people are as stupid as you need them to be?

[toc] | [prev] | [next] | [standalone]

#39251

On 9/26/16, 9:24 AM, in article nsbi3r$tb7$1@dont-email.me, "Peter Köhlmann"
<peter-koehlmann@t-online.de> wrote:

> The lying imbecile Snit Michael Glasser babbled:
> 
>> On 9/26/16, 7:26 AM, in article e4spfrFkap9U1@mid.individual.net, "Mike
>> Easter" <MikeE@ster.invalid> wrote:
>> 
>>> Snit wrote:
>>>> As it stands, it seems the forger can only do a piss-poor job and use
>>>> Google Groups... easy to see. I think the real focus here would be to
>>>> reduce the chance of someone getting confused between the two.
>>> 
>>> I think the current signing activity is temporary for purposes of
>>> testing, as would be done in a group such as alt.security.pgp.  I
>>> believe that there is general agreement that clearsigning as an
>>> anti-sporgery tactic isn't the best solution, which solution depends on
>>> the particular 'situation' including the adversary.
>>> 
>>> In the case of Marek's messages, he is using a pay news server and a
>>> valid From, which combine to make his headers sufficiently unique to not
>>> be easily 'strongly' spoofed/forged.
>>> 
>>> Many people use a free news server and an invalid From email, making
>>> them more vulnerable to sporgery games, depending on the adversary.
>>> 
>>> Not only does clearsigning create baggage/clutter, but the current
>>> technique also messes up/ affects/ the sig delimiter.
>> 
>> Makes sense. And I think in his case he is legitimately being forged
>> (albeit poorly) -- and I do get the desire to want to make it so people do
>> not confuse the two. If the "games" continue I will set my Usenet client
>> to mark the forger posts as read. I certainly do not agree with Marek on
>> everything but these stupid trolling game are just idiotic nonsense.
>> 
>> 
> Lets not forget that it was *you* who did the forging.
> 
> Do you really think people are as stupid as you need them to be?

<https://goo.gl/ZMXDjt>


-- 
* OS X / Linux: What is a file?     <http://youtu.be/_dMbXGLW9PI>
* Mint MATE Trash, Panel, Menu:     <http://youtu.be/C0y74FIf7uE>
* Mint KDE working with folders:    <http://youtu.be/7C9nvniOoE0>
* Mint KDE creating files:          <http://youtu.be/N7-fZJaJUv8>
* Mint KDE help:                    <http://youtu.be/3ikizUd3sa8>
* Mint KDE general navigation:      <http://youtu.be/t9y14yZtQuI>
* Mint KDE bugs or Easter eggs?     <http://youtu.be/CU-whJQvtfA>
* Easy on OS X / Hard on Linux:     <http://youtu.be/D3BPWANQoIk>
* OS / Word Processor Comparison:   <http://youtu.be/w6Qcl-w7s5c>

[toc] | [prev] | [next] | [standalone]

#39235

On 2016-09-26 15:39, Richard Kettlewell wrote:
> "Carlos E.R." <robin_listas@invalid.es> writes:


>> cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281
> 
> I very strongly recommend that you use the full keyid, in all contexts,
> not the truncated 64-bit form.

I use the one that enigmail tell me it is. I didn't look at the human
signature block.

> Only 32-bit IDs have been publicly broken[1], but the 64-bit IDs look
> disinctly fragile - a colleague recently estimated it would cost about
> GBP250K using AWS, a figure that can be expected to fall with time (in
> absolute terms; the GBP may lose value faster, given current policy
> directions).
> 
> [1] “Broken” here means constructing an attacker-controlled private key
>     that yields the same ID.

Mmmm.... :-/


Well, if I download the wrong key it would simply fail to verify.


-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#39240

"Carlos E.R." <robin_listas@invalid.es> writes:
> On 2016-09-26 15:39, Richard Kettlewell wrote:
>> "Carlos E.R." <robin_listas@invalid.es> writes:
>>> cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281
>> 
>> I very strongly recommend that you use the full keyid, in all contexts,
>> not the truncated 64-bit form.
>
> I use the one that enigmail tell me it is. I didn't look at the human
> signature block.

If Enigmail only gives you 64 bits then you must dig deeper.

>> Only 32-bit IDs have been publicly broken[1], but the 64-bit IDs look
>> disinctly fragile - a colleague recently estimated it would cost about
>> GBP250K using AWS, a figure that can be expected to fall with time (in
>> absolute terms; the GBP may lose value faster, given current policy
>> directions).
>> 
>> [1] “Broken” here means constructing an attacker-controlled private key
>>     that yields the same ID.
>
> Mmmm.... :-/
>
> Well, if I download the wrong key it would simply fail to verify.

It would fail to verify Marek’s messages.  It would verify a forger’s[1]
messages instead.

  [1] ...a hypothetical forger who was willing to spend a quarter of a
      million on the exercise, which isn’t very likely in this case; but
      if you’re not going to use security software correctly, then why
      on earth are you bothering to use it at all?

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#39253

On 2016-09-26 16:59, Richard Kettlewell wrote:
> "Carlos E.R." <robin_listas@invalid.es> writes:
>> On 2016-09-26 15:39, Richard Kettlewell wrote:
>>> "Carlos E.R." <robin_listas@invalid.es> writes:
>>>> cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281
>>>
>>> I very strongly recommend that you use the full keyid, in all contexts,
>>> not the truncated 64-bit form.
>>
>> I use the one that enigmail tell me it is. I didn't look at the human
>> signature block.
> 
> If Enigmail only gives you 64 bits then you must dig deeper.

I don't see how.


>> Well, if I download the wrong key it would simply fail to verify.
> 
> It would fail to verify Marek’s messages.  It would verify a forger’s[1]
> messages instead.

The key server would then have two different keys with the same ID, so
it would probably warn about this when fetching, and I would see that it
downloaded two keys, or none.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#39256

Carlos E.R. wrote:
> Richard Kettlewell wrote:

>> If Enigmail only gives you 64 bits then you must dig deeper.
>
> I don't see how.

I haven't found a way to change the keyid-format (it can be none, short 
or long) in Enigmail yet, but I can do it with gpg2.

gpg2 --keyid-format long -k <keyname>

Normally -k name gives the short form keyid on my system, as it shows in 
enigmail.

I think there might be some kind of gpg.conf where the default 
keyid-format short can be changed to long, but I haven't found how to do 
that yet.


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39258

Mike Easter wrote:
> I haven't found a way to change the keyid-format (it can be none, short
> or long) in Enigmail yet, but I can do it with gpg2.

:-)  battle with enigmail developer; refuses to budge on this issue:

https://sourceforge.net/p/enigmail/forum/support/thread/b9c3d976/

Abbreviated Q:

(1) can OpenPGP be config'd to either respect the keyid-format in 
gpg.conf, or specifically be set to use it in TBird about:config or 
Enigmail prefs?

(2) can fingerprint (fpr=) be added?

(3) can the 'id' and 'fpr' be added as internal variables, e.g. to be 
able to specify


Abbreviated A:

Currently "no" to all questions.

-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39261

Mike Easter wrote:
> the keyid-format in gpg.conf

Apparently there is no such thing as gpg.conf by default, you make one 
if you need it; and naturally -help isn't nearly as robust as man gpg. 
So, from the man (reformatted):

--keyid-format short|0xshort|long|0xlong

Select how to  display  key  IDs.  "short"  is  the  traditional 
8-character key ID. "long" is the more accurate (but less convenient) 
16-character key ID. Add an "0x" to either to include  an "0x"  at  the 
beginning  of the key ID, as in 0x99242560.  Note that this option is 
ignored if the option --with-colons is used.


I was reading somewhere else that there was such a thing as 'none' which 
was unrelated to the keyid format per se in that it caused some kind of 
'pretty' fingerprint.  I have no idea what that meant.


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39263

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Mike Easter wrote:
> Mike Easter wrote:
>> the keyid-format in gpg.conf
>
> Apparently there is no such thing as gpg.conf by default, you make one 
> if you need it; and naturally -help isn't nearly as robust as man gpg. 
> So, from the man (reformatted):
>
> --keyid-format short|0xshort|long|0xlong
>
> Select how to  display  key  IDs.  "short"  is  the  traditional 
> 8-character key ID. "long" is the more accurate (but less convenient) 
> 16-character key ID. Add an "0x" to either to include  an "0x"  at  the 
> beginning  of the key ID, as in 0x99242560.  Note that this option is 
> ignored if the option --with-colons is used.
>
>
> I was reading somewhere else that there was such a thing as 'none' which 
> was unrelated to the keyid format per se in that it caused some kind of 
> 'pretty' fingerprint.  I have no idea what that meant.
>
>

If I'm thinking of the same thing, it's the same output as "gpg
- --list-keys --fingerprint", which results in the full fingerprint as ten
octet pairs, printed in two groups of four space-separated words which
are themselves separated by two spaces.   See the print in my signature
as an example.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX6a6MAAoJEI4R3fMSeaKBE+QIAKYbNoKOCX+hNm/6pI3203Br
Bxta68DMYOtoFjl0/S2/ji7DmBlV3brk5KfDQVq5BVS66T+31DOomIiyYOa8NjpA
DIlwR7TObTBFZ21EAvte4XzlUpVP96+5SDx9TFvuCC678wYOSuauNu8QVp0mIs59
az7ySVeLaZQvc1XbUpA5YKQ4N4ubORPj10lMRiNTEF4E5RsF9kh/YoQVV/AE8A3s
jOb4/o1XwcIbqJqqoGiZ3d0Cn8uzdIhtdgZ5bEHmPn82xcnGGK31QtrEJVL6auIb
s6LEglKvZX1j5ev84GU52xT1g6VK9TNMokgT4xgkvpFe6y4SYMbb7ToaMwgyB/g=
=J4u2
-----END PGP SIGNATURE-----

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39259

Richard Kettlewell wrote:
> I very strongly recommend that you use the full keyid, in all contexts,
> not the truncated 64-bit form.

Apparently this is somewhat of a religious war.  It would seem to me to 
be 'rational' to be able to at least VIEW (or print/copy/etc) the keyid 
either way.

Those who like the short form convenience point out that in most 
contexts, the issue of collisions isn't even afoot; the keyid being 
'reached for' is not a part of the gigantic world pool of keyid/s, but 
instead is being sought as an item in some small or local group.

I've always reached for a key at a keyserver with the long form, but I 
notice that when the keyserver fetches it up for me, the keyserver 
refers to the keyid in the short form - not the long.

I would say that the short form is practical but not perfect.  In a 
scenario in which 'specificity' (there is no other) is imperative, then 
it should be the long form.  In other scenarios, such as picking an 
enigmail key from a keyring, short suffices.

Personally, I think I should be able to 'get' somehow, the long form 
from enigmail by using one of its menus, but I can't.

-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

Page 3 of 4 — ← Prev page 1 2 [3] 4  Next page →

Back to top | Article view | alt.os.linux

csiph-web