Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.advocacy > #291171 > unrolled thread
| Started by | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| First post | 2015-04-23 11:40 -0700 |
| Last post | 2015-04-26 12:40 -0700 |
| Articles | 20 on this page of 77 — 7 participants |
Back to article view | Back to comp.os.linux.advocacy
OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 11:40 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 11:46 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Tomas <tgif9fri@numo.net> - 2015-04-23 15:12 -0400
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-23 12:23 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 12:59 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) vallor <vallor@cultnix.org> - 2015-04-23 15:49 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Tomas <tgif9fri@numo.net> - 2015-04-23 20:41 -0400
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 21:44 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) cc <scatnubbs@hotmail.com> - 2015-04-24 04:31 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-24 10:30 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-24 20:08 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-25 10:49 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-25 18:40 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-25 11:53 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-25 19:18 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-25 12:25 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 09:54 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 17:30 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 10:43 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 11:29 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 18:49 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 12:23 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 12:48 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 19:55 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 13:25 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 13:33 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 14:00 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 21:22 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 14:32 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 21:50 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:01 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:05 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:35 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 14:35 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 14:40 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:09 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 15:21 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:21 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:40 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:47 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:51 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:49 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:56 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 16:00 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 23:32 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 16:46 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 00:00 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 17:02 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 17:08 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 00:47 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 18:14 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 01:41 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 19:04 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 02:32 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 19:38 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 02:46 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 19:59 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 03:21 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:38 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:45 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 03:58 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 21:04 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 21:06 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) tmelmosfire <tmelmosfire@gmail.com> - 2015-04-26 21:12 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 04:20 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 03:55 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:57 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 04:02 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:59 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 04:04 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 19:01 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) tmelmosfire <tmelmosfire@gmail.com> - 2015-04-26 19:11 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 19:47 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 17:11 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) tmelmosfire <tmelmosfire@gmail.com> - 2015-04-26 20:06 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 20:47 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 12:40 -0700
Page 2 of 4 — ← Prev page 1 [2] 3 4 Next page →
| From | owl <owl@rooftop.invalid> |
|---|---|
| Date | 2015-04-26 18:49 +0000 |
| Message-ID | <hbvj83.gko8a2@rooftop.invalid> |
| In reply to | #291636 |
Steve Carroll <fretwizzer@gmail.com> wrote: > On Sunday, April 26, 2015 at 11:30:29 AM UTC-6, owl wrote: >> Steve Carroll <fretwizzer@gmail.com> wrote: >> > On Saturday, April 25, 2015 at 1:18:20 PM UTC-6, owl wrote: ... >> >> > ... >> >> He could just sign messages with his private key and put an end to this >> >> nonsense. >> >> > When Desk Rabbit suggested this awhile back I went and got the Mac version of PGP key but I see no way to 'sign' posts made via Google Groups. If a reader doesn't have the public key... >> >> Why wouldn't the reader have the public key? > Who would bother? I've never done it for usenet. Why would you bother? You sure seem to be bothered about "forgeries." Isn't that enough reason to bother signing your messages and making your public key available? >> That's what it's for. Make >> it public. Put it on the web and link to it in the message itself if >> necessary. >> >> > https://groups.google.com/forum/#!original/comp.os.linux.advocacy/vDNdq6Aj6EQ/nQ3pffj7qu4J > That's not from GoogleGroups and it's probably using a newsreader app. Inferior as it may be to a dedicated app, I've gotten used to it now and, being browser based, it also works well on mobile. Have you tried posting a signed message through google? >> > ... that's what you get and it's useless. For those same readers, the gmail handle... >> >> How is that useless? Does it fail verification? > I have no idea. >> > i.e. 'fretwizzer' >> >> > or a "posting-account" number... >> >> > i.e. 'posting-account=qzPusQoAAADVdKNEKE-jqIVbecHp7oZ7' >> >> > ... in a header is the only way. Notable is Gluehead's ever present denial of reality stating: "if he were to do so and make it public that ONLY such comments were to be trusted it would be a good step forward." This is essentially what I've done when I alerted COLA about being hacked, what I've been doing all along by differentiating myself from the forgeries, I've made it "public that ONLY such comments were to be trusted" as coming from the one "posting-account". The reader can quickly see the 'fre twi >> zzer' handle and/or the 'Z7' at the end of the account number. If you can explain how to use the key on a post from Google Groups 'I'm all eyes' from a learning viewpoint... but being that most people probably aren't going to bother with the public key anyway, seems there isn't much point to it as it wouldn't really "put an end to this nonsense." >> >> Again, is google mangling messages so that they fail a signature check? > Dunno... I see no facility for signing it... if I could figure out how to do it I would. Try pasting a signed message into google groups compose window. >> Anybody who cared whether it was you or somebody else would need only >> to verify that the message was signed by you. People who would not care >> enough to be bothered with that don't care now either. > Agreed. Besides myself, take a look at the people who care... it's one person... and he's doing his usual and ridiculous hard sell attempt for those he believes are as stupid as he needs them to be. > It's possible there's a chrome extension that does it but I haven't seen any talk of it when searching; they do have one for email, though. Why do you need an extension or a facility for signing at google? Just compose a text message on your machine, sign it, and paste the signed message into google's compose window thingie. owl@thinkpad:~$ cat message a message from me owl@thinkpad:~$ gpg --output signed_message --clearsign message You need a passphrase to unlock the secret key for user: "owl (usenet) <owl@rooftop.invalid>" 2048-bit RSA key, ID D83A7ECF, created 2015-04-26 gpg: gpg-agent is not available in this session owl@thinkpad:~$ cat signed_message -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 a message from me -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= =P3mC -----END PGP SIGNATURE----- owl@thinkpad:~$ owl@thinkpad:~$ gpg --verify signed_message gpg: Signature made Sun 26 Apr 2015 02:34:53 PM EDT using RSA key ID D83A7ECF gpg: Good signature from "owl (usenet) <owl@rooftop.invalid>" owl@thinkpad:~$ Here's a public key: owl@thinkpad:~$ cat owl.asc -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.10 (GNU/Linux) mQENBFU9I9EBCACZI8NiUxzLlQUmkYgfhVseeDfAroM7PcH5ZN4mPBiWeVpyl7E3 XOpm1P1G15Ds6eGOmUn+QY+P7LzyOtUsXxtqBlqePzHlgM3pS5kAh0PBECWMP3zE 7wcPYFhYRCoGhWHpY9dkXoqgkAcqekI3Nr+TkVwKDCHlwUq3m/pXk3uon+s11qHV 2GzJss/tii41t8Hb+wuV2cH/niQakp9FTt5bZqqDcbddvhvnhMPPqU0p1VtIS8Bm BC/Pb7zlcSz2N2CJ6xEek66MnbzaEUm7EX2HabIh4jCiOmjZX1KxNaRQ1hz5AB6m QxqACxq8Sl6esntnU7yFUphK4Xp9W9ynNLz/ABEBAAG0VG93bCAoY29sYSkgKGhh ZCB0byBoYXZlIGF0IGxlYXN0IDUgbGV0dGVycyBpbiByZWFsIG5hbWUgZmllbGQp IDxvd2xAcm9vZnRvcC5pbnZhbGlkPokBOAQTAQIAIgUCVT0j0QIbAwYLCQgHAwIG FQgCCQoLBBYCAwECHgECF4AACgkQRUaq8oUq46jSGAf/ef4UcyzcBQURZq60xa6q wKTVnMi1A9PhR/eirukY5Qdq6JXnVb39UtU6s0LCmQVQxYytH78TBQUe4aob9HBc etcK95b3K1MMXN0yy8EMfLWLi46B+ZjXXlFjIIUPaBWw3ILd89Dc/zlA+njRguGn CcSu0xDnnlL24VPv4s9ECR7bSsds4Rkmy7KxGZKw5Y1nHh2wNmWbiBxDyYn7OQwZ mqZznd5XlgiZCodr5mJkSJteaZgDanWgIndSAk4VzAhp4LAaxy14buG4VWncjU9n cX15+bcBIhyntHmZU/Y2II6h6NVTgkOGwmxoUJg9NIcf+49utn4dRh/v20y3WX3a +LkBDQRVPSPRAQgAwKLsAjuRq70bgrV0mu7BwqUK/9W2dv/FZBk4BJtAr0uxo2Rr GgP5TXa3zZ6fy+LE9Lipu96cQFKTL22kGP/jIkabwLxtSBjqXaDIXF8fZpLtoY/T sWuvnsjtrzbBAlJd9H63FQ8IGDxL1U3VAavQeXWKQXVQ1C2sBWBSOFCMdCj4nQpA PUWUvCRX28fYbCr21vQXtL+3eC1a2FxeXFIfg67O9Q8TRhsmJagMLRSFwB3U6EH2 6tM8rOqAtaBGs12IxpvcFCpHrJPTqkX90fHAALKEmlJCHZ6E2I0UnugtOOOvQ02r y/55znm1eeOt5OEuzQVcc9G2Vj8Zu2YTlN8pUQARAQABiQEfBBgBAgAJBQJVPSPR AhsMAAoJEEVGqvKFKuOoacUIAJMhxkecGIU2FysUUS2LGshuuyGWCmlWFlIyF9iq jpZQyNNGeMpjN0fncUfc+3tl6KfyEcPN9IrouUpxjSst1ZzxbUL2seAzdBgO1BFo BJANIFQsIWZ6WB3Xh7ibGHYXYQNE4uD7jHGvQ8DMerTBQEtYho+h4HF2UjeVzWB6 lejNuoj3UHoGo3vtK74Q9dMvDDH6nkWl2R9tbZaN5Sok73+Ul+tvT2CXRtYo4Css 7UKFLISbNOV3jXvBitQBrIfI58nD9dgezXOfzlw+YLbDoULfA3bobKgv73oYVFRr Rzwo1FdGVQdwmKa+jw0stlvfzyPYGks6U6Voi+our9nzpFI= =JvsZ -----END PGP PUBLIC KEY BLOCK----- owl@thinkpad:~$
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 12:23 -0700 |
| Message-ID | <990eab8b-bae7-49b8-9cc3-0f23c1cd1bbb@googlegroups.com> |
| In reply to | #291638 |
On Sunday, April 26, 2015 at 12:49:41 PM UTC-6, owl wrote: > Steve Carroll <fretwizzer@gmail.com> wrote: > > On Sunday, April 26, 2015 at 11:30:29 AM UTC-6, owl wrote: > >> Steve Carroll <fretwizzer@gmail.com> wrote: > >> > On Saturday, April 25, 2015 at 1:18:20 PM UTC-6, owl wrote: > ... > > >> >> > ... > >> >> He could just sign messages with his private key and put an end to this > >> >> nonsense. > >> > >> > When Desk Rabbit suggested this awhile back I went and got the Mac version of PGP key but I see no way to 'sign' posts made via Google Groups. If a reader doesn't have the public key... > >> > >> Why wouldn't the reader have the public key? > > > Who would bother? I've never done it for usenet. > > Why would you bother? Whether or not I will remains to be seen. It depends on how much of a hassle it is. BTW, thanks for helping with this. > You sure seem to be bothered about "forgeries." To the extent that I'd like to differentiate myself from them, obviously... but I'm not changing how I read usenet at this point to do it. > Isn't that enough reason to bother signing your messages and making > your public key available? If I can without too much hassle, I will. > >> That's what it's for. Make > >> it public. Put it on the web and link to it in the message itself if > >> necessary. > >> > >> > https://groups.google.com/forum/#!original/comp.os.linux.advocacy/vDNdq6Aj6EQ/nQ3pffj7qu4J > > > That's not from GoogleGroups and it's probably using a newsreader app. Inferior as it may be to a dedicated app, I've gotten used to it now and, being browser based, it also works well on mobile. > > > Have you tried posting a signed message through google? I have no idea how. > >> > ... that's what you get and it's useless. For those same readers, the gmail handle... > >> > >> How is that useless? Does it fail verification? > > > I have no idea. > > >> > i.e. 'fretwizzer' > >> > >> > or a "posting-account" number... > >> > >> > i.e. 'posting-account=qzPusQoAAADVdKNEKE-jqIVbecHp7oZ7' > >> > >> > ... in a header is the only way. Notable is Gluehead's ever present denial of reality stating: "if he were to do so and make it public that ONLY such comments were to be trusted it would be a good step forward." This is essentially what I've done when I alerted COLA about being hacked, what I've been doing all along by differentiating myself from the forgeries, I've made it "public that ONLY such comments were to be trusted" as coming from the one "posting-account". The reader can quickly see the 'fre > twi > >> zzer' handle and/or the 'Z7' at the end of the account number. If you can explain how to use the key on a post from Google Groups 'I'm all eyes' from a learning viewpoint... but being that most people probably aren't going to bother with the public key anyway, seems there isn't much point to it as it wouldn't really "put an end to this nonsense." > >> > >> Again, is google mangling messages so that they fail a signature check? > > > Dunno... I see no facility for signing it... if I could figure out how to do it I would. > > Try pasting a signed message into google groups compose window. > > > >> Anybody who cared whether it was you or somebody else would need only > >> to verify that the message was signed by you. People who would not care > >> enough to be bothered with that don't care now either. > > > Agreed. Besides myself, take a look at the people who care... it's one person... and he's doing his usual and ridiculous hard sell attempt for those he believes are as stupid as he needs them to be. > > > It's possible there's a chrome extension that does it but I haven't seen any talk of it when searching; they do have one for email, though. > > Why do you need an extension or a facility for signing at google? > Just compose a text message on your machine, sign it, and paste the > signed message into google's compose window thingie. How do I sign it (I've never used this)? > owl@thinkpad:~$ cat message > a message from me > > owl@thinkpad:~$ gpg --output signed_message --clearsign message > > You need a passphrase to unlock the secret key for > user: "owl (usenet) <owl@rooftop.invalid>" > 2048-bit RSA key, ID D83A7ECF, created 2015-04-26 > > gpg: gpg-agent is not available in this session > owl@thinkpad:~$ cat signed_message > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > a message from me > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (GNU/Linux) > > iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY > 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV > TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J > vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS > UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ > 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= > =P3mC > -----END PGP SIGNATURE----- > owl@thinkpad:~$ > > owl@thinkpad:~$ gpg --verify signed_message > gpg: Signature made Sun 26 Apr 2015 02:34:53 PM EDT using RSA key ID D83A7ECF > gpg: Good signature from "owl (usenet) <owl@rooftop.invalid>" > owl@thinkpad:~$ > > Here's a public key: > > owl@thinkpad:~$ cat owl.asc > -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: GnuPG v1.4.10 (GNU/Linux) > > mQENBFU9I9EBCACZI8NiUxzLlQUmkYgfhVseeDfAroM7PcH5ZN4mPBiWeVpyl7E3 > XOpm1P1G15Ds6eGOmUn+QY+P7LzyOtUsXxtqBlqePzHlgM3pS5kAh0PBECWMP3zE > 7wcPYFhYRCoGhWHpY9dkXoqgkAcqekI3Nr+TkVwKDCHlwUq3m/pXk3uon+s11qHV > 2GzJss/tii41t8Hb+wuV2cH/niQakp9FTt5bZqqDcbddvhvnhMPPqU0p1VtIS8Bm > BC/Pb7zlcSz2N2CJ6xEek66MnbzaEUm7EX2HabIh4jCiOmjZX1KxNaRQ1hz5AB6m > QxqACxq8Sl6esntnU7yFUphK4Xp9W9ynNLz/ABEBAAG0VG93bCAoY29sYSkgKGhh > ZCB0byBoYXZlIGF0IGxlYXN0IDUgbGV0dGVycyBpbiByZWFsIG5hbWUgZmllbGQp > IDxvd2xAcm9vZnRvcC5pbnZhbGlkPokBOAQTAQIAIgUCVT0j0QIbAwYLCQgHAwIG > FQgCCQoLBBYCAwECHgECF4AACgkQRUaq8oUq46jSGAf/ef4UcyzcBQURZq60xa6q > wKTVnMi1A9PhR/eirukY5Qdq6JXnVb39UtU6s0LCmQVQxYytH78TBQUe4aob9HBc > etcK95b3K1MMXN0yy8EMfLWLi46B+ZjXXlFjIIUPaBWw3ILd89Dc/zlA+njRguGn > CcSu0xDnnlL24VPv4s9ECR7bSsds4Rkmy7KxGZKw5Y1nHh2wNmWbiBxDyYn7OQwZ > mqZznd5XlgiZCodr5mJkSJteaZgDanWgIndSAk4VzAhp4LAaxy14buG4VWncjU9n > cX15+bcBIhyntHmZU/Y2II6h6NVTgkOGwmxoUJg9NIcf+49utn4dRh/v20y3WX3a > +LkBDQRVPSPRAQgAwKLsAjuRq70bgrV0mu7BwqUK/9W2dv/FZBk4BJtAr0uxo2Rr > GgP5TXa3zZ6fy+LE9Lipu96cQFKTL22kGP/jIkabwLxtSBjqXaDIXF8fZpLtoY/T > sWuvnsjtrzbBAlJd9H63FQ8IGDxL1U3VAavQeXWKQXVQ1C2sBWBSOFCMdCj4nQpA > PUWUvCRX28fYbCr21vQXtL+3eC1a2FxeXFIfg67O9Q8TRhsmJagMLRSFwB3U6EH2 > 6tM8rOqAtaBGs12IxpvcFCpHrJPTqkX90fHAALKEmlJCHZ6E2I0UnugtOOOvQ02r > y/55znm1eeOt5OEuzQVcc9G2Vj8Zu2YTlN8pUQARAQABiQEfBBgBAgAJBQJVPSPR > AhsMAAoJEEVGqvKFKuOoacUIAJMhxkecGIU2FysUUS2LGshuuyGWCmlWFlIyF9iq > jpZQyNNGeMpjN0fncUfc+3tl6KfyEcPN9IrouUpxjSst1ZzxbUL2seAzdBgO1BFo > BJANIFQsIWZ6WB3Xh7ibGHYXYQNE4uD7jHGvQ8DMerTBQEtYho+h4HF2UjeVzWB6 > lejNuoj3UHoGo3vtK74Q9dMvDDH6nkWl2R9tbZaN5Sok73+Ul+tvT2CXRtYo4Css > 7UKFLISbNOV3jXvBitQBrIfI58nD9dgezXOfzlw+YLbDoULfA3bobKgv73oYVFRr > Rzwo1FdGVQdwmKa+jw0stlvfzyPYGks6U6Voi+our9nzpFI= > =JvsZ > -----END PGP PUBLIC KEY BLOCK----- > owl@thinkpad:~$ I've never used this so please bear with me. I took the part starting with: -----BEGIN PGP PUBLIC KEY BLOCK----- ... and ending with... -----END PGP PUBLIC KEY BLOCK----- ...and I pasted it into a text file. Then I did what I assumed was the next step (based on looking at one I generated) and I named the text file: D83A7ECF.asc I then imported it into my GPG keychain and I got an entry that read: Type: pub Name: owl(cola) Email: your email Date: today's date Key ID: A number that is presumably yours Validity: Shows 2 yellow bars (mine has 4 green bars). How do I verify that this is you who wrote this post by using this key? Why is the validity less on yours? Is it based on the stupid way I'm doing it? ;)
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 12:48 -0700 |
| Message-ID | <4ff7180f-a500-435b-9256-f7b3afbf8581@googlegroups.com> |
| In reply to | #291640 |
On Sunday, April 26, 2015 at 1:23:46 PM UTC-6, Steve Carroll wrote: (snip) > How do I verify that this is you who wrote this post by using this key? Why is the validity less on yours? Is it based on the stupid way I'm doing it? ;) One issue... I didn't have all the check boxes checked in my System prefs for encryption so I never had it available as a 'Service'.
[toc] | [prev] | [next] | [standalone]
| From | owl <owl@rooftop.invalid> |
|---|---|
| Date | 2015-04-26 19:55 +0000 |
| Message-ID | <bvjf93.ajfi2@rooftop.invalid> |
| In reply to | #291640 |
Steve Carroll <fretwizzer@gmail.com> wrote: > On Sunday, April 26, 2015 at 12:49:41 PM UTC-6, owl wrote: >> Steve Carroll <fretwizzer@gmail.com> wrote: >> > On Sunday, April 26, 2015 at 11:30:29 AM UTC-6, owl wrote: >> >> Steve Carroll <fretwizzer@gmail.com> wrote: >> >> > On Saturday, April 25, 2015 at 1:18:20 PM UTC-6, owl wrote: >> ... >> >> >> >> > ... >> >> >> He could just sign messages with his private key and put an end to this >> >> >> nonsense. >> >> >> >> > When Desk Rabbit suggested this awhile back I went and got the Mac version of PGP key but I see no way to 'sign' posts made via Google Groups. If a reader doesn't have the public key... >> >> >> >> Why wouldn't the reader have the public key? >> >> > Who would bother? I've never done it for usenet. >> >> Why would you bother? > Whether or not I will remains to be seen. It depends on how much of a hassle it is. BTW, thanks for helping with this. >> You sure seem to be bothered about "forgeries." > To the extent that I'd like to differentiate myself from them, obviously... but I'm not changing how I read usenet at this point to do it. >> Isn't that enough reason to bother signing your messages and making >> your public key available? > If I can without too much hassle, I will. >> >> That's what it's for. Make >> >> it public. Put it on the web and link to it in the message itself if >> >> necessary. >> >> >> >> > https://groups.google.com/forum/#!original/comp.os.linux.advocacy/vDNdq6Aj6EQ/nQ3pffj7qu4J >> >> > That's not from GoogleGroups and it's probably using a newsreader app. Inferior as it may be to a dedicated app, I've gotten used to it now and, being browser based, it also works well on mobile. >> >> >> Have you tried posting a signed message through google? > I have no idea how. >> >> > ... that's what you get and it's useless. For those same readers, the gmail handle... >> >> >> >> How is that useless? Does it fail verification? >> >> > I have no idea. >> >> >> > i.e. 'fretwizzer' >> >> >> >> > or a "posting-account" number... >> >> >> >> > i.e. 'posting-account=qzPusQoAAADVdKNEKE-jqIVbecHp7oZ7' >> >> >> >> > ... in a header is the only way. Notable is Gluehead's ever present denial of reality stating: "if he were to do so and make it public that ONLY such comments were to be trusted it would be a good step forward." This is essentially what I've done when I alerted COLA about being hacked, what I've been doing all along by differentiating myself from the forgeries, I've made it "public that ONLY such comments were to be trusted" as coming from the one "posting-account". The reader can quickly see the ' fre >> twi >> >> zzer' handle and/or the 'Z7' at the end of the account number. If you can explain how to use the key on a post from Google Groups 'I'm all eyes' from a learning viewpoint... but being that most people probably aren't going to bother with the public key anyway, seems there isn't much point to it as it wouldn't really "put an end to this nonsense." >> >> >> >> Again, is google mangling messages so that they fail a signature check? >> >> > Dunno... I see no facility for signing it... if I could figure out how to do it I would. >> >> Try pasting a signed message into google groups compose window. >> >> >> >> Anybody who cared whether it was you or somebody else would need only >> >> to verify that the message was signed by you. People who would not care >> >> enough to be bothered with that don't care now either. >> >> > Agreed. Besides myself, take a look at the people who care... it's one person... and he's doing his usual and ridiculous hard sell attempt for those he believes are as stupid as he needs them to be. >> >> > It's possible there's a chrome extension that does it but I haven't seen any talk of it when searching; they do have one for email, though. >> >> Why do you need an extension or a facility for signing at google? >> Just compose a text message on your machine, sign it, and paste the >> signed message into google's compose window thingie. > How do I sign it (I've never used this)? Compose a message as a text file, or if replying to a message, include the parts you are replying to (with delimiters of course - you may have to add these yourself). Assuming filename "message.txt": gpg --output signed_message.txt --clearsign message.txt Then you can paste the contents of "signed_message.txt" into google's input window. Google may or may not mangle it, so this could fail. Try reposting my signed message through google and we'll see what happens to it. >> owl@thinkpad:~$ cat message >> a message from me >> >> owl@thinkpad:~$ gpg --output signed_message --clearsign message >> >> You need a passphrase to unlock the secret key for >> user: "owl (usenet) <owl@rooftop.invalid>" >> 2048-bit RSA key, ID D83A7ECF, created 2015-04-26 >> >> gpg: gpg-agent is not available in this session >> owl@thinkpad:~$ cat signed_message >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> a message from me >> >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG v1.4.10 (GNU/Linux) >> >> iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY >> 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV >> TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J >> vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS >> UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ >> 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= >> =P3mC >> -----END PGP SIGNATURE----- >> owl@thinkpad:~$ >> >> owl@thinkpad:~$ gpg --verify signed_message >> gpg: Signature made Sun 26 Apr 2015 02:34:53 PM EDT using RSA key ID D83A7ECF >> gpg: Good signature from "owl (usenet) <owl@rooftop.invalid>" >> owl@thinkpad:~$ >> >> Here's a public key: >> >> owl@thinkpad:~$ cat owl.asc >> -----BEGIN PGP PUBLIC KEY BLOCK----- >> Version: GnuPG v1.4.10 (GNU/Linux) >> >> mQENBFU9I9EBCACZI8NiUxzLlQUmkYgfhVseeDfAroM7PcH5ZN4mPBiWeVpyl7E3 >> XOpm1P1G15Ds6eGOmUn+QY+P7LzyOtUsXxtqBlqePzHlgM3pS5kAh0PBECWMP3zE >> 7wcPYFhYRCoGhWHpY9dkXoqgkAcqekI3Nr+TkVwKDCHlwUq3m/pXk3uon+s11qHV >> 2GzJss/tii41t8Hb+wuV2cH/niQakp9FTt5bZqqDcbddvhvnhMPPqU0p1VtIS8Bm >> BC/Pb7zlcSz2N2CJ6xEek66MnbzaEUm7EX2HabIh4jCiOmjZX1KxNaRQ1hz5AB6m >> QxqACxq8Sl6esntnU7yFUphK4Xp9W9ynNLz/ABEBAAG0VG93bCAoY29sYSkgKGhh >> ZCB0byBoYXZlIGF0IGxlYXN0IDUgbGV0dGVycyBpbiByZWFsIG5hbWUgZmllbGQp >> IDxvd2xAcm9vZnRvcC5pbnZhbGlkPokBOAQTAQIAIgUCVT0j0QIbAwYLCQgHAwIG >> FQgCCQoLBBYCAwECHgECF4AACgkQRUaq8oUq46jSGAf/ef4UcyzcBQURZq60xa6q >> wKTVnMi1A9PhR/eirukY5Qdq6JXnVb39UtU6s0LCmQVQxYytH78TBQUe4aob9HBc >> etcK95b3K1MMXN0yy8EMfLWLi46B+ZjXXlFjIIUPaBWw3ILd89Dc/zlA+njRguGn >> CcSu0xDnnlL24VPv4s9ECR7bSsds4Rkmy7KxGZKw5Y1nHh2wNmWbiBxDyYn7OQwZ >> mqZznd5XlgiZCodr5mJkSJteaZgDanWgIndSAk4VzAhp4LAaxy14buG4VWncjU9n >> cX15+bcBIhyntHmZU/Y2II6h6NVTgkOGwmxoUJg9NIcf+49utn4dRh/v20y3WX3a >> +LkBDQRVPSPRAQgAwKLsAjuRq70bgrV0mu7BwqUK/9W2dv/FZBk4BJtAr0uxo2Rr >> GgP5TXa3zZ6fy+LE9Lipu96cQFKTL22kGP/jIkabwLxtSBjqXaDIXF8fZpLtoY/T >> sWuvnsjtrzbBAlJd9H63FQ8IGDxL1U3VAavQeXWKQXVQ1C2sBWBSOFCMdCj4nQpA >> PUWUvCRX28fYbCr21vQXtL+3eC1a2FxeXFIfg67O9Q8TRhsmJagMLRSFwB3U6EH2 >> 6tM8rOqAtaBGs12IxpvcFCpHrJPTqkX90fHAALKEmlJCHZ6E2I0UnugtOOOvQ02r >> y/55znm1eeOt5OEuzQVcc9G2Vj8Zu2YTlN8pUQARAQABiQEfBBgBAgAJBQJVPSPR >> AhsMAAoJEEVGqvKFKuOoacUIAJMhxkecGIU2FysUUS2LGshuuyGWCmlWFlIyF9iq >> jpZQyNNGeMpjN0fncUfc+3tl6KfyEcPN9IrouUpxjSst1ZzxbUL2seAzdBgO1BFo >> BJANIFQsIWZ6WB3Xh7ibGHYXYQNE4uD7jHGvQ8DMerTBQEtYho+h4HF2UjeVzWB6 >> lejNuoj3UHoGo3vtK74Q9dMvDDH6nkWl2R9tbZaN5Sok73+Ul+tvT2CXRtYo4Css >> 7UKFLISbNOV3jXvBitQBrIfI58nD9dgezXOfzlw+YLbDoULfA3bobKgv73oYVFRr >> Rzwo1FdGVQdwmKa+jw0stlvfzyPYGks6U6Voi+our9nzpFI= >> =JvsZ >> -----END PGP PUBLIC KEY BLOCK----- >> owl@thinkpad:~$ > I've never used this so please bear with me. I took the part starting with: > -----BEGIN PGP PUBLIC KEY BLOCK----- > ... and ending with... > -----END PGP PUBLIC KEY BLOCK----- > ...and I pasted it into a text file. Then I did what I assumed was the next step (based on looking at one I generated) and I named the text file: > D83A7ECF.asc > I then imported it into my GPG keychain and I got an entry that read: > > Type: pub > Name: owl(cola) Did you add the "cola" part? I had a key with "owl (cola)", but generated a new one as "owl (usenet)" which I thought was the one I posted. > Email: your email > Date: today's date > Key ID: A number that is presumably yours > Validity: Shows 2 yellow bars (mine has 4 green bars). > How do I verify that this is you who wrote this post by using this key? Copy the following from my post: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 a message from me -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= =P3mC -----END PGP SIGNATURE----- Save it as whatever.txt then $ gpg --verify whatever.txt > Why is the validity less on yours? Is it based on the stupid way I'm doing it? ;) You can set the trust level: https://www.gnupg.org/gph/en/manual/x334.html
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 13:25 -0700 |
| Message-ID | <7d4e03c8-0145-49a1-880e-602579bc3813@googlegroups.com> |
| In reply to | #291643 |
On Sunday, April 26, 2015 at 1:55:16 PM UTC-6, owl wrote: (snip) > > How do I sign it (I've never used this)? > > Compose a message as a text file, or if replying to a message, > include the parts you are replying to (with delimiters of course - > you may have to add these yourself). Assuming filename "message.txt": > > gpg --output signed_message.txt --clearsign message.txt > > Then you can paste the contents of "signed_message.txt" into > google's input window. Google may or may not mangle it, so this > could fail. Try reposting my signed message through google and > we'll see what happens to it. Here are the contents: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 This is a signing test. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= =WB15 -----END PGP SIGNATURE----- How do I make sure I give out my public key and not my private key? Is it the one that has headers/footers like yours? Ex: -----BEGIN PGP PUBLIC KEY BLOCK----- -----END PGP PUBLIC KEY BLOCK----- I 'exported it and it has those (with all the text) in a .asc file. > >> owl@thinkpad:~$ cat message > >> a message from me > >> > >> owl@thinkpad:~$ gpg --output signed_message --clearsign message > >> > >> You need a passphrase to unlock the secret key for > >> user: "owl (usenet) <owl@rooftop.invalid>" > >> 2048-bit RSA key, ID D83A7ECF, created 2015-04-26 > >> > >> gpg: gpg-agent is not available in this session > >> owl@thinkpad:~$ cat signed_message > >> -----BEGIN PGP SIGNED MESSAGE----- > >> Hash: SHA1 > >> > >> a message from me > >> > >> -----BEGIN PGP SIGNATURE----- > >> Version: GnuPG v1.4.10 (GNU/Linux) > >> > >> iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY > >> 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV > >> TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J > >> vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS > >> UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ > >> 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= > >> =P3mC > >> -----END PGP SIGNATURE----- > >> owl@thinkpad:~$ > >> > >> owl@thinkpad:~$ gpg --verify signed_message > >> gpg: Signature made Sun 26 Apr 2015 02:34:53 PM EDT using RSA key ID D83A7ECF > >> gpg: Good signature from "owl (usenet) <owl@rooftop.invalid>" > >> owl@thinkpad:~$ > >> > >> Here's a public key: > >> > >> owl@thinkpad:~$ cat owl.asc > >> -----BEGIN PGP PUBLIC KEY BLOCK----- > >> Version: GnuPG v1.4.10 (GNU/Linux) > >> > >> mQENBFU9I9EBCACZI8NiUxzLlQUmkYgfhVseeDfAroM7PcH5ZN4mPBiWeVpyl7E3 > >> XOpm1P1G15Ds6eGOmUn+QY+P7LzyOtUsXxtqBlqePzHlgM3pS5kAh0PBECWMP3zE > >> 7wcPYFhYRCoGhWHpY9dkXoqgkAcqekI3Nr+TkVwKDCHlwUq3m/pXk3uon+s11qHV > >> 2GzJss/tii41t8Hb+wuV2cH/niQakp9FTt5bZqqDcbddvhvnhMPPqU0p1VtIS8Bm > >> BC/Pb7zlcSz2N2CJ6xEek66MnbzaEUm7EX2HabIh4jCiOmjZX1KxNaRQ1hz5AB6m > >> QxqACxq8Sl6esntnU7yFUphK4Xp9W9ynNLz/ABEBAAG0VG93bCAoY29sYSkgKGhh > >> ZCB0byBoYXZlIGF0IGxlYXN0IDUgbGV0dGVycyBpbiByZWFsIG5hbWUgZmllbGQp > >> IDxvd2xAcm9vZnRvcC5pbnZhbGlkPokBOAQTAQIAIgUCVT0j0QIbAwYLCQgHAwIG > >> FQgCCQoLBBYCAwECHgECF4AACgkQRUaq8oUq46jSGAf/ef4UcyzcBQURZq60xa6q > >> wKTVnMi1A9PhR/eirukY5Qdq6JXnVb39UtU6s0LCmQVQxYytH78TBQUe4aob9HBc > >> etcK95b3K1MMXN0yy8EMfLWLi46B+ZjXXlFjIIUPaBWw3ILd89Dc/zlA+njRguGn > >> CcSu0xDnnlL24VPv4s9ECR7bSsds4Rkmy7KxGZKw5Y1nHh2wNmWbiBxDyYn7OQwZ > >> mqZznd5XlgiZCodr5mJkSJteaZgDanWgIndSAk4VzAhp4LAaxy14buG4VWncjU9n > >> cX15+bcBIhyntHmZU/Y2II6h6NVTgkOGwmxoUJg9NIcf+49utn4dRh/v20y3WX3a > >> +LkBDQRVPSPRAQgAwKLsAjuRq70bgrV0mu7BwqUK/9W2dv/FZBk4BJtAr0uxo2Rr > >> GgP5TXa3zZ6fy+LE9Lipu96cQFKTL22kGP/jIkabwLxtSBjqXaDIXF8fZpLtoY/T > >> sWuvnsjtrzbBAlJd9H63FQ8IGDxL1U3VAavQeXWKQXVQ1C2sBWBSOFCMdCj4nQpA > >> PUWUvCRX28fYbCr21vQXtL+3eC1a2FxeXFIfg67O9Q8TRhsmJagMLRSFwB3U6EH2 > >> 6tM8rOqAtaBGs12IxpvcFCpHrJPTqkX90fHAALKEmlJCHZ6E2I0UnugtOOOvQ02r > >> y/55znm1eeOt5OEuzQVcc9G2Vj8Zu2YTlN8pUQARAQABiQEfBBgBAgAJBQJVPSPR > >> AhsMAAoJEEVGqvKFKuOoacUIAJMhxkecGIU2FysUUS2LGshuuyGWCmlWFlIyF9iq > >> jpZQyNNGeMpjN0fncUfc+3tl6KfyEcPN9IrouUpxjSst1ZzxbUL2seAzdBgO1BFo > >> BJANIFQsIWZ6WB3Xh7ibGHYXYQNE4uD7jHGvQ8DMerTBQEtYho+h4HF2UjeVzWB6 > >> lejNuoj3UHoGo3vtK74Q9dMvDDH6nkWl2R9tbZaN5Sok73+Ul+tvT2CXRtYo4Css > >> 7UKFLISbNOV3jXvBitQBrIfI58nD9dgezXOfzlw+YLbDoULfA3bobKgv73oYVFRr > >> Rzwo1FdGVQdwmKa+jw0stlvfzyPYGks6U6Voi+our9nzpFI= > >> =JvsZ > >> -----END PGP PUBLIC KEY BLOCK----- > >> owl@thinkpad:~$ > > > I've never used this so please bear with me. I took the part starting with: > > > -----BEGIN PGP PUBLIC KEY BLOCK----- > > > ... and ending with... > > > -----END PGP PUBLIC KEY BLOCK----- > > > ...and I pasted it into a text file. Then I did what I assumed was the next step (based on looking at one I generated) and I named the text file: > > > D83A7ECF.asc > > > I then imported it into my GPG keychain and I got an entry that read: > > > > Type: pub > > Name: owl(cola) > > Did you add the "cola" part? > I had a key with "owl (cola)", but generated a new one as "owl (usenet)" > which I thought was the one I posted. > > > Email: your email > > Date: today's date > > Key ID: A number that is presumably yours > > Validity: Shows 2 yellow bars (mine has 4 green bars). > > > How do I verify that this is you who wrote this post by using this key? > > Copy the following from my post: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > a message from me > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (GNU/Linux) > > iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY > 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV > TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J > vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS > UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ > 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= > =P3mC > -----END PGP SIGNATURE----- > > Save it as whatever.txt > then > $ gpg --verify whatever.txt It reads: "Verification failed Unexpected GPG signature status 9" BTW, above, you asked: "Did you add the "cola" part? " I didn't add anything, that is what showed up. > > Why is the validity less on yours? Is it based on the stupid way I'm doing it? ;) > > You can set the trust level: > https://www.gnupg.org/gph/en/manual/x334.html
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 13:33 -0700 |
| Message-ID | <9e3c361e-cfa9-4a48-b53c-df8f8ed66966@googlegroups.com> |
| In reply to | #291646 |
On Sunday, April 26, 2015 at 2:25:19 PM UTC-6, Steve Carroll wrote: > On Sunday, April 26, 2015 at 1:55:16 PM UTC-6, owl wrote: > > (snip) > > > > How do I sign it (I've never used this)? > > > > Compose a message as a text file, or if replying to a message, > > include the parts you are replying to (with delimiters of course - > > you may have to add these yourself). Assuming filename "message.txt": > > > > gpg --output signed_message.txt --clearsign message.txt > > > > Then you can paste the contents of "signed_message.txt" into > > google's input window. Google may or may not mangle it, so this > > could fail. Try reposting my signed message through google and > > we'll see what happens to it. > > Here are the contents: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > This is a signing test. > -----BEGIN PGP SIGNATURE----- > Comment: GPGTools - https://gpgtools.org > > iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D > c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC > 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG > F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG > 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi > +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= > =WB15 > -----END PGP SIGNATURE----- > > How do I make sure I give out my public key and not my private key? Is it the one that has headers/footers like yours? Ex: > > -----BEGIN PGP PUBLIC KEY BLOCK----- > > -----END PGP PUBLIC KEY BLOCK----- > > I 'exported it and it has those (with all the text) in a .asc file. > > > >> owl@thinkpad:~$ cat message > > >> a message from me > > >> > > >> owl@thinkpad:~$ gpg --output signed_message --clearsign message > > >> > > >> You need a passphrase to unlock the secret key for > > >> user: "owl (usenet) <owl@rooftop.invalid>" > > >> 2048-bit RSA key, ID D83A7ECF, created 2015-04-26 > > >> > > >> gpg: gpg-agent is not available in this session > > >> owl@thinkpad:~$ cat signed_message > > >> -----BEGIN PGP SIGNED MESSAGE----- > > >> Hash: SHA1 > > >> > > >> a message from me > > >> > > >> -----BEGIN PGP SIGNATURE----- > > >> Version: GnuPG v1.4.10 (GNU/Linux) > > >> > > >> iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY > > >> 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV > > >> TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J > > >> vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS > > >> UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ > > >> 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= > > >> =P3mC > > >> -----END PGP SIGNATURE----- > > >> owl@thinkpad:~$ > > >> > > >> owl@thinkpad:~$ gpg --verify signed_message > > >> gpg: Signature made Sun 26 Apr 2015 02:34:53 PM EDT using RSA key ID D83A7ECF > > >> gpg: Good signature from "owl (usenet) <owl@rooftop.invalid>" > > >> owl@thinkpad:~$ > > >> > > >> Here's a public key: > > >> > > >> owl@thinkpad:~$ cat owl.asc > > >> -----BEGIN PGP PUBLIC KEY BLOCK----- > > >> Version: GnuPG v1.4.10 (GNU/Linux) > > >> > > >> mQENBFU9I9EBCACZI8NiUxzLlQUmkYgfhVseeDfAroM7PcH5ZN4mPBiWeVpyl7E3 > > >> XOpm1P1G15Ds6eGOmUn+QY+P7LzyOtUsXxtqBlqePzHlgM3pS5kAh0PBECWMP3zE > > >> 7wcPYFhYRCoGhWHpY9dkXoqgkAcqekI3Nr+TkVwKDCHlwUq3m/pXk3uon+s11qHV > > >> 2GzJss/tii41t8Hb+wuV2cH/niQakp9FTt5bZqqDcbddvhvnhMPPqU0p1VtIS8Bm > > >> BC/Pb7zlcSz2N2CJ6xEek66MnbzaEUm7EX2HabIh4jCiOmjZX1KxNaRQ1hz5AB6m > > >> QxqACxq8Sl6esntnU7yFUphK4Xp9W9ynNLz/ABEBAAG0VG93bCAoY29sYSkgKGhh > > >> ZCB0byBoYXZlIGF0IGxlYXN0IDUgbGV0dGVycyBpbiByZWFsIG5hbWUgZmllbGQp > > >> IDxvd2xAcm9vZnRvcC5pbnZhbGlkPokBOAQTAQIAIgUCVT0j0QIbAwYLCQgHAwIG > > >> FQgCCQoLBBYCAwECHgECF4AACgkQRUaq8oUq46jSGAf/ef4UcyzcBQURZq60xa6q > > >> wKTVnMi1A9PhR/eirukY5Qdq6JXnVb39UtU6s0LCmQVQxYytH78TBQUe4aob9HBc > > >> etcK95b3K1MMXN0yy8EMfLWLi46B+ZjXXlFjIIUPaBWw3ILd89Dc/zlA+njRguGn > > >> CcSu0xDnnlL24VPv4s9ECR7bSsds4Rkmy7KxGZKw5Y1nHh2wNmWbiBxDyYn7OQwZ > > >> mqZznd5XlgiZCodr5mJkSJteaZgDanWgIndSAk4VzAhp4LAaxy14buG4VWncjU9n > > >> cX15+bcBIhyntHmZU/Y2II6h6NVTgkOGwmxoUJg9NIcf+49utn4dRh/v20y3WX3a > > >> +LkBDQRVPSPRAQgAwKLsAjuRq70bgrV0mu7BwqUK/9W2dv/FZBk4BJtAr0uxo2Rr > > >> GgP5TXa3zZ6fy+LE9Lipu96cQFKTL22kGP/jIkabwLxtSBjqXaDIXF8fZpLtoY/T > > >> sWuvnsjtrzbBAlJd9H63FQ8IGDxL1U3VAavQeXWKQXVQ1C2sBWBSOFCMdCj4nQpA > > >> PUWUvCRX28fYbCr21vQXtL+3eC1a2FxeXFIfg67O9Q8TRhsmJagMLRSFwB3U6EH2 > > >> 6tM8rOqAtaBGs12IxpvcFCpHrJPTqkX90fHAALKEmlJCHZ6E2I0UnugtOOOvQ02r > > >> y/55znm1eeOt5OEuzQVcc9G2Vj8Zu2YTlN8pUQARAQABiQEfBBgBAgAJBQJVPSPR > > >> AhsMAAoJEEVGqvKFKuOoacUIAJMhxkecGIU2FysUUS2LGshuuyGWCmlWFlIyF9iq > > >> jpZQyNNGeMpjN0fncUfc+3tl6KfyEcPN9IrouUpxjSst1ZzxbUL2seAzdBgO1BFo > > >> BJANIFQsIWZ6WB3Xh7ibGHYXYQNE4uD7jHGvQ8DMerTBQEtYho+h4HF2UjeVzWB6 > > >> lejNuoj3UHoGo3vtK74Q9dMvDDH6nkWl2R9tbZaN5Sok73+Ul+tvT2CXRtYo4Css > > >> 7UKFLISbNOV3jXvBitQBrIfI58nD9dgezXOfzlw+YLbDoULfA3bobKgv73oYVFRr > > >> Rzwo1FdGVQdwmKa+jw0stlvfzyPYGks6U6Voi+our9nzpFI= > > >> =JvsZ > > >> -----END PGP PUBLIC KEY BLOCK----- > > >> owl@thinkpad:~$ > > > > > I've never used this so please bear with me. I took the part starting with: > > > > > -----BEGIN PGP PUBLIC KEY BLOCK----- > > > > > ... and ending with... > > > > > -----END PGP PUBLIC KEY BLOCK----- > > > > > ...and I pasted it into a text file. Then I did what I assumed was the next step (based on looking at one I generated) and I named the text file: > > > > > D83A7ECF.asc > > > > > I then imported it into my GPG keychain and I got an entry that read: > > > > > > Type: pub > > > Name: owl(cola) > > > > Did you add the "cola" part? > > I had a key with "owl (cola)", but generated a new one as "owl (usenet)" > > which I thought was the one I posted. > > > > > Email: your email > > > Date: today's date > > > Key ID: A number that is presumably yours > > > Validity: Shows 2 yellow bars (mine has 4 green bars). > > > > > How do I verify that this is you who wrote this post by using this key? > > > > Copy the following from my post: > > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > a message from me > > > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.10 (GNU/Linux) > > > > iQEcBAEBAgAGBQJVPS/NAAoJEAJKDhzYOn7PMC8H/1Mu7Pa9zmW/pAKhO9KFivCY > > 4r+DSaFoQMlcb4BHhtnQdB2waKQH9SWe6WLmhsvhVAsoFs6w/qCaGo9tqHYbm8WV > > TOk7nPLJMDiH9jnHCDsuFPnrWm2vQn/r7c7dwlvXv9YGFgm0plfdw1qRg/5+Tl9J > > vWiwct3/oFm63dUL7KxmNm/9X5+rI/elwrkm4D70vrMd9J/eBuhe8ULBkLBWqzDS > > UJhbcHVJoCPHz5AkIMdXnIBJLO56Lx0xrwg5zHLBsBlFLnOHZUCPD9b1OTNkHuJ/ > > 6+hqEUpAfhzF4ytly7mfp9aihvU/cY8+aORXjvOBkuGEfs61oGPcO5DwKw6owtM= > > =P3mC > > -----END PGP SIGNATURE----- > > > > Save it as whatever.txt > > then > > $ gpg --verify whatever.txt > > It reads: > > "Verification failed > Unexpected GPG signature status 9" > > BTW, above, you asked: "Did you add the "cola" part? " > > I didn't add anything, that is what showed up. > > > > Why is the validity less on yours? Is it based on the stupid way I'm doing it? ;) > > > > You can set the trust level: > > https://www.gnupg.org/gph/en/manual/x334.html Public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Comment: GPGTools - https://gpgtools.org mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0OlN0ZXZlIENhcnJvbGwg KERvIHlvdSBoZWFyIG1lIG5vdz8pIDxmcmV0d2l6emVyQGdtYWlsLmNvbT6JAT0E EwEKACcCGwMFCQeGH4AFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlUQMucACgkQ otOEfl7UHitcWgf/cfHQJGmQK8bH/jRjjvVbqBySSF9XkGmUCugzMTkUB1N87BfJ oG6BjTb5YxVKNgddEZWQ/9poI+8FXewge/VBa2kHAfokxoEBox2tB2Bq4y2jYgNF viH5tQdDHv2jEfCRBdapHTBZ7oJRExcUYYKS2V8LlY76Dj7jggrV1lb3dLhSgMLN /386cPkyMKMIBRFnFZoQI5gy71Qj3FeRteCvCQBb6ynLr5tQzXErLuqN7j4ZoEyP mYITv/rcNLLxovK/ekpgG7krMihbgw+mezHaBmsSz9VZDitF5lIGv5vpesJ0ZmbX LFbFAPJ0j9TvPLVmm+nSDDnymikfbzhOXJbz+rQyU3RldmUgQ2Fycm9sbCAoR1BH IHNpZ25pbmcpIDxmcmV0d2l6emVyQGdtYWlsLmNvbT6JAUAEEwEKACoCGwMFCQeG H4AFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlUQMucCGQEACgkQotOEfl7UHite mwf+O1D4yk91ur+pRH5qGVsjVQiquEaei50hYvo4GpGfb5+2L7HF6aE1v0jUfHOB knhkwc1T2CQtZWDs6wiw1vT2omlQscQInZUtPH3fA4wBXnuSgfcTbCc7u0OuYugJ /Hktu4geDpAWGxhX5dwsfw6VxU9nCSvBQ0p3ycvugc9bJNM7W8V1FP4Y1FewE3AV Fz10z3byrtWvUNgY+aV6RIJJcw3ql29Z5DuWpurQpT6uVk+QDSjUEoR1PsCfRNNE EEoy17xvMNarEgxsyKpclPwKsf5bbugqrVTFG3oLDK21jrY5xrZTMCTPgrRwIT+p qpDT0LRQW7eL7vPMcaPPtW0/VLkBDQRVEC3JAQgAyYJd1plPTFpsHjVHVHeSUfz+ rvRRy6myedUeg8P7bpsqtCe9IXn3CTG2VHsaQYT/Nbp6QQbaupfkDYNLlRr0HtcE tsLT1WE02d1qa0G/c5VGSfyDF/GQ0nbdqB+BypYHAhbNW9Ioy4qj8mfUDRnJxaSP Jmpqk9ZPTmVk9Ay2xNamOq2xXKSdQQ9noLjJSbVlIMWZ5TjcAycBbjwezKc12Oip kLvQ29Uc2+SScfW2HbwzsEkD/++C+leWzC4avbrUJLX5gMPzmAQC6PIB2YPdhV8S YtqqjcLfRqpDMU85IWHr9LY1A4+Kww2azXyBXK7qEi6JICuXYU3RNNEqZwudQQAR AQABiQElBBgBCgAPBQJVEC3JAhsMBQkHhh+AAAoJEKLThH5e1B4rqssIAITP/koe otDUPLtQjayp/g7k5IyjOR1Hx3+N+q87wgmXWZ/GBmhYALWs9xihq0VQUFLbez7T JDmBBG9QSIwhag7iIQW4Me1LCOQ/+IVpxBk8TgxtQNRKqTiGZReIN3nagSPw+1dM gcE1fEbxENszbcaLSWCOYvgSkRGwndxBDUmfEjKD4CpNroF+KKJ1Bn5KyeTWIjyP GB+JQUbbG1U7JeU9YTmg4Vf7bkH9/ej1IGaTzM2jMa/AnYTOvL75EEUzi/0C5OZ8 3CrjCHDjU7ZDg56fzlmVWLDB+98w1ypM/8AJQG2BsT0Gw8vDANPE8i+wHDLqUJE5 hHtfdcEnvHryGoU= =oKhl -----END PGP PUBLIC KEY BLOCK-----
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 14:00 -0700 |
| Message-ID | <3660c025-c74d-469a-beb2-ddf1ec305a41@googlegroups.com> |
| In reply to | #291649 |
On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: (snip) I just tested it in the browser, I highlighted this... -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 This is a signing test. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= =WB15 -----END PGP SIGNATURE----- ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this: * I create a key pair and share the public half of it * I write a message and 'sign' it (like I just quoted) * The end user grabs my public key (one time) and stores it in his GPG keychain * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system). I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)?
[toc] | [prev] | [next] | [standalone]
| From | owl <owl@rooftop.invalid> |
|---|---|
| Date | 2015-04-26 21:22 +0000 |
| Message-ID | <bbnvyc83.kajg@rooftop.invalid> |
| In reply to | #291651 |
Steve Carroll <fretwizzer@gmail.com> wrote:
> On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote:
> (snip)
> I just tested it in the browser, I highlighted this...
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> This is a signing test.
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - https://gpgtools.org
> iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D
> c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC
> 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG
> F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG
> 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi
> +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg=
> =WB15
> -----END PGP SIGNATURE-----
> ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this:
> * I create a key pair and share the public half of it
> * I write a message and 'sign' it (like I just quoted)
> * The end user grabs my public key (one time) and stores it in his GPG keychain
> * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system).
> I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)?
The trust level, you get other people who trust your key to sign your
key. If you get someone's pubkey and a lot of people you know have
signed it, then you can give it more trust.
I signed your pubkey. Below is the signed version. Anybody
importing that one will see that I have signed it, sort of like
vouching for this key.
owl@thinkpad:~$ gpg --edit-key fretwizzer
gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC
trust: full validity: full
sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E
[ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com>
[ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com>
Command> check
uid Steve Carroll (GPG signing) <fretwizzer@gmail.com>
sig!3 5ED41E2B 2015-03-23 [self-signature]
sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid>
uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com>
sig!3 5ED41E2B 2015-03-23 [self-signature]
sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid>
Command> quit
owl@thinkpad:~$
Your pubkey with my signature, showing that I vouch for the key:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.10 (GNU/Linux)
mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n
Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY
QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3
bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS
nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0
jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg
KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD
BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e
1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I
1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD
rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX
sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A
n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0
cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6
fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR
kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH
5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp
la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS
97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG
OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl
YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ
B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa
B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2
B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR
8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF
EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi
8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88
tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH
/icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat
fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1
0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K
JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd
7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg
4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70
UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC
09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq
apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7
0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa
qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA
AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ
1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5
gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB
NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf
iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq
4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7
X3XBJ7x68hqF
=VKJW
-----END PGP PUBLIC KEY BLOCK-----
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 14:32 -0700 |
| Message-ID | <6549e76a-477a-4f50-844d-1d963e204610@googlegroups.com> |
| In reply to | #291652 |
On Sunday, April 26, 2015 at 3:22:33 PM UTC-6, owl wrote: > Steve Carroll <fretwizzer@gmail.com> wrote: > > On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: > > > (snip) > > > I just tested it in the browser, I highlighted this... > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA512 > > > This is a signing test. > > -----BEGIN PGP SIGNATURE----- > > Comment: GPGTools - https://gpgtools.org > > > iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D > > c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC > > 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG > > F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG > > 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi > > +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= > > =WB15 > > -----END PGP SIGNATURE----- > > > ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this: > > > * I create a key pair and share the public half of it > > > * I write a message and 'sign' it (like I just quoted) > > > * The end user grabs my public key (one time) and stores it in his GPG keychain > > > * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system). > > > I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)? > > The trust level, you get other people who trust your key to sign your > key. If you get someone's pubkey and a lot of people you know have > signed it, then you can give it more trust. > > I signed your pubkey. Below is the signed version. Anybody > importing that one will see that I have signed it, sort of like > vouching for this key. > > owl@thinkpad:~$ gpg --edit-key fretwizzer > gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. > > > pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC > trust: full validity: full > sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E > [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> > [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > > Command> check > uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > sig!3 5ED41E2B 2015-03-23 [self-signature] > sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > sig!3 5ED41E2B 2015-03-23 [self-signature] > sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > Command> quit > owl@thinkpad:~$ > > Your pubkey with my signature, showing that I vouch for the key: > > -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: GnuPG v1.4.10 (GNU/Linux) > > mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n > Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY > QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 > bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS > nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 > jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg > KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD > BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e > 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I > 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD > rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX > sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A > n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 > cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 > fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR > kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH > 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp > la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS > 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG > OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl > YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ > B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa > B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 > B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR > 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF > EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi > 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 > tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH > /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat > fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 > 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K > JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd > 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg > 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 > UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC > 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq > apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 > 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa > qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA > AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ > 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 > gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB > NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf > iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq > 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 > X3XBJ7x68hqF > =VKJW > -----END PGP PUBLIC KEY BLOCK----- I updated both our keys but see no difference. Do I need to import this into my keychain? Or do I even get a visual that my key has been vouched for by another person? How do I vouch for yours?
[toc] | [prev] | [next] | [standalone]
| From | owl <owl@rooftop.invalid> |
|---|---|
| Date | 2015-04-26 21:50 +0000 |
| Message-ID | <bvy73.jaol3@rooftop.invalid> |
| In reply to | #291653 |
Steve Carroll <fretwizzer@gmail.com> wrote: > On Sunday, April 26, 2015 at 3:22:33 PM UTC-6, owl wrote: >> Steve Carroll <fretwizzer@gmail.com> wrote: >> > On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: >> >> > (snip) >> >> > I just tested it in the browser, I highlighted this... >> >> > -----BEGIN PGP SIGNED MESSAGE----- >> > Hash: SHA512 >> >> > This is a signing test. >> > -----BEGIN PGP SIGNATURE----- >> > Comment: GPGTools - https://gpgtools.org >> >> > iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D >> > c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC >> > 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG >> > F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG >> > 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi >> > +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= >> > =WB15 >> > -----END PGP SIGNATURE----- >> >> > ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this: >> >> > * I create a key pair and share the public half of it >> >> > * I write a message and 'sign' it (like I just quoted) >> >> > * The end user grabs my public key (one time) and stores it in his GPG keychain >> >> > * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system). >> >> > I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)? >> >> The trust level, you get other people who trust your key to sign your >> key. If you get someone's pubkey and a lot of people you know have >> signed it, then you can give it more trust. >> >> I signed your pubkey. Below is the signed version. Anybody >> importing that one will see that I have signed it, sort of like >> vouching for this key. >> >> owl@thinkpad:~$ gpg --edit-key fretwizzer >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. >> This is free software: you are free to change and redistribute it. >> There is NO WARRANTY, to the extent permitted by law. >> >> >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC >> trust: full validity: full >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> >> Command> check >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> >> Command> quit >> owl@thinkpad:~$ >> >> Your pubkey with my signature, showing that I vouch for the key: >> >> -----BEGIN PGP PUBLIC KEY BLOCK----- >> Version: GnuPG v1.4.10 (GNU/Linux) >> >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 >> X3XBJ7x68hqF >> =VKJW >> -----END PGP PUBLIC KEY BLOCK----- > I updated both our keys but see no difference. Do I need to import this into my keychain? Yes. Well, you don't *need* to. Only if you want your pubkey to show that I have signed it and vouch for it, which doesn't really matter, since i'm just a usenet nym :) and in real life that won't carry much weight. But at least for posts in cola anyone importing that key will see that I have signed it. Other regulars could sign it as well, giving it more weight. But that's all irrelevant to anyone who already has and trusts your original pubkey. It will function properly for verifying your signature. > Or do I even get a visual that my key has been vouched for by another person? How do I vouch for yours? To see that I have signed your key, import the signed pubkey above. Then run: gpg --edit-key fretwizzer At the "Command>" prompt, type "check" That will show my signature on your key. as above, where I ran check on your key after signing it: >> Command> check >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> To sign my key, run: gpg --edit-key owl then at the Command> prompt, type "sign" you can also type "trust" at the Command prompt and set a trust level that you have for my key. Type "quit" to exit gpg.
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 15:01 -0700 |
| Message-ID | <532bf8bd-8b65-4d53-938f-4287ebacf6fd@googlegroups.com> |
| In reply to | #291656 |
On Sunday, April 26, 2015 at 3:50:14 PM UTC-6, owl wrote: > Steve Carroll <fretwizzer@gmail.com> wrote: > > On Sunday, April 26, 2015 at 3:22:33 PM UTC-6, owl wrote: > >> Steve Carroll <fretwizzer@gmail.com> wrote: > >> > On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: > >> > >> > (snip) > >> > >> > I just tested it in the browser, I highlighted this... > >> > >> > -----BEGIN PGP SIGNED MESSAGE----- > >> > Hash: SHA512 > >> > >> > This is a signing test. > >> > -----BEGIN PGP SIGNATURE----- > >> > Comment: GPGTools - https://gpgtools.org > >> > >> > iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D > >> > c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC > >> > 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG > >> > F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG > >> > 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi > >> > +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= > >> > =WB15 > >> > -----END PGP SIGNATURE----- > >> > >> > ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this: > >> > >> > * I create a key pair and share the public half of it > >> > >> > * I write a message and 'sign' it (like I just quoted) > >> > >> > * The end user grabs my public key (one time) and stores it in his GPG keychain > >> > >> > * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system). > >> > >> > I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)? > >> > >> The trust level, you get other people who trust your key to sign your > >> key. If you get someone's pubkey and a lot of people you know have > >> signed it, then you can give it more trust. > >> > >> I signed your pubkey. Below is the signed version. Anybody > >> importing that one will see that I have signed it, sort of like > >> vouching for this key. > >> > >> owl@thinkpad:~$ gpg --edit-key fretwizzer > >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. > >> This is free software: you are free to change and redistribute it. > >> There is NO WARRANTY, to the extent permitted by law. > >> > >> > >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC > >> trust: full validity: full > >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E > >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> > >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > >> > >> Command> check > >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > >> > >> Command> quit > >> owl@thinkpad:~$ > >> > >> Your pubkey with my signature, showing that I vouch for the key: > >> > >> -----BEGIN PGP PUBLIC KEY BLOCK----- > >> Version: GnuPG v1.4.10 (GNU/Linux) > >> > >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n > >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY > >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 > >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS > >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 > >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg > >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD > >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e > >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I > >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD > >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX > >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A > >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 > >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 > >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR > >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH > >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp > >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS > >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG > >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl > >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ > >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa > >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 > >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR > >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF > >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi > >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 > >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH > >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat > >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 > >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K > >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd > >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg > >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 > >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC > >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq > >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 > >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa > >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA > >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ > >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 > >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB > >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf > >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq > >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 > >> X3XBJ7x68hqF > >> =VKJW > >> -----END PGP PUBLIC KEY BLOCK----- > > > I updated both our keys but see no difference. Do I need to import this into my keychain? > > Yes. Well, you don't *need* to. Only if you want your pubkey to show > that I have signed it and vouch for it, which doesn't really matter, since > i'm just a usenet nym :) and in real life that won't carry much weight. > But at least for posts in cola anyone importing that key will see that > I have signed it. Other regulars could sign it as well, giving it more > weight. But that's all irrelevant to anyone who already has and trusts > your original pubkey. It will function properly for verifying your > signature. > > > Or do I even get a visual that my key has been vouched for by another person? How do I vouch for yours? > > To see that I have signed your key, import the signed pubkey above. > Then run: > gpg --edit-key fretwizzer > > At the "Command>" prompt, type "check" > > That will show my signature on your key. > > as above, where I ran check on your key after signing it: > >> Command> check > >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > > To sign my key, run: > gpg --edit-key owl > > then at the Command> prompt, type "sign" > > you can also type "trust" at the Command prompt and set a trust level > that you have for my key. > > Type "quit" to exit gpg. I see your verification (in the CLI). I 'signed' yours using the GUI app. Unless I'm missing something, it seems weird that I can't see who has verified mine in the GUI app.
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 15:05 -0700 |
| Message-ID | <3a938e9c-bb6c-4be6-b7fe-01bfc3b97deb@googlegroups.com> |
| In reply to | #291658 |
On Sunday, April 26, 2015 at 4:01:49 PM UTC-6, Steve Carroll wrote: > On Sunday, April 26, 2015 at 3:50:14 PM UTC-6, owl wrote: > > Steve Carroll <fretwizzer@gmail.com> wrote: > > > On Sunday, April 26, 2015 at 3:22:33 PM UTC-6, owl wrote: > > >> Steve Carroll <fretwizzer@gmail.com> wrote: > > >> > On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: > > >> > > >> > (snip) > > >> > > >> > I just tested it in the browser, I highlighted this... > > >> > > >> > -----BEGIN PGP SIGNED MESSAGE----- > > >> > Hash: SHA512 > > >> > > >> > This is a signing test. > > >> > -----BEGIN PGP SIGNATURE----- > > >> > Comment: GPGTools - https://gpgtools.org > > >> > > >> > iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D > > >> > c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC > > >> > 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG > > >> > F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG > > >> > 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi > > >> > +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= > > >> > =WB15 > > >> > -----END PGP SIGNATURE----- > > >> > > >> > ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this: > > >> > > >> > * I create a key pair and share the public half of it > > >> > > >> > * I write a message and 'sign' it (like I just quoted) > > >> > > >> > * The end user grabs my public key (one time) and stores it in his GPG keychain > > >> > > >> > * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system). > > >> > > >> > I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)? > > >> > > >> The trust level, you get other people who trust your key to sign your > > >> key. If you get someone's pubkey and a lot of people you know have > > >> signed it, then you can give it more trust. > > >> > > >> I signed your pubkey. Below is the signed version. Anybody > > >> importing that one will see that I have signed it, sort of like > > >> vouching for this key. > > >> > > >> owl@thinkpad:~$ gpg --edit-key fretwizzer > > >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. > > >> This is free software: you are free to change and redistribute it. > > >> There is NO WARRANTY, to the extent permitted by law. > > >> > > >> > > >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC > > >> trust: full validity: full > > >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E > > >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> > > >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > > >> > > >> Command> check > > >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > >> > > >> Command> quit > > >> owl@thinkpad:~$ > > >> > > >> Your pubkey with my signature, showing that I vouch for the key: > > >> > > >> -----BEGIN PGP PUBLIC KEY BLOCK----- > > >> Version: GnuPG v1.4.10 (GNU/Linux) > > >> > > >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n > > >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY > > >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 > > >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS > > >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 > > >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg > > >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD > > >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e > > >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I > > >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD > > >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX > > >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A > > >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 > > >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 > > >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR > > >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH > > >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp > > >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS > > >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG > > >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl > > >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ > > >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa > > >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 > > >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR > > >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF > > >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi > > >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 > > >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH > > >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat > > >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 > > >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K > > >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd > > >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg > > >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 > > >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC > > >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq > > >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 > > >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa > > >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA > > >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ > > >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 > > >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB > > >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf > > >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq > > >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 > > >> X3XBJ7x68hqF > > >> =VKJW > > >> -----END PGP PUBLIC KEY BLOCK----- > > > > > I updated both our keys but see no difference. Do I need to import this into my keychain? > > > > Yes. Well, you don't *need* to. Only if you want your pubkey to show > > that I have signed it and vouch for it, which doesn't really matter, since > > i'm just a usenet nym :) and in real life that won't carry much weight. > > But at least for posts in cola anyone importing that key will see that > > I have signed it. Other regulars could sign it as well, giving it more > > weight. But that's all irrelevant to anyone who already has and trusts > > your original pubkey. It will function properly for verifying your > > signature. > > > > > Or do I even get a visual that my key has been vouched for by another person? How do I vouch for yours? > > > > To see that I have signed your key, import the signed pubkey above. > > Then run: > > gpg --edit-key fretwizzer > > > > At the "Command>" prompt, type "check" > > > > That will show my signature on your key. > > > > as above, where I ran check on your key after signing it: > > >> Command> check > > >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > > > > > To sign my key, run: > > gpg --edit-key owl > > > > then at the Command> prompt, type "sign" > > > > you can also type "trust" at the Command prompt and set a trust level > > that you have for my key. > > > > Type "quit" to exit gpg. > > I see your verification (in the CLI). I 'signed' yours using the GUI app. Unless I'm missing something, it seems weird that I can't see who has verified mine in the GUI app. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Scratch that, I think I see where it's showing it in the GUI. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVPWEwAAoJEKLThH5e1B4rVycH/11NSZcsMoAgmhLTd5bhcxsL SNEWUdqVXNEAz+ZwK1skue6LJNR3/QWd+FtOrg69Xm+SrJ/sEEXs2UmswH752Rti nE9hTqEvbgsIhQ3hXeLpgT69zck87fjjR2l2Dg4/FsakSJa/fa+adAtE/Eg2Ylk8 r6bK8GgaclOApizV9TYAwDiivXrtOHolNPcqCvDdC7jgFYdCfGeyNJ9lrqxK1qss 6F0rZ0670xQqxvuzIQYAHuJG2eC0makDJXrAtZORAgkbAH8lYx+oXKD+1c1gpGlN VxobRjAkqCiizsNOUl1SNscmUILvQ/0Re0fZmBK2/I/OsaVyY2rj74hlPbPibuo= =dqAu -----END PGP SIGNATURE-----
[toc] | [prev] | [next] | [standalone]
| From | owl <owl@rooftop.invalid> |
|---|---|
| Date | 2015-04-26 22:35 +0000 |
| Message-ID | <bvnhdu93.ap3ra@rooftop.invalid> |
| In reply to | #291659 |
Steve Carroll <fretwizzer@gmail.com> wrote: > On Sunday, April 26, 2015 at 4:01:49 PM UTC-6, Steve Carroll wrote: >> On Sunday, April 26, 2015 at 3:50:14 PM UTC-6, owl wrote: >> > Steve Carroll <fretwizzer@gmail.com> wrote: >> > > On Sunday, April 26, 2015 at 3:22:33 PM UTC-6, owl wrote: >> > >> Steve Carroll <fretwizzer@gmail.com> wrote: >> > >> > On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: >> > >> >> > >> > (snip) >> > >> >> > >> > I just tested it in the browser, I highlighted this... >> > >> >> > >> > -----BEGIN PGP SIGNED MESSAGE----- >> > >> > Hash: SHA512 >> > >> >> > >> > This is a signing test. >> > >> > -----BEGIN PGP SIGNATURE----- >> > >> > Comment: GPGTools - https://gpgtools.org >> > >> >> > >> > iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D >> > >> > c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC >> > >> > 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG >> > >> > F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG >> > >> > 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi >> > >> > +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= >> > >> > =WB15 >> > >> > -----END PGP SIGNATURE----- >> > >> >> > >> > ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this: >> > >> >> > >> > * I create a key pair and share the public half of it >> > >> >> > >> > * I write a message and 'sign' it (like I just quoted) >> > >> >> > >> > * The end user grabs my public key (one time) and stores it in his GPG keychain >> > >> >> > >> > * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system). >> > >> >> > >> > I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)? >> > >> >> > >> The trust level, you get other people who trust your key to sign your >> > >> key. If you get someone's pubkey and a lot of people you know have >> > >> signed it, then you can give it more trust. >> > >> >> > >> I signed your pubkey. Below is the signed version. Anybody >> > >> importing that one will see that I have signed it, sort of like >> > >> vouching for this key. >> > >> >> > >> owl@thinkpad:~$ gpg --edit-key fretwizzer >> > >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. >> > >> This is free software: you are free to change and redistribute it. >> > >> There is NO WARRANTY, to the extent permitted by law. >> > >> >> > >> >> > >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC >> > >> trust: full validity: full >> > >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E >> > >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> > >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> > >> >> > >> Command> check >> > >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> > >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> > >> >> > >> Command> quit >> > >> owl@thinkpad:~$ >> > >> >> > >> Your pubkey with my signature, showing that I vouch for the key: >> > >> >> > >> -----BEGIN PGP PUBLIC KEY BLOCK----- >> > >> Version: GnuPG v1.4.10 (GNU/Linux) >> > >> >> > >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n >> > >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY >> > >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 >> > >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS >> > >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 >> > >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg >> > >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD >> > >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e >> > >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I >> > >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD >> > >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX >> > >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A >> > >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 >> > >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 >> > >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR >> > >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH >> > >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp >> > >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS >> > >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG >> > >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl >> > >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ >> > >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa >> > >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 >> > >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR >> > >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF >> > >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi >> > >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 >> > >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH >> > >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat >> > >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 >> > >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K >> > >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd >> > >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg >> > >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 >> > >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC >> > >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq >> > >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 >> > >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa >> > >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA >> > >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ >> > >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 >> > >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB >> > >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf >> > >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq >> > >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 >> > >> X3XBJ7x68hqF >> > >> =VKJW >> > >> -----END PGP PUBLIC KEY BLOCK----- >> > >> > > I updated both our keys but see no difference. Do I need to import this into my keychain? >> > >> > Yes. Well, you don't *need* to. Only if you want your pubkey to show >> > that I have signed it and vouch for it, which doesn't really matter, since >> > i'm just a usenet nym :) and in real life that won't carry much weight. >> > But at least for posts in cola anyone importing that key will see that >> > I have signed it. Other regulars could sign it as well, giving it more >> > weight. But that's all irrelevant to anyone who already has and trusts >> > your original pubkey. It will function properly for verifying your >> > signature. >> > >> > > Or do I even get a visual that my key has been vouched for by another person? How do I vouch for yours? >> > >> > To see that I have signed your key, import the signed pubkey above. >> > Then run: >> > gpg --edit-key fretwizzer >> > >> > At the "Command>" prompt, type "check" >> > >> > That will show my signature on your key. >> > >> > as above, where I ran check on your key after signing it: >> > >> Command> check >> > >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> > >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> > >> > >> > To sign my key, run: >> > gpg --edit-key owl >> > >> > then at the Command> prompt, type "sign" >> > >> > you can also type "trust" at the Command prompt and set a trust level >> > that you have for my key. >> > >> > Type "quit" to exit gpg. >> >> I see your verification (in the CLI). I 'signed' yours using the GUI app. Unless I'm missing something, it seems weird that I can't see who has verified mine in the GUI app. > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > Scratch that, I think I see where it's showing it in the GUI. > -----BEGIN PGP SIGNATURE----- > Comment: GPGTools - https://gpgtools.org > iQEcBAEBCgAGBQJVPWEwAAoJEKLThH5e1B4rVycH/11NSZcsMoAgmhLTd5bhcxsL > SNEWUdqVXNEAz+ZwK1skue6LJNR3/QWd+FtOrg69Xm+SrJ/sEEXs2UmswH752Rti > nE9hTqEvbgsIhQ3hXeLpgT69zck87fjjR2l2Dg4/FsakSJa/fa+adAtE/Eg2Ylk8 > r6bK8GgaclOApizV9TYAwDiivXrtOHolNPcqCvDdC7jgFYdCfGeyNJ9lrqxK1qss > 6F0rZ0670xQqxvuzIQYAHuJG2eC0makDJXrAtZORAgkbAH8lYx+oXKD+1c1gpGlN > VxobRjAkqCiizsNOUl1SNscmUILvQ/0Re0fZmBK2/I/OsaVyY2rj74hlPbPibuo= > =dqAu > -----END PGP SIGNATURE----- Good signature: owl@thinkpad:~$ cat steve.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Scratch that, I think I see where it's showing it in the GUI. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVPWEwAAoJEKLThH5e1B4rVycH/11NSZcsMoAgmhLTd5bhcxsL SNEWUdqVXNEAz+ZwK1skue6LJNR3/QWd+FtOrg69Xm+SrJ/sEEXs2UmswH752Rti nE9hTqEvbgsIhQ3hXeLpgT69zck87fjjR2l2Dg4/FsakSJa/fa+adAtE/Eg2Ylk8 r6bK8GgaclOApizV9TYAwDiivXrtOHolNPcqCvDdC7jgFYdCfGeyNJ9lrqxK1qss 6F0rZ0670xQqxvuzIQYAHuJG2eC0makDJXrAtZORAgkbAH8lYx+oXKD+1c1gpGlN VxobRjAkqCiizsNOUl1SNscmUILvQ/0Re0fZmBK2/I/OsaVyY2rj74hlPbPibuo= =dqAu -----END PGP SIGNATURE----- owl@thinkpad:~$ gpg --verify steve.txt gpg: Signature made Sun 26 Apr 2015 06:05:36 PM EDT using RSA key ID 5ED41E2B gpg: Good signature from "Steve Carroll (GPG signing) <fretwizzer@gmail.com>" gpg: aka "Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com>" owl@thinkpad:~$
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 14:35 -0700 |
| Message-ID | <b9f60cbc-3aa4-450a-9583-6f37e51fafa6@googlegroups.com> |
| In reply to | #291652 |
On Sunday, April 26, 2015 at 3:22:33 PM UTC-6, owl wrote: > Steve Carroll <fretwizzer@gmail.com> wrote: > > On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: > > > (snip) > > > I just tested it in the browser, I highlighted this... > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA512 > > > This is a signing test. > > -----BEGIN PGP SIGNATURE----- > > Comment: GPGTools - https://gpgtools.org > > > iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D > > c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC > > 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG > > F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG > > 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi > > +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= > > =WB15 > > -----END PGP SIGNATURE----- > > > ... and I was able to 'verify' it was from me so it seems to be working (in other words, Google isn't munging it). So if this is working correctly... do I have the idea here with this: > > > * I create a key pair and share the public half of it > > > * I write a message and 'sign' it (like I just quoted) > > > * The end user grabs my public key (one time) and stores it in his GPG keychain > > > * When the end user sees a signed message by me he simply highlights it and can verify it instantly with a mouse click (or however it's done in their system). > > > I emailed myself a signed message and my mail app came back saying it was secure and from me. Seems like that's it, eh? Thanks, dude! I probably never would have gotten around to doing this if not for you, this is definitely a useful thing for a number of reasons. If you know, how secure is this? What's the "the trust level" bit? Is it based on me verifying it in the real world (like a phone call or something)? > > The trust level, you get other people who trust your key to sign your > key. If you get someone's pubkey and a lot of people you know have > signed it, then you can give it more trust. > > I signed your pubkey. Below is the signed version. Anybody > importing that one will see that I have signed it, sort of like > vouching for this key. > > owl@thinkpad:~$ gpg --edit-key fretwizzer > gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. > > > pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC > trust: full validity: full > sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E > [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> > [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > > Command> check > uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > sig!3 5ED41E2B 2015-03-23 [self-signature] > sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > sig!3 5ED41E2B 2015-03-23 [self-signature] > sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > Command> quit > owl@thinkpad:~$ > > Your pubkey with my signature, showing that I vouch for the key: > > -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: GnuPG v1.4.10 (GNU/Linux) > > mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n > Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY > QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 > bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS > nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 > jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg > KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD > BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e > 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I > 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD > rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX > sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A > n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 > cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 > fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR > kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH > 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp > la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS > 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG > OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl > YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ > B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa > B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 > B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR > 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF > EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi > 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 > tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH > /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat > fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 > 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K > JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd > 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg > 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 > UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC > 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq > apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 > 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa > qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA > AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ > 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 > gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB > NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf > iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq > 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 > X3XBJ7x68hqF > =VKJW > -----END PGP PUBLIC KEY BLOCK----- Disregard the question of how do I sign yours. I just did it, apparently. You're now all green... at least until tomorrow... I'm not sure you're the "real" owl ;)
[toc] | [prev] | [next] | [standalone]
| From | Snit <usenet@gallopinginsanity.com> |
|---|---|
| Date | 2015-04-26 14:40 -0700 |
| Message-ID | <D162A973.4ACF1%usenet@gallopinginsanity.com> |
| In reply to | #291652 |
On 4/26/15, 2:22 PM, in article bbnvyc83.kajg@rooftop.invalid, "owl" <owl@rooftop.invalid> wrote: > Steve Carroll <fretwizzer@gmail.com> wrote: >> On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: > >> (snip) > >> I just tested it in the browser, I highlighted this... > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA512 > >> This is a signing test. >> -----BEGIN PGP SIGNATURE----- >> Comment: GPGTools - https://gpgtools.org > >> iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D >> c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC >> 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG >> F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG >> 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi >> +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= >> =WB15 >> -----END PGP SIGNATURE----- > >> ... and I was able to 'verify' it was from me so it seems to be working (in >> other words, Google isn't munging it). So if this is working correctly... do >> I have the idea here with this: > >> * I create a key pair and share the public half of it > >> * I write a message and 'sign' it (like I just quoted) > >> * The end user grabs my public key (one time) and stores it in his GPG >> keychain > >> * When the end user sees a signed message by me he simply highlights it and >> can verify it instantly with a mouse click (or however it's done in their >> system). > >> I emailed myself a signed message and my mail app came back saying it was >> secure and from me. Seems like that's it, eh? Thanks, dude! I probably never >> would have gotten around to doing this if not for you, this is definitely a >> useful thing for a number of reasons. If you know, how secure is this? What's >> the "the trust level" bit? Is it based on me verifying it in the real world >> (like a phone call or something)? > > The trust level, you get other people who trust your key to sign your > key. If you get someone's pubkey and a lot of people you know have > signed it, then you can give it more trust. > > I signed your pubkey. Below is the signed version. Anybody > importing that one will see that I have signed it, sort of like > vouching for this key. > > owl@thinkpad:~$ gpg --edit-key fretwizzer > gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. > > > pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC > trust: full validity: full > sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E > [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> > [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > > Command> check > uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > sig!3 5ED41E2B 2015-03-23 [self-signature] > sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > sig!3 5ED41E2B 2015-03-23 [self-signature] > sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > > Command> quit > owl@thinkpad:~$ > > Your pubkey with my signature, showing that I vouch for the key: > > -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: GnuPG v1.4.10 (GNU/Linux) > > mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n > Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY > QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 > bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS > nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 > jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg > KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD > BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e > 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I > 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD > rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX > sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A > n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 > cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 > fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR > kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH > 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp > la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS > 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG > OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl > YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ > B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa > B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 > B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR > 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF > EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi > 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 > tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH > /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat > fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 > 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K > JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd > 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg > 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 > UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC > 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq > apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 > 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa > qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA > AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ > 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 > gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB > NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf > iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq > 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 > X3XBJ7x68hqF > =VKJW > -----END PGP PUBLIC KEY BLOCK----- > > Funny to see Carroll begging to get help so he can be trusted. :) In all seriousness, if he actually is willing to do this it would be great. It would end his nonsense about saying his past posts were "hacked"... if they were the key would fail. Then again, given how hacking his past posts is not possible anyway, it is not like he could not just say someone hacked the key, too. But it would make his claims even *more* unbelievable. Only people such as cc and DFS and anyone else he has sucking up to him could claim to believe him then. What it will also do, though, is give Carroll a way to even more easily deny what he calls his "aliases" - his other names and accounts (socks and secondary accounts). He *mostly* denies these already, though, so not a big deal. And, anyway, with the added overhead of doing this it might make him troll less - so let me go on record as saying that as long as Carroll is going to continue to post I am 100% for him doing this. Absolutely. -- * Mint MATE Trash, Panel, Menu: <http://youtu.be/C0y74FIf7uE> * Mint KDE bugs or Easter eggs? <http://youtu.be/CU-whJQvtfA> * Mint KDE working with folders: <http://youtu.be/7C9nvniOoE0> * Mint KDE creating files: <http://youtu.be/N7-fZJaJUv8> * Mint KDE help: <http://youtu.be/3ikizUd3sa8> * Mint KDE general navigation: <http://youtu.be/t9y14yZtQuI> * Mavericks / Pages 5.1: <http://youtu.be/D3BPWANQoIk> * OS / Word Processor Comparison: <http://youtu.be/w6Qcl-w7s5c>
[toc] | [prev] | [next] | [standalone]
| From | owl <owl@rooftop.invalid> |
|---|---|
| Date | 2015-04-26 22:09 +0000 |
| Message-ID | <nvbhcr94.gjif9r@rooftop.invalid> |
| In reply to | #291655 |
Snit <usenet@gallopinginsanity.com> wrote: > On 4/26/15, 2:22 PM, in article bbnvyc83.kajg@rooftop.invalid, "owl" > <owl@rooftop.invalid> wrote: >> Steve Carroll <fretwizzer@gmail.com> wrote: >>> On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: >> >>> (snip) >> >>> I just tested it in the browser, I highlighted this... >> >>> -----BEGIN PGP SIGNED MESSAGE----- >>> Hash: SHA512 >> >>> This is a signing test. >>> -----BEGIN PGP SIGNATURE----- >>> Comment: GPGTools - https://gpgtools.org >> >>> iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D >>> c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC >>> 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG >>> F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG >>> 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi >>> +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= >>> =WB15 >>> -----END PGP SIGNATURE----- >> >>> ... and I was able to 'verify' it was from me so it seems to be working (in >>> other words, Google isn't munging it). So if this is working correctly... do >>> I have the idea here with this: >> >>> * I create a key pair and share the public half of it >> >>> * I write a message and 'sign' it (like I just quoted) >> >>> * The end user grabs my public key (one time) and stores it in his GPG >>> keychain >> >>> * When the end user sees a signed message by me he simply highlights it and >>> can verify it instantly with a mouse click (or however it's done in their >>> system). >> >>> I emailed myself a signed message and my mail app came back saying it was >>> secure and from me. Seems like that's it, eh? Thanks, dude! I probably never >>> would have gotten around to doing this if not for you, this is definitely a >>> useful thing for a number of reasons. If you know, how secure is this? What's >>> the "the trust level" bit? Is it based on me verifying it in the real world >>> (like a phone call or something)? >> >> The trust level, you get other people who trust your key to sign your >> key. If you get someone's pubkey and a lot of people you know have >> signed it, then you can give it more trust. >> >> I signed your pubkey. Below is the signed version. Anybody >> importing that one will see that I have signed it, sort of like >> vouching for this key. >> >> owl@thinkpad:~$ gpg --edit-key fretwizzer >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. >> This is free software: you are free to change and redistribute it. >> There is NO WARRANTY, to the extent permitted by law. >> >> >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC >> trust: full validity: full >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> >> Command> check >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> >> Command> quit >> owl@thinkpad:~$ >> >> Your pubkey with my signature, showing that I vouch for the key: >> >> -----BEGIN PGP PUBLIC KEY BLOCK----- >> Version: GnuPG v1.4.10 (GNU/Linux) >> >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 >> X3XBJ7x68hqF >> =VKJW >> -----END PGP PUBLIC KEY BLOCK----- >> >> > Funny to see Carroll begging to get help so he can be trusted. :) > In all seriousness, if he actually is willing to do this it would be great. > It would end his nonsense about saying his past posts were "hacked"... if > they were the key would fail. Then again, given how hacking his past posts > is not possible anyway, it is not like he could not just say someone hacked > the key, too. > But it would make his claims even *more* unbelievable. Only people such as > cc and DFS and anyone else he has sucking up to him could claim to believe > him then. > What it will also do, though, is give Carroll a way to even more easily deny > what he calls his "aliases" - his other names and accounts (socks and > secondary accounts). He *mostly* denies these already, though, so not a big > deal. > And, anyway, with the added overhead of doing this it might make him troll > less - so let me go on record as saying that as long as Carroll is going to > continue to post I am 100% for him doing this. Absolutely. It can't prevent denial of an unsigned message. But the sender of the unsigned message can be challenged to resend it as a signed message.
[toc] | [prev] | [next] | [standalone]
| From | Snit <usenet@gallopinginsanity.com> |
|---|---|
| Date | 2015-04-26 15:21 -0700 |
| Message-ID | <D162B30E.4ACFD%usenet@gallopinginsanity.com> |
| In reply to | #291661 |
On 4/26/15, 3:09 PM, in article nvbhcr94.gjif9r@rooftop.invalid, "owl" <owl@rooftop.invalid> wrote: >> Funny to see Carroll begging to get help so he can be trusted. :) > >> In all seriousness, if he actually is willing to do this it would be great. >> It would end his nonsense about saying his past posts were "hacked"... if >> they were the key would fail. Then again, given how hacking his past posts >> is not possible anyway, it is not like he could not just say someone hacked >> the key, too. > >> But it would make his claims even *more* unbelievable. Only people such as >> cc and DFS and anyone else he has sucking up to him could claim to believe >> him then. > >> What it will also do, though, is give Carroll a way to even more easily deny >> what he calls his "aliases" - his other names and accounts (socks and >> secondary accounts). He *mostly* denies these already, though, so not a big >> deal. > >> And, anyway, with the added overhead of doing this it might make him troll >> less - so let me go on record as saying that as long as Carroll is going to >> continue to post I am 100% for him doing this. Absolutely. > > It can't prevent denial of an unsigned message. But the sender of the > unsigned message can be challenged to resend it as a signed message. But if Carroll is playing his normal game where he is insisting the old message is forged or hacked he would just not do this. Or would just to create more confusion. :) But for ones which are signed it would be even harder for him to deny them. Not saying he never would - his stories get pretty outrageous at times - but it would make it so only the most extreme shills (cc, DFS, Sandman from CSMA, etc.) would ever even pretend to believe him. I strongly encourage him to do this. If he is *really* being hacked, as he claims, this is a way to prevent his ex-girlfriend or whomever he is blaming today for doing so. Heck, since he blames me half the time it is a good way for him to protect me. When he claims I have sent one of these signed messages he will have to create a very bizarre story in deed. So, yes, Carroll, *please* do this. Protect yourself. And those you accuse. -- * Mint MATE Trash, Panel, Menu: <http://youtu.be/C0y74FIf7uE> * Mint KDE bugs or Easter eggs? <http://youtu.be/CU-whJQvtfA> * Mint KDE working with folders: <http://youtu.be/7C9nvniOoE0> * Mint KDE creating files: <http://youtu.be/N7-fZJaJUv8> * Mint KDE help: <http://youtu.be/3ikizUd3sa8> * Mint KDE general navigation: <http://youtu.be/t9y14yZtQuI> * Mavericks / Pages 5.1: <http://youtu.be/D3BPWANQoIk> * OS / Word Processor Comparison: <http://youtu.be/w6Qcl-w7s5c>
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 15:21 -0700 |
| Message-ID | <1797a522-31fb-4687-a84a-5e4e88c2076d@googlegroups.com> |
| In reply to | #291661 |
On Sunday, April 26, 2015 at 4:09:33 PM UTC-6, owl wrote: > Snit <usenet@gallopinginsanity.com> wrote: > > On 4/26/15, 2:22 PM, in article bbnvyc83.kajg@rooftop.invalid, "owl" > > <owl@rooftop.invalid> wrote: > > >> Steve Carroll <fretwizzer@gmail.com> wrote: > >>> On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: > >> > >>> (snip) > >> > >>> I just tested it in the browser, I highlighted this... > >> > >>> -----BEGIN PGP SIGNED MESSAGE----- > >>> Hash: SHA512 > >> > >>> This is a signing test. > >>> -----BEGIN PGP SIGNATURE----- > >>> Comment: GPGTools - https://gpgtools.org > >> > >>> iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D > >>> c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC > >>> 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG > >>> F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG > >>> 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi > >>> +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= > >>> =WB15 > >>> -----END PGP SIGNATURE----- > >> > >>> ... and I was able to 'verify' it was from me so it seems to be working (in > >>> other words, Google isn't munging it). So if this is working correctly... do > >>> I have the idea here with this: > >> > >>> * I create a key pair and share the public half of it > >> > >>> * I write a message and 'sign' it (like I just quoted) > >> > >>> * The end user grabs my public key (one time) and stores it in his GPG > >>> keychain > >> > >>> * When the end user sees a signed message by me he simply highlights it and > >>> can verify it instantly with a mouse click (or however it's done in their > >>> system). > >> > >>> I emailed myself a signed message and my mail app came back saying it was > >>> secure and from me. Seems like that's it, eh? Thanks, dude! I probably never > >>> would have gotten around to doing this if not for you, this is definitely a > >>> useful thing for a number of reasons. If you know, how secure is this? What's > >>> the "the trust level" bit? Is it based on me verifying it in the real world > >>> (like a phone call or something)? > >> > >> The trust level, you get other people who trust your key to sign your > >> key. If you get someone's pubkey and a lot of people you know have > >> signed it, then you can give it more trust. > >> > >> I signed your pubkey. Below is the signed version. Anybody > >> importing that one will see that I have signed it, sort of like > >> vouching for this key. > >> > >> owl@thinkpad:~$ gpg --edit-key fretwizzer > >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. > >> This is free software: you are free to change and redistribute it. > >> There is NO WARRANTY, to the extent permitted by law. > >> > >> > >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC > >> trust: full validity: full > >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E > >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> > >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > >> > >> Command> check > >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > >> > >> Command> quit > >> owl@thinkpad:~$ > >> > >> Your pubkey with my signature, showing that I vouch for the key: > >> > >> -----BEGIN PGP PUBLIC KEY BLOCK----- > >> Version: GnuPG v1.4.10 (GNU/Linux) > >> > >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n > >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY > >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 > >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS > >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 > >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg > >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD > >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e > >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I > >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD > >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX > >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A > >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 > >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 > >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR > >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH > >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp > >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS > >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG > >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl > >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ > >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa > >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 > >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR > >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF > >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi > >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 > >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH > >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat > >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 > >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K > >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd > >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg > >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 > >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC > >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq > >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 > >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa > >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA > >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ > >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 > >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB > >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf > >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq > >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 > >> X3XBJ7x68hqF > >> =VKJW > >> -----END PGP PUBLIC KEY BLOCK----- > >> > >> > > Funny to see Carroll begging to get help so he can be trusted. :) > > > In all seriousness, if he actually is willing to do this it would be great. > > It would end his nonsense about saying his past posts were "hacked"... if > > they were the key would fail. Then again, given how hacking his past posts > > is not possible anyway, it is not like he could not just say someone hacked > > the key, too. > > > But it would make his claims even *more* unbelievable. Only people such as > > cc and DFS and anyone else he has sucking up to him could claim to believe > > him then. > > > What it will also do, though, is give Carroll a way to even more easily deny > > what he calls his "aliases" - his other names and accounts (socks and > > secondary accounts). He *mostly* denies these already, though, so not a big > > deal. > > > And, anyway, with the added overhead of doing this it might make him troll > > less - so let me go on record as saying that as long as Carroll is going to > > continue to post I am 100% for him doing this. Absolutely. > > It can't prevent denial of an unsigned message. But the sender of the > unsigned message can be challenged to resend it as a signed message. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Now we know that, for all the crowing he's done on this topic, the 'IT Master' doesn't know how to do this. It literally takes a couple seconds to highlight text and 'sign' it. I'm not going to pretend you didn't square me away on this stuff and I appreciate it. Snit has this thread to follow and can start to sound like he has a clue from here on out... but he missed that opportunity when it mattered ;) (cue up another feeble, face saving attempt by the 'IT Master') -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVPWOwAAoJEKLThH5e1B4rqhcIAJKrUgCyu/ECqSBmTzb6VoN/ d/DWKjlSJ3veWtLllMemOScJkCRw5S4e/vePlsWf4Lz6zvc1AHTzZwEgfBJ+s6zM 34hCc4meQPV20/Klx8DY5AHlfhYWSX0e+3li3WQS2j6ERbOE4DIvQE2DsSAV2hrt eL3NljvgFhU85/GMlfjlQwYk90eaeD8QVXvuBwOKhXjBfj37IO1XaoawFFuqPqfu +vtnhyVCrRhfp0+MdrY+Jk0IEZ9qunL6y9WWJI5j7v33ljWHdnC0eQkTo9Z0zfOX ZirVuIkFPO07IF8uZTlNyy4ipEytP0e/Yf3YWEuFHSGeouuvHsOjb1RQGUQ2tVw= =qFIe -----END PGP SIGNATURE-----
[toc] | [prev] | [next] | [standalone]
| From | owl <owl@rooftop.invalid> |
|---|---|
| Date | 2015-04-26 22:40 +0000 |
| Message-ID | <nvbhf84.gjja3@rooftop.invalid> |
| In reply to | #291663 |
Steve Carroll <fretwizzer@gmail.com> wrote: > On Sunday, April 26, 2015 at 4:09:33 PM UTC-6, owl wrote: >> Snit <usenet@gallopinginsanity.com> wrote: >> > On 4/26/15, 2:22 PM, in article bbnvyc83.kajg@rooftop.invalid, "owl" >> > <owl@rooftop.invalid> wrote: >> >> >> Steve Carroll <fretwizzer@gmail.com> wrote: >> >>> On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: >> >> >> >>> (snip) >> >> >> >>> I just tested it in the browser, I highlighted this... >> >> >> >>> -----BEGIN PGP SIGNED MESSAGE----- >> >>> Hash: SHA512 >> >> >> >>> This is a signing test. >> >>> -----BEGIN PGP SIGNATURE----- >> >>> Comment: GPGTools - https://gpgtools.org >> >> >> >>> iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D >> >>> c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC >> >>> 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG >> >>> F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG >> >>> 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi >> >>> +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= >> >>> =WB15 >> >>> -----END PGP SIGNATURE----- >> >> >> >>> ... and I was able to 'verify' it was from me so it seems to be working (in >> >>> other words, Google isn't munging it). So if this is working correctly... do >> >>> I have the idea here with this: >> >> >> >>> * I create a key pair and share the public half of it >> >> >> >>> * I write a message and 'sign' it (like I just quoted) >> >> >> >>> * The end user grabs my public key (one time) and stores it in his GPG >> >>> keychain >> >> >> >>> * When the end user sees a signed message by me he simply highlights it and >> >>> can verify it instantly with a mouse click (or however it's done in their >> >>> system). >> >> >> >>> I emailed myself a signed message and my mail app came back saying it was >> >>> secure and from me. Seems like that's it, eh? Thanks, dude! I probably never >> >>> would have gotten around to doing this if not for you, this is definitely a >> >>> useful thing for a number of reasons. If you know, how secure is this? What's >> >>> the "the trust level" bit? Is it based on me verifying it in the real world >> >>> (like a phone call or something)? >> >> >> >> The trust level, you get other people who trust your key to sign your >> >> key. If you get someone's pubkey and a lot of people you know have >> >> signed it, then you can give it more trust. >> >> >> >> I signed your pubkey. Below is the signed version. Anybody >> >> importing that one will see that I have signed it, sort of like >> >> vouching for this key. >> >> >> >> owl@thinkpad:~$ gpg --edit-key fretwizzer >> >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. >> >> This is free software: you are free to change and redistribute it. >> >> There is NO WARRANTY, to the extent permitted by law. >> >> >> >> >> >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC >> >> trust: full validity: full >> >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E >> >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> >> >> >> Command> check >> >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> >> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> >> >> sig!3 5ED41E2B 2015-03-23 [self-signature] >> >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> >> >> >> >> Command> quit >> >> owl@thinkpad:~$ >> >> >> >> Your pubkey with my signature, showing that I vouch for the key: >> >> >> >> -----BEGIN PGP PUBLIC KEY BLOCK----- >> >> Version: GnuPG v1.4.10 (GNU/Linux) >> >> >> >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n >> >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY >> >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 >> >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS >> >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 >> >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg >> >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD >> >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e >> >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I >> >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD >> >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX >> >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A >> >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 >> >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 >> >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR >> >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH >> >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp >> >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS >> >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG >> >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl >> >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ >> >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa >> >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 >> >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR >> >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF >> >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi >> >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 >> >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH >> >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat >> >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 >> >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K >> >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd >> >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg >> >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 >> >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC >> >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq >> >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 >> >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa >> >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA >> >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ >> >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 >> >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB >> >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf >> >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq >> >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 >> >> X3XBJ7x68hqF >> >> =VKJW >> >> -----END PGP PUBLIC KEY BLOCK----- >> >> >> >> >> > Funny to see Carroll begging to get help so he can be trusted. :) >> >> > In all seriousness, if he actually is willing to do this it would be great. >> > It would end his nonsense about saying his past posts were "hacked"... if >> > they were the key would fail. Then again, given how hacking his past posts >> > is not possible anyway, it is not like he could not just say someone hacked >> > the key, too. >> >> > But it would make his claims even *more* unbelievable. Only people such as >> > cc and DFS and anyone else he has sucking up to him could claim to believe >> > him then. >> >> > What it will also do, though, is give Carroll a way to even more easily deny >> > what he calls his "aliases" - his other names and accounts (socks and >> > secondary accounts). He *mostly* denies these already, though, so not a big >> > deal. >> >> > And, anyway, with the added overhead of doing this it might make him troll >> > less - so let me go on record as saying that as long as Carroll is going to >> > continue to post I am 100% for him doing this. Absolutely. >> >> It can't prevent denial of an unsigned message. But the sender of the >> unsigned message can be challenged to resend it as a signed message. > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > Now we know that, for all the crowing he's done on this topic, the 'IT Master' doesn't know how to do this. It literally takes a couple seconds to highlight text and 'sign' it. I'm not going to pretend you didn't square me away on this stuff and I appreciate it. Snit has this thread to follow and can start to sound like he has a clue from here on out... but he missed that opportunity when it mattered ;) > (cue up another feeble, face saving attempt by the 'IT Master') > -----BEGIN PGP SIGNATURE----- > Comment: GPGTools - https://gpgtools.org > iQEcBAEBCgAGBQJVPWOwAAoJEKLThH5e1B4rqhcIAJKrUgCyu/ECqSBmTzb6VoN/ > d/DWKjlSJ3veWtLllMemOScJkCRw5S4e/vePlsWf4Lz6zvc1AHTzZwEgfBJ+s6zM > 34hCc4meQPV20/Klx8DY5AHlfhYWSX0e+3li3WQS2j6ERbOE4DIvQE2DsSAV2hrt > eL3NljvgFhU85/GMlfjlQwYk90eaeD8QVXvuBwOKhXjBfj37IO1XaoawFFuqPqfu > +vtnhyVCrRhfp0+MdrY+Jk0IEZ9qunL6y9WWJI5j7v33ljWHdnC0eQkTo9Z0zfOX > ZirVuIkFPO07IF8uZTlNyy4ipEytP0e/Yf3YWEuFHSGeouuvHsOjb1RQGUQ2tVw= > =qFIe > -----END PGP SIGNATURE----- Bad signature. What happened? The other post was fine. owl@thinkpad:~$ cat steve_post -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Now we know that, for all the crowing he's done on this topic, the 'IT Master' doesn't know how to do this. It literally takes a couple seconds to highlight text and 'sign' it. I'm not going to pretend you didn't square me away on this stuff and I appreciate it. Snit has this thread to follow and can start to sound like he has a clue from here on out... but he missed that opportunity when it mattered ;) (cue up another feeble, face saving attempt by the 'IT Master') -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVPWOwAAoJEKLThH5e1B4rqhcIAJKrUgCyu/ECqSBmTzb6VoN/ d/DWKjlSJ3veWtLllMemOScJkCRw5S4e/vePlsWf4Lz6zvc1AHTzZwEgfBJ+s6zM 34hCc4meQPV20/Klx8DY5AHlfhYWSX0e+3li3WQS2j6ERbOE4DIvQE2DsSAV2hrt eL3NljvgFhU85/GMlfjlQwYk90eaeD8QVXvuBwOKhXjBfj37IO1XaoawFFuqPqfu +vtnhyVCrRhfp0+MdrY+Jk0IEZ9qunL6y9WWJI5j7v33ljWHdnC0eQkTo9Z0zfOX ZirVuIkFPO07IF8uZTlNyy4ipEytP0e/Yf3YWEuFHSGeouuvHsOjb1RQGUQ2tVw= =qFIe -----END PGP SIGNATURE----- owl@thinkpad:~$ gpg --verify steve_post gpg: Signature made Sun 26 Apr 2015 06:16:16 PM EDT using RSA key ID 5ED41E2B gpg: BAD signature from "Steve Carroll (GPG signing) <fretwizzer@gmail.com>" owl@thinkpad:~$
[toc] | [prev] | [next] | [standalone]
| From | Steve Carroll <fretwizzer@gmail.com> |
|---|---|
| Date | 2015-04-26 15:47 -0700 |
| Message-ID | <2bde29a6-b74a-4221-adec-a565dd1fb99f@googlegroups.com> |
| In reply to | #291666 |
On Sunday, April 26, 2015 at 4:40:26 PM UTC-6, owl wrote: > Steve Carroll <fretwizzer@gmail.com> wrote: > > On Sunday, April 26, 2015 at 4:09:33 PM UTC-6, owl wrote: > >> Snit <usenet@gallopinginsanity.com> wrote: > >> > On 4/26/15, 2:22 PM, in article bbnvyc83.kajg@rooftop.invalid, "owl" > >> > <owl@rooftop.invalid> wrote: > >> > >> >> Steve Carroll <fretwizzer@gmail.com> wrote: > >> >>> On Sunday, April 26, 2015 at 2:33:04 PM UTC-6, Steve Carroll wrote: > >> >> > >> >>> (snip) > >> >> > >> >>> I just tested it in the browser, I highlighted this... > >> >> > >> >>> -----BEGIN PGP SIGNED MESSAGE----- > >> >>> Hash: SHA512 > >> >> > >> >>> This is a signing test. > >> >>> -----BEGIN PGP SIGNATURE----- > >> >>> Comment: GPGTools - https://gpgtools.org > >> >> > >> >>> iQEcBAEBCgAGBQJVPUcAAAoJEKLThH5e1B4r/8oH/2NuIb5h5PqoDhwXeGdQz9/D > >> >>> c6zpKqaLTdPXowVekEmS5CEbQKUBY8hokmaYGOEMaa3DMefIHN38YqWn5vRZ/AFC > >> >>> 4cYPmjgNepDCRn1t1L7gYFxBAuuSvcKiMpbVj3AZ6EFt4XLHsWFF13ojof6PyyBG > >> >>> F9OAlx/jI80PzctWEhMqk2U24OGPMTgkED487ZGtkp2IHHPTLnwG2iwWewecFRUG > >> >>> 9VKO/Fo/nRy5+CsLXDC+Svma/TOhuz7P9utDLiKO+bVTegoSJhPUc5MtvzKHsORi > >> >>> +8RMcXtrqkMZ8NxOpY2Ble9Q3SvCoCBGeUKJEpe8ubkAGAT6AaxLuUKVMgLF/Jg= > >> >>> =WB15 > >> >>> -----END PGP SIGNATURE----- > >> >> > >> >>> ... and I was able to 'verify' it was from me so it seems to be working (in > >> >>> other words, Google isn't munging it). So if this is working correctly... do > >> >>> I have the idea here with this: > >> >> > >> >>> * I create a key pair and share the public half of it > >> >> > >> >>> * I write a message and 'sign' it (like I just quoted) > >> >> > >> >>> * The end user grabs my public key (one time) and stores it in his GPG > >> >>> keychain > >> >> > >> >>> * When the end user sees a signed message by me he simply highlights it and > >> >>> can verify it instantly with a mouse click (or however it's done in their > >> >>> system). > >> >> > >> >>> I emailed myself a signed message and my mail app came back saying it was > >> >>> secure and from me. Seems like that's it, eh? Thanks, dude! I probably never > >> >>> would have gotten around to doing this if not for you, this is definitely a > >> >>> useful thing for a number of reasons. If you know, how secure is this? What's > >> >>> the "the trust level" bit? Is it based on me verifying it in the real world > >> >>> (like a phone call or something)? > >> >> > >> >> The trust level, you get other people who trust your key to sign your > >> >> key. If you get someone's pubkey and a lot of people you know have > >> >> signed it, then you can give it more trust. > >> >> > >> >> I signed your pubkey. Below is the signed version. Anybody > >> >> importing that one will see that I have signed it, sort of like > >> >> vouching for this key. > >> >> > >> >> owl@thinkpad:~$ gpg --edit-key fretwizzer > >> >> gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. > >> >> This is free software: you are free to change and redistribute it. > >> >> There is NO WARRANTY, to the extent permitted by law. > >> >> > >> >> > >> >> pub 2048R/5ED41E2B created: 2015-03-23 expires: 2019-03-23 usage: SC > >> >> trust: full validity: full > >> >> sub 2048R/93129FA2 created: 2015-03-23 expires: 2019-03-23 usage: E > >> >> [ full ] (1). Steve Carroll (GPG signing) <fretwizzer@gmail.com> > >> >> [ full ] (2) Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > >> >> > >> >> Command> check > >> >> uid Steve Carroll (GPG signing) <fretwizzer@gmail.com> > >> >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > >> >> uid Steve Carroll (Do you hear me now?) <fretwizzer@gmail.com> > >> >> sig!3 5ED41E2B 2015-03-23 [self-signature] > >> >> sig! D83A7ECF 2015-04-26 owl (usenet) <owl@rooftop.invalid> > >> >> > >> >> Command> quit > >> >> owl@thinkpad:~$ > >> >> > >> >> Your pubkey with my signature, showing that I vouch for the key: > >> >> > >> >> -----BEGIN PGP PUBLIC KEY BLOCK----- > >> >> Version: GnuPG v1.4.10 (GNU/Linux) > >> >> > >> >> mQENBFUQLckBCADQ5m8yvsb7TKlV3fNJtg6neTu8cpzIgffWR6LqlRhBbAdTGh4n > >> >> Tu2mDEa4LPH+r0BICQtEbMEXsHBgd9c4R8QkQz0Ugjc1R7zpfDDGZZ51Ke2ol+bY > >> >> QA1ssenYBdsMxFMY9CD28xhIx4D/QzRgKv8Xtfozyt0kvcjuOI6ruFtFchsidiz3 > >> >> bQAYBkzcIxN5bsUtRnUagrMB2+VMgwfPgIXSUMtDLpkQTF0MjzsLKaxuh1SBpXAS > >> >> nJwuQndgrY6jiv78CBJNfWKK8Ouj6l3O3iita7bV+cmgdSxqAEUAWgZj926aJtH0 > >> >> jjyesS7aersDse182FYLzUFowajG8+tRy0ELABEBAAG0MlN0ZXZlIENhcnJvbGwg > >> >> KEdQRyBzaWduaW5nKSA8ZnJldHdpenplckBnbWFpbC5jb20+iQFABBMBCgAqAhsD > >> >> BQkHhh+ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJVEDLnAhkBAAoJEKLThH5e > >> >> 1B4rXpsH/jtQ+MpPdbq/qUR+ahlbI1UIqrhGnoudIWL6OBqRn2+fti+xxemhNb9I > >> >> 1HxzgZJ4ZMHNU9gkLWVg7OsIsNb09qJpULHECJ2VLTx93wOMAV57koH3E2wnO7tD > >> >> rmLoCfx5LbuIHg6QFhsYV+XcLH8OlcVPZwkrwUNKd8nL7oHPWyTTO1vFdRT+GNRX > >> >> sBNwFRc9dM928q7Vr1DYGPmlekSCSXMN6pdvWeQ7lqbq0KU+rlZPkA0o1BKEdT7A > >> >> n0TTRBBKMte8bzDWqxIMbMiqXJT8CrH+W27oKq1UxRt6CwyttY62Oca2UzAkz4K0 > >> >> cCE/qaqQ09C0UFu3i+7zzHGjz7VtP1SJARwEEAECAAYFAlU9URgACgkQAkoOHNg6 > >> >> fs+ttAgAnmFuLqbCsNQryshj07LmTut/tqZjpeyBkFdZ/YHM1zBijGBz3OnmDaLR > >> >> kfHwDIi+VLYVAiHNbYivRNa1vgvqtIJiR7/Z9+4jD98M24JRZHU1gaqs/AzLOtJH > >> >> 5vG6+ns/DEMCE6JigEbR122ulkxpc+5Ej64AnuBkxtfSzdLFi1ntzmRWBB7gofWp > >> >> la97odN72aHj7e1t+0ihRJt8iu1vEiFYGaLeJsdGRsV4UWLvKZRz3V3KzNdCX+bS > >> >> 97FUViaINrtWCDiTVZIZHC2eN15fn7JnJ4cuT2BLxT06tH8liZddoxiasFLR7OJG > >> >> OxquVU0djs/8kKIlhab+EAe0V9vDFbQ6U3RldmUgQ2Fycm9sbCAoRG8geW91IGhl > >> >> YXIgbWUgbm93PykgPGZyZXR3aXp6ZXJAZ21haWwuY29tPokBPQQTAQoAJwIbAwUJ > >> >> B4YfgAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVRAy5wAKCRCi04R+XtQeK1xa > >> >> B/9x8dAkaZArxsf+NGOO9VuoHJJIX1eQaZQK6DMxORQHU3zsF8mgboGNNvljFUo2 > >> >> B10RlZD/2mgj7wVd7CB79UFraQcB+iTGgQGjHa0HYGrjLaNiA0W+Ifm1B0Me/aMR > >> >> 8JEF1qkdMFnuglETFxRhgpLZXwuVjvoOPuOCCtXWVvd0uFKAws3/fzpw+TIwowgF > >> >> EWcVmhAjmDLvVCPcV5G14K8JAFvrKcuvm1DNcSsu6o3uPhmgTI+ZghO/+tw0svGi > >> >> 8r96SmAbuSsyKFuDD6Z7MdoGaxLP1VkOK0XmUga/m+l6wnRmZtcsVsUA8nSP1O88 > >> >> tWab6dIMOfKaKR9vOE5clvP6iQEcBBABAgAGBQJVPVEYAAoJEAJKDhzYOn7PneUH > >> >> /icCck+ToL0m0PYnkpvU8syCT2JanzeqJlQpDuYu/IBnwjisuJBcpplAOERiegat > >> >> fKlqEdLE0SDGdqa86nLD5FrTbEcsWqkSW0e3k0ixh+TnVsOacaJVKd4q5J2gjxE1 > >> >> 0R3tA/9ZJdoNJDbWcA73TXpGmZQs6MhGv4MNBe8xfLEAXSDXp0vSpjvblpodSf9K > >> >> JzkQqyhINioeZiLu0EeVy14kD86+qt/RR8YV7BmAeExe09UTTcBTeQ8x0reEqlKd > >> >> 7fb7QgfoH2Wd4AkAnBF1Yw7nA8SS3/fVCF6p37cJzTG7qKJnxwLEkJqBDsl2Fkyg > >> >> 4XNnWCQzRIONZFoyVHhJLGu5AQ0EVRAtyQEIAMmCXdaZT0xabB41R1R3klH8/q70 > >> >> UcupsnnVHoPD+26bKrQnvSF59wkxtlR7GkGE/zW6ekEG2rqX5A2DS5Ua9B7XBLbC > >> >> 09VhNNndamtBv3OVRkn8gxfxkNJ23agfgcqWBwIWzVvSKMuKo/Jn1A0ZycWkjyZq > >> >> apPWT05lZPQMtsTWpjqtsVyknUEPZ6C4yUm1ZSDFmeU43AMnAW48HsynNdjoqZC7 > >> >> 0NvVHNvkknH1th28M7BJA//vgvpXlswuGr261CS1+YDD85gEAujyAdmD3YVfEmLa > >> >> qo3C30aqQzFPOSFh6/S2NQOPisMNms18gVyu6hIuiSArl2FN0TTRKmcLnUEAEQEA > >> >> AYkBJQQYAQoADwUCVRAtyQIbDAUJB4YfgAAKCRCi04R+XtQeK6rLCACEz/5KHqLQ > >> >> 1Dy7UI2sqf4O5OSMozkdR8d/jfqvO8IJl1mfxgZoWAC1rPcYoatFUFBS23s+0yQ5 > >> >> gQRvUEiMIWoO4iEFuDHtSwjkP/iFacQZPE4MbUDUSqk4hmUXiDd52oEj8PtXTIHB > >> >> NXxG8RDbM23Gi0lgjmL4EpERsJ3cQQ1JnxIyg+AqTa6BfiiidQZ+Ssnk1iI8jxgf > >> >> iUFG2xtVOyXlPWE5oOFX+25B/f3o9SBmk8zNozGvwJ2Ezry++RBFM4v9AuTmfNwq > >> >> 4whw41O2Q4Oen85ZlViwwfvfMNcqTP/ACUBtgbE9BsPLwwDTxPIvsBwy6lCROYR7 > >> >> X3XBJ7x68hqF > >> >> =VKJW > >> >> -----END PGP PUBLIC KEY BLOCK----- > >> >> > >> >> > >> > Funny to see Carroll begging to get help so he can be trusted. :) > >> > >> > In all seriousness, if he actually is willing to do this it would be great. > >> > It would end his nonsense about saying his past posts were "hacked"... if > >> > they were the key would fail. Then again, given how hacking his past posts > >> > is not possible anyway, it is not like he could not just say someone hacked > >> > the key, too. > >> > >> > But it would make his claims even *more* unbelievable. Only people such as > >> > cc and DFS and anyone else he has sucking up to him could claim to believe > >> > him then. > >> > >> > What it will also do, though, is give Carroll a way to even more easily deny > >> > what he calls his "aliases" - his other names and accounts (socks and > >> > secondary accounts). He *mostly* denies these already, though, so not a big > >> > deal. > >> > >> > And, anyway, with the added overhead of doing this it might make him troll > >> > less - so let me go on record as saying that as long as Carroll is going to > >> > continue to post I am 100% for him doing this. Absolutely. > >> > >> It can't prevent denial of an unsigned message. But the sender of the > >> unsigned message can be challenged to resend it as a signed message. > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA512 > > > Now we know that, for all the crowing he's done on this topic, the 'IT Master' doesn't know how to do this. It literally takes a couple seconds to highlight text and 'sign' it. I'm not going to pretend you didn't square me away on this stuff and I appreciate it. Snit has this thread to follow and can start to sound like he has a clue from here on out... but he missed that opportunity when it mattered ;) > > > (cue up another feeble, face saving attempt by the 'IT Master') > > > -----BEGIN PGP SIGNATURE----- > > Comment: GPGTools - https://gpgtools.org > > > iQEcBAEBCgAGBQJVPWOwAAoJEKLThH5e1B4rqhcIAJKrUgCyu/ECqSBmTzb6VoN/ > > d/DWKjlSJ3veWtLllMemOScJkCRw5S4e/vePlsWf4Lz6zvc1AHTzZwEgfBJ+s6zM > > 34hCc4meQPV20/Klx8DY5AHlfhYWSX0e+3li3WQS2j6ERbOE4DIvQE2DsSAV2hrt > > eL3NljvgFhU85/GMlfjlQwYk90eaeD8QVXvuBwOKhXjBfj37IO1XaoawFFuqPqfu > > +vtnhyVCrRhfp0+MdrY+Jk0IEZ9qunL6y9WWJI5j7v33ljWHdnC0eQkTo9Z0zfOX > > ZirVuIkFPO07IF8uZTlNyy4ipEytP0e/Yf3YWEuFHSGeouuvHsOjb1RQGUQ2tVw= > > =qFIe > > -----END PGP SIGNATURE----- > > > Bad signature. What happened? The other post was fine. Could it have been that file I imported with your verification of my signature? It's the only thing that was different that I can think of. > owl@thinkpad:~$ cat steve_post > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > Now we know that, for all the crowing he's done on this topic, the 'IT Master' doesn't know how to do this. It literally takes a couple seconds to highlight text and 'sign' it. I'm not going to pretend you didn't square me away on this stuff and I appreciate it. Snit has this thread to follow and can start to sound like he has a clue from here on out... but he missed that opportunity when it mattered ;) > > (cue up another feeble, face saving attempt by the 'IT Master') > > -----BEGIN PGP SIGNATURE----- > Comment: GPGTools - https://gpgtools.org > > iQEcBAEBCgAGBQJVPWOwAAoJEKLThH5e1B4rqhcIAJKrUgCyu/ECqSBmTzb6VoN/ > d/DWKjlSJ3veWtLllMemOScJkCRw5S4e/vePlsWf4Lz6zvc1AHTzZwEgfBJ+s6zM > 34hCc4meQPV20/Klx8DY5AHlfhYWSX0e+3li3WQS2j6ERbOE4DIvQE2DsSAV2hrt > eL3NljvgFhU85/GMlfjlQwYk90eaeD8QVXvuBwOKhXjBfj37IO1XaoawFFuqPqfu > +vtnhyVCrRhfp0+MdrY+Jk0IEZ9qunL6y9WWJI5j7v33ljWHdnC0eQkTo9Z0zfOX > ZirVuIkFPO07IF8uZTlNyy4ipEytP0e/Yf3YWEuFHSGeouuvHsOjb1RQGUQ2tVw= > =qFIe > -----END PGP SIGNATURE----- > > owl@thinkpad:~$ gpg --verify steve_post > gpg: Signature made Sun 26 Apr 2015 06:16:16 PM EDT using RSA key ID 5ED41E2B > gpg: BAD signature from "Steve Carroll (GPG signing) <fretwizzer@gmail.com>" > owl@thinkpad:~$ Yeah, I get the same thing inline on the browser... where the good one still works fine.
[toc] | [prev] | [next] | [standalone]
Page 2 of 4 — ← Prev page 1 [2] 3 4 Next page →
Back to top | Article view | comp.os.linux.advocacy
csiph-web