5 ms·

Scary bit is it's not server on HTTPS, which is probably a must-have for sites that publish public-key information. Much easier to MITM attack the site and clai

by lmgftp 13y ago

Scary bit is it's not server on HTTPS, which is probably a must-have for sites that publish public-key information. Much easier to MITM attack the site and claim to be posting "his" public key and email address while really publishing your own info, etc. A great tutorial, however. Very accessible in my opinion and considering it's purpose my previous paragraph is more of an aside.

jarrett 13y ago
That's the purpose of key signing. The author--like almost all PGP users--has gotten his key signed by third parties. This means that its integrity can be verified. E.g., if a man in the middle were to intercept the HTTP response and change the contents of the key, it would lack the signatures. Still, I suppose it's possible for an adversary to work around this as well. If you can find enough people who are 1) willing to falsely sign a key, and 2) trusted by others, you can have these people sign a spoofed key. But then these people would be putting their reputations on the line, and the probability of being exposed is high. Thus the cost of the attack is high. The lesson being: If you're emailing info that is valuable enough to warrant such a costly attack, verify the key through some other means. Meet the message recipient in person, for example. And consider a thorough security audit of everything in your digital and physical life. You're obviously operating in a far more dangerous world than I do. There are probably many vulnerabilities available to attackers that have nothing to do with your email.
- lmgftp 13y ago
  Of course, you're entirely correct in that :) My warning was truly an aside, and given the nature of a large group of visitors, of course a handful might not follow best practices and verify the signatures, etc.
  - jarrett 13y ago
    Ah, good point. I see what you mean--if someone is just learning about PGP the first time, they might not know about issues surrounding key integrity, and the need for trusted 3rd-party signatures.
- deleted 13y ago
  [deleted]
asdliajd 13y ago
Install gpg-curl, use hkps (TLS key exchange) https://we.riseup.net/riseuplabs+paow/openpgp-best-practices#consider-making-your-default-keyserver-use-a-keyse https://we.riseup.net/riseuplabs+paow/openpgp-best-practices... Edit: nevermind, i see you meant the site with the tutorial, not key exchange

by lmgftp 13y ago

jarrett 13y ago

That's the purpose of key signing. The author--like almost all PGP users--has gotten his key signed by third parties. This means that its integrity can be verified. E.g., if a man in the middle were to intercept the HTTP response and change the contents of the key, it would lack the signatures. Still, I suppose it's possible for an adversary to work around this as well. If you can find enough people who are 1) willing to falsely sign a key, and 2) trusted by others, you can have these people sign a spoofed key. But then these people would be putting their reputations on the line, and the probability of being exposed is high. Thus the cost of the attack is high. The lesson being: If you're emailing info that is valuable enough to warrant such a costly attack, verify the key through some other means. Meet the message recipient in person, for example. And consider a thorough security audit of everything in your digital and physical life. You're obviously operating in a far more dangerous world than I do. There are probably many vulnerabilities available to attackers that have nothing to do with your email.

lmgftp 13y ago
Of course, you're entirely correct in that :) My warning was truly an aside, and given the nature of a large group of visitors, of course a handful might not follow best practices and verify the signatures, etc.
- jarrett 13y ago
  Ah, good point. I see what you mean--if someone is just learning about PGP the first time, they might not know about issues surrounding key integrity, and the need for trusted 3rd-party signatures.
deleted 13y ago
[deleted]

asdliajd 13y ago

Install gpg-curl, use hkps (TLS key exchange) https://we.riseup.net/riseuplabs+paow/openpgp-best-practices#consider-making-your-default-keyserver-use-a-keyse https://we.riseup.net/riseuplabs+paow/openpgp-best-practices... Edit: nevermind, i see you meant the site with the tutorial, not key exchange