PGP signatures.

[Mikkel L. Ellertson]

Tim wrote:
> On Fri, 2008-05-30 at 11:46 -0430, Patrick O'Callaghan wrote:
>> It's a basic fact of life that crypto software is complicated for
>> users, and there appear to be fairly fundamental reasons why this is
>> so (see "Why Johnny Can't Encrypt", an interesting paper by a group of
>> Stanford researchers from a few years ago). 
> 
> I've had to set up PGP/GPG for someone, yonks ago, because comprehending
> any of it was going to be completely beyond them.  But we had to be able
> to exchange some information confidentially, so there was no avoiding
> using it.  Eventually I managed by setting it all up for them, and were
> able get to the point where I only had to give telephone help for the
> steps to encrypt or decrypt mail (enter passphrase, which passphrase it
> was they had to use, which options they had to pick to encrypt, etc.),
> but I don't think it was ever going to get to the stage of them being
> able to use it all by themselves.
> 
> It would have helped if Evolution, for instance, allowed you to set an
> option in the address book to always encrypt for this person, rather
> than requiring the user to do an encrypt action choice for every email.
> I've had that option in other clients.  That'd help against accidentally
> sending things in the clear, at the very least.
> 
If you install the Enigmail plugin in ThunderBird, you can configure 
rules to control encryption options for specific e-mail addresses. 
It defaults to asking you what to do when it gets an address that 
does not match any of its rules. (It is all check boxes and 
drop-down options.)

> One thing that struck as being particularly painful, since it was email
> that we were talking about, was the inability to give someone your
> public key in some way through your mail program.  Yes, I know that's
> not a brilliantly safe way to set things up.  But with two PCs next to
> each other on a LAN, that would have been safe and an easy to do it.
> 
The key management option will let you create a key pair, publish a 
key, get a key from a key server, and import/export a key. For 
sending keys through the mail, even pgp offered the option to export 
your public key as an ASCII armored text file that you could include 
inside the message, or as an attachment. You can then import the key 
from that file. It is also handy if you want to publish your public 
key on a web page.

Sending/receiving a key using e-mail is not really a security risk 
if you have a second method of communication so that you can verify 
that the key is really from you. (Compare the key fingerprints.) You 
do not need to protect your public key - just make sure the key he 
gets is really your public key.

> You had to use the gpg program, separately, to publish your key, or
> create it as a file.  The "mail and encryption are separate things"
> issue is difficult for many to comprehend, and that's just another thing
> that will discourage many from using it.
> 
> Various gpg programs are geared towards using public keyservers as about
> the only way to exchange keys (or the only obvious way to do it), but
> that may not be desireable for some.  It certainly isn't for me, as I've
> found using them to be a guaranteed method for receiving spam.  Even
> more so than having your e-mail address on your website, completely
> unmunged.
> 
The GUIs and mail integration has improved drastically from when you 
had to do everything from the command line. But it was not that hard 
to create scripts to handle common tasks. For your friend you were 
exchanging mail with, something like "encrypt <file>" and "decrypt 
<file>" would probably been enough. Or just encrypt and decrypt if 
you used the same file names all the time.

> As I mentioned earlier, someone's obviously monitoring some keyservers,
> and harvesting addresses from them.  Adding another address to the
> public key instantly results in that address being included in the next
> volley of spam.  Peculiarly, removing some addresses from the key had a
> similar effect (no more spam being received at those addresses).  I
> didn't expect that to happen.
> 
> The keyserver I used was:  hkp://subkeys.pgp.net  Though I'm inclined to
> suspect the harvesting is not that server, in itself.
> 
The keyservers share the key information, so it is hard to say what 
key server is being monitored. I would not think it would be a good 
source of addresses to SPAM... But I have seen addresses harvested 
from places like the Postfix support list. LOL

Mikkel
-- 

   Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20080530/16325564/attachment-0001.sig>