Re: GnuPG in the media

2013-02-08 Thread Branko Majic
On Thu, 07 Feb 2013 22:16:23 -0500 Robert J. Hansen r...@sixdemonbag.org wrote: GnuPG was mentioned (somewhat inaccurately, but still mentioned) in the _Daily Mail_. It's not exactly 'respectable journalism', but it's still very high-visibility.

Re: More secure than smartcard or cryptostick against remote attacks?

2013-02-08 Thread Peter Lebbing
On 08/02/13 03:12, Josef Schneider wrote: With GnuPG on the other hand someone who has access to my PC can sign whatever he likes and sign as much as he likes, as long as my card reader is attached Just so you know, the OpenPGP card has a forcesig, force signature PIN, flag which you can set

Feature request for future OpenPGP card: force PIN

2013-02-08 Thread Peter Lebbing
Hello Werner and list, I'd like to do a feature request for a new version of the OpenPGP card, whenever such a new version would be designed. The current OpenPGP cards have a force signature PIN flag which can be set so only one signature is issued with one PIN entry. I'd like to request similar

Re: More secure than smartcard or cryptostick against remote attacks?

2013-02-08 Thread Niels Laukens
On 2013-02-08 10:48, Peter Lebbing wrote: On 08/02/13 03:12, Josef Schneider wrote: With GnuPG on the other hand someone who has access to my PC can sign whatever he likes and sign as much as he likes, as long as my card reader is attached Just so you know, the OpenPGP card has a forcesig,

Re: Smartcard reader with pin-pad: working combo?

2013-02-08 Thread Niels Laukens
On 2013-02-08 11:23, Hendrik Jäger wrote: Hello Niels On Fri, 08 Feb 2013 10:10:56 +0100 Niels Laukens ni...@dest-unreach.be wrote: How likely is it that this is going to work? The card seems to be supported by GnuPG, even for 4096RSA keys (which I plan to use). On the card’s page it

Re: More secure than smartcard or cryptostick against remote attacks?

2013-02-08 Thread Peter Lebbing
On 08/02/13 10:55, Niels Laukens wrote: I'm no expert, but isn't that only useful if you have a card-reader with pin-entry? If you use your compromised PC to enter your PIN, the malware can just replay that PIN to the card. Yes, I agree. Not that I am an expert. Peter. -- I use the GNU

Re: Smartcard reader with pin-pad: working combo?

2013-02-08 Thread Hendrik Jäger
Hello Niels On Fri, 08 Feb 2013 10:10:56 +0100 Niels Laukens ni...@dest-unreach.be wrote: Which brings me to my main question: I'm thinking of buying this smartcard: OpenPGP SmartCard V2 https://shop.kernelconcepts.de/product_info.php?cPath=1_26products_id=42 together with this reader: SCM

Re: Feature request for future OpenPGP card: force PIN

2013-02-08 Thread Werner Koch
On Fri, 8 Feb 2013 11:09, pe...@digitalbrains.com said: the same as for the signature key; both are a form of signatures. However, I'm not familiar with the rationale for adding the force signature PIN flag. That is simply a requirement due to the German law about qualified signatures. If

LiveCD with GPG 2.0.18+

2013-02-08 Thread Niels Laukens
Is there any LiveCD that has GPG 2.0.18 (or higher) on it? I plan to generate some secret keys to store on a smartcard, and to backup on a USB device. To minimize the risk of Key compromise, I'd like to do the key generation on an offline machine. I could do a regular install for this, and wipe

Re: LiveCD with GPG 2.0.18+

2013-02-08 Thread Peter Lebbing
Is there any LiveCD that has GPG 2.0.18 (or higher) on it? A quick check shows that Knoppix claims to have gnupg2 2.0.19-1 on Knoppix DVD versions 7.0.4 and 7.0.5. The version number is probably a Debian version number. There are files called dpkg-l-dvd-704.txt and ..705.txt in the DVD mirrors

Re: More secure than smartcard or cryptostick against remote attacks?

2013-02-08 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 El 08-02-2013 6:48, Peter Lebbing escribió: On 08/02/13 03:12, Josef Schneider wrote: With GnuPG on the other hand someone who has access to my PC can sign whatever he likes and sign as much as he likes, as long as my card reader is attached