Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Stefan Claas
On 05.06.17 01:05, Ben McGinnes wrote: > On Sun, Jun 04, 2017 at 10:47:56PM +0200, Stefan Claas wrote: >> I'm not yet familar with the TOFU model, but if it helps to spot a >> fake pub key imediately, in addition to the regular trust-model i >> see no reason why not. > That's pretty much exactly

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Ben McGinnes
On Sun, Jun 04, 2017 at 10:47:56PM +0200, Stefan Claas wrote: > > I'm not yet familar with the TOFU model, but if it helps to spot a > fake pub key imediately, in addition to the regular trust-model i > see no reason why not. That's pretty much exactly what it does. TOFU stands for Trust On

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Ben McGinnes
On Sun, Jun 04, 2017 at 08:29:31PM +0200, Kristian Fiskerstrand wrote: > On 06/04/2017 11:21 AM, Stefan Claas wrote: > >> The reason why i ask, i started to use Thunderbird with Enigmail >> and Enigmail shows me always Untrusted Good Signature with a 32bit >> key ID, when i have not carefully

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Stefan Claas
On 04.06.17 22:32, Kristian Fiskerstrand wrote: > On 06/04/2017 10:25 PM, Stefan Claas wrote: >> With Thunderbird/Enigmail (i can't speak for other apps) a user new to GnuPG >> and and not savvy with checking email headers and not carefully checking the >> fingerprint (he must click addionally on

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Kristian Fiskerstrand
On 06/04/2017 10:25 PM, Stefan Claas wrote: > With Thunderbird/Enigmail (i can't speak for other apps) a user new to GnuPG > and and not savvy with checking email headers and not carefully checking the > fingerprint (he must click addionally on the Details button) and who has > never > signed a

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Stefan Claas
On 04.06.17 20:29, Kristian Fiskerstrand wrote: > On 06/04/2017 11:21 AM, Stefan Claas wrote: >> The reason why i ask, i started to use Thunderbird with Enigmail and >> Enigmail shows me always Untrusted Good Signature with a 32bit key ID, >> when i have not carefully verified the persons pub key

Re: scute / firefox: cannot connect to GPG agent

2017-06-04 Thread Fabian Peter Hammerle
Hi, Thanks for your reply! > The GPG_AGENT_INFO variable must have the following form: > "PATH_TO_SOCKET:PID:VERSION", where PID is the running agent's process ID > and VERSION is the version of the agent protocol (which must be 1). > Otherwise Scute will ignore the variable. > > So try instead:

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Kristian Fiskerstrand
On 06/04/2017 11:21 AM, Stefan Claas wrote: > The reason why i ask, i started to use Thunderbird with Enigmail and > Enigmail shows me always Untrusted Good Signature with a 32bit key ID, > when i have not carefully verified the persons pub key and --lsign'ed > the pub-key. Showing only the long

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Stefan Claas
On 04.06.17 13:19, Ludwig Hügelschäfer wrote: > On 04.06.17 12:39, Stefan Claas wrote: >> On 04.06.17 11:50, Ben McGinnes wrote: > (...) > >>> then add "keyid-format 0xLONG" to your gpg.conf file. >>> >> I did that, but Enigmail still shows me the short key-id. :-( > The next major version of

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Ludwig Hügelschäfer
On 04.06.17 12:39, Stefan Claas wrote: > On 04.06.17 11:50, Ben McGinnes wrote: (...) >> then add "keyid-format 0xLONG" to your gpg.conf file. >> > I did that, but Enigmail still shows me the short key-id. :-( The next major version of Enigmail will show long keyIds everywhere. Ludwig

Re: scute / firefox: cannot connect to GPG agent

2017-06-04 Thread Damien Goutte-Gattat
Hi, On 06/03/2017 12:48 AM, Fabian Peter Hammerle wrote: As far as I understand gpg-agent is running. Can you please check whether it is really the case? E.g., check that the socket indicated by "gpgconf --list-dir agent-socket" does exist? After reading

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Stefan Claas
On 04.06.17 12:50, Robert J. Hansen wrote: >> P.S. With scallion it took me only seconds/or a minute to generate >> a fake pub-key with the same 32bit key id, on my old notebook. > The question then becomes how hard it would be to forge a qidenticon. > There's not a whole lot of entropy there. I'm

scute / firefox: cannot connect to GPG agent

2017-06-04 Thread Fabian Peter Hammerle
Hi, I am trying to setup Scute (http://scute.org/) so I can use my authentication subkey for client authentication in Firefox. I followed the steps in Scute's manual to setup Firefox. http://scute.org/scute.html/Application-Configuration.html My problem is that I keep getting these warnings

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Robert J. Hansen
> P.S. With scallion it took me only seconds/or a minute to generate > a fake pub-key with the same 32bit key id, on my old notebook. The question then becomes how hard it would be to forge a qidenticon. There's not a whole lot of entropy there. ___

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Stefan Claas
On 04.06.17 11:50, Ben McGinnes wrote: > On Sun, Jun 04, 2017 at 11:21:33AM +0200, Stefan Claas wrote: >> The reason why i ask, i started to use Thunderbird with Enigmail and >> Enigmail shows me always Untrusted Good Signature with a 32bit key ID, >> when i have not carefully verified the

Re: Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Ben McGinnes
On Sun, Jun 04, 2017 at 11:21:33AM +0200, Stefan Claas wrote: > Hi, > > i like to ask application developers if it's possible to implement, > in the future, identicons like for example Bitmessage has? > > https://github.com/jakobvarmose/go-qidenticon It's possible, but it's highly unlikely that

Question for app developers, like Enigmail etc. - Identicons

2017-06-04 Thread Stefan Claas
Hi, i like to ask application developers if it's possible to implement, in the future, identicons like for example Bitmessage has? https://github.com/jakobvarmose/go-qidenticon The reason why i ask, i started to use Thunderbird with Enigmail and Enigmail shows me always Untrusted Good Signature