Re: Trustworthy Android implementation ?

2014-04-27 Thread Mirimir 
On 04/27/2014 02:48 PM, Peter Lebbing wrote:
> On 27/04/14 22:40, Mirimir wrote:
>> Somebody doesn't like me :(
> 
> It's just a spam issue here at the mailing list currently. Every message I
> write, I get at least one, but more commonly two mails from so-called bachelor
> ladies, usually with a picture taken by a girl in the bathroom mirror. NSFW.
> 
> Peter.

Well, I've received several now from "Clara Anne". All feature the same
woman, and were apparently shot in the same session. Also, there's a
list on the counter, with some entries crossed out. I'm guessing that
she was filling an order ;) And her face seems dead, so maybe she's a
junkie. Very sad, altogether :(


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Trustworthy Android implementation ?

2014-04-27 Thread Mirimir 
On 04/27/2014 02:48 PM, Peter Lebbing wrote:
> On 27/04/14 22:40, Mirimir wrote:
>> Somebody doesn't like me :(
> 
> It's just a spam issue here at the mailing list currently. Every message I
> write, I get at least one, but more commonly two mails from so-called bachelor
> ladies, usually with a picture taken by a girl in the bathroom mirror. NSFW.
> 
> Peter.

Well, I don't mind free soft porn :)

But maybe it's from someone who's subscribed.

So hey, I invite y'all to send me complete headers for all that you get.
Maybe they slip up sometimes, and we can have some fun ;)


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Trustworthy Android implementation ?

2014-04-27 Thread Peter Lebbing 
On 27/04/14 22:40, Mirimir wrote:
> Somebody doesn't like me :(

It's just a spam issue here at the mailing list currently. Every message I
write, I get at least one, but more commonly two mails from so-called bachelor
ladies, usually with a picture taken by a girl in the bathroom mirror. NSFW.

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Trustworthy Android implementation ?

2014-04-27 Thread Mirimir 
Somebody doesn't like me :(

 Original Message 
Subject: Re: Re: Trustworthy Android implementation ?
Date: Sun, 27 Apr 2014 13:20:35 -0700
From: [REDACTED]
Reply-To: [REDACTED]
To: mirimir 

hi Mirimir
I'm [REDACTED], I'm 24  and here're two photos of myself. Just got your
msg back about my ad, I think am not late to reply :( :(  ...


 Original Message 
Subject: Re: Re: Trustworthy Android implementation ?
Date: Sun, 27 Apr 2014 20:27:00 + (UTC)
From: [REDACTED]
Reply-To: [REDACTED]
To: mirimir 

Hey cool you wrote back :) Wasn't sure if you were real or not it's hard
to tell sometimes lol. Can you send me a recent pic to this email? Also
you are looking for something really casual right? ...

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Trustworthy Android implementation ?

2014-04-27 Thread Mirimir 
On 04/27/2014 09:55 AM, Old_Professor wrote:
> I'm looking for a trustworthy and user-friendly encryption product to
> use on my Android smart phone.  I found four implementations of GPG. I
> don't know anything about the competence or trustworthiness of the
> implementers.
> 
> I'm concerned that if the phone is lost or stolen, how much resistance
> will the GPG implementation have to exposing my passphrase or private key.
> 
> I found:
> 
> APG - Thialfihar
> Gnu Privacy Guard -The Guardian Project
> OpenKeychain - Dominik Schürmann
> PGP SMS lite - woodkick

Better perhaps would be full-"disk" encryption. Some implementations can
wipe storage after N authentication failures. I know Guardian Rom the
best . There's also Mike Perry's
.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Trustworthy Android implementation ?

2014-04-27 Thread Old_Professor 
I'm looking for a trustworthy and user-friendly 
encryption product to use on my Android smart 
phone.  I found four implementations of GPG. I 
don't know anything about the competence or 
trustworthiness of the implementers.


I'm concerned that if the phone is lost or 
stolen, how much resistance will the GPG 
implementation have to exposing my passphrase or private key.


I found:

APG - Thialfihar
Gnu Privacy Guard -The Guardian Project
OpenKeychain - Dominik Schürmann
PGP SMS lite - woodkick



___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: A few newbie Qs

2014-04-27 Thread Simon Ward 


On 27 April 2014 11:34:07 BST, "Robert J. Hansen"  wrote:
>>execute arbitrary code with your credentials, you should simply
>> consider your GnuPG installation compromised whether you use the
>> clipboard or not.
>
>C&P is a time machine.
>
>If I enter a passphrase normally on Monday and my machine is
>compromised
>on a Tuesday, I can be confident my certificate is still secure because
>I never entered my passphrase on a compromised machine.  If I enter a
>passphrase via C&P on Monday and my machine is compromised on a
>Tuesday,
>I suddenly have to worry: was my passphrase still in my C&P buffer? 
>Did
>I remember to wipe the C&P buffer?  Did the C&P buffer get wiped
>securely?  Did I...

The password manager should clear or overwrite the clipboard after a short 
time, which should help. Keepass includes "timed clipboard clearing" in its 
feature list. Of course, there is still the question of whether it does (or 
can*) do it securely.

(*It's possible to clear the X clipboard, but I'm not sure if it remains in 
memory)

Simon
-- 
Sent from Kaiten Mail. Please excuse my brevity.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: UI terminology for calculated validities

2014-04-27 Thread Peter Lebbing 
On 27/04/14 13:11, Nicolai Josuttis wrote:
> Well, the "users" I asked were just ordinary people in my family
> (typical smart phone users).

Would those be smart users of a phone, or users of a smart phone? Where does the
intelligence reside? ;)

I'm reminded of a nice quote I saw in an e-mail signature.

"I have always wished for my computer to be as easy to use as my telephone; my
wish has come true because I can no longer figure out how to use my telephone"
 -- Bjarne Stroustrup

> Some of these policies would then be supported by GPG directly,
> but I might have to implement one or two in enigmail directly:
> a) This would allow only keys where the user locally signed the key
>with at least casual checking
>- Is there an option I can use to have this policy?

It's just b) without assigning trust to any key. I don't think there is a trust
model where you drop all assigned trust, but you can of course empty the trust
database (perhaps back it up, and restore it once the user selects a different
trust model).

> And:
> We might even split option a) in:
> a1) allow keys where I personally signed with casual verification
> a2) allow keys where I personally signed with extensive verification

Doesn't sound like a "let's make this less confusing for non-expert users"
thing. Also, making it configurable seems to imply to me that users would want
to switch back and forth. Otherwise, they would just use the verification effort
they feel comfortable with, and sign keys as "0x10 Generic certification" rather
than using "casual" and "positive" certifications. Without ever seeing those
descriptions, by the way, no need to burden them with those.

HTH,

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

C&P'ing passphrases (was Re: A few newbie Qs)

2014-04-27 Thread Peter Lebbing 
On 27/04/14 12:34, Robert J. Hansen wrote:
> I think so, but I'm well-known for being barking mad.

"Woof" back at you.

> Generally speaking, it is suboptimal to enter passphrases via C&P.  It
> makes it possible for a compromise tomorrow to discover the passphrase
> you entered today.

But I will just enter the same passphrase again tomorrow. Even if I notice I've
been compromised, it is unlikely that I notice this on the day of the
compromise. Even if I knew when the compromise happened, I wouldn't rely on my
memory to remember which passphrases I entered since. So, in conclusion, when I
notice my machine is compromised, I need to consider everything I access through
a passphrase using that machine as compromised, replace all those passphrases
and contemplate what the attacker could have done with the compromised services.

I don't think the risks I ran and the actions I need to take when my machine is
compromised are any different whether I use C&P or enter them directly, for the
common case that I regularly use the passphrase.

> I don't doubt there are situations where it makes sense to use C&P.
> I've yet to find one, though.

Well, you can't integrate your password manager with everything you need
passphrases for. And I highly prefer the more than hundred randomly-generated
passphrases[1] in my KeePass over trying to think of more than a hundred good
passphrases and remember them. I consider that w beyond my capabilities.
That word needs even more vowels, but it would make it hard to read ;).

Still, if there is a real risk that websites see my clipboard, I definitely want
to know.

Cheers,

Peter.

[1] By the way, the best part of those passphrases aren't protected on my
system; they are in my browser's unencrypted credentials database and the
password for the KeePass database is a single lowercase "a" because you have to
enter something. They are just accounts on websites. Passphrases I do consider
important are in another well-protected KeePass database (and are copy-pasted).

I recently moved Amazon to the protected database because I noticed you can
order and pay stuff without re-entering your credit card number. It will be
shipped to one of your pre-existing addresses, but I still did not appreciate
it, so I changed the passphrase and moved it to my protected database.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: A few newbie Qs

2014-04-27 Thread Robert J. Hansen 
> Is this really a useful criterium?

I think so, but I'm well-known for being barking mad.  Hornswoop me
bungo pony, dogsled on ice (red and black, it's their color scheme).  By
the silverfish imperetrix whose incorrupted eye sees through the charms
of doctors and their wives...

(At some point it's really hard to distinguish random Blue Oyster Cult
lyrics from a full-on psychotic episode.)

> execute arbitrary code with your credentials, you should simply
> consider your GnuPG installation compromised whether you use the
> clipboard or not.

C&P is a time machine.

If I enter a passphrase normally on Monday and my machine is compromised
on a Tuesday, I can be confident my certificate is still secure because
I never entered my passphrase on a compromised machine.  If I enter a
passphrase via C&P on Monday and my machine is compromised on a Tuesday,
I suddenly have to worry: was my passphrase still in my C&P buffer?  Did
I remember to wipe the C&P buffer?  Did the C&P buffer get wiped
securely?  Did I...

Generally speaking, it is suboptimal to enter passphrases via C&P.  It
makes it possible for a compromise tomorrow to discover the passphrase
you entered today.

I don't doubt there are situations where it makes sense to use C&P.
I've yet to find one, though.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: UI terminology for calculated validities

2014-04-27 Thread Nicolai Josuttis 
Am 25.04.2014 19:43, Bernard Tyers schrieb/wrote:
> At the risk of being flamed, can I suggest asking the users what
> they think?
> 
> Nicolai, by the look of it you've carried out some user research.
> I guess so by the "real world" discussion you posted in a message.
> 
Well, the "users" I asked were just ordinary people in my family
(typical smart phone users).

The funny thing is, today I discussed this again with one.
The outcome was surprisingly a renaissance of the term "valid"
but in a slightly different sense.
Valid meaning "validated by me or other people I trust".

And the result was to provide three "trust model" options
in a mailer:

--
To send encrypted, accept
a) only keys validated/signed by me personally
b) only keys validated/signed by my or others I trust
c) all keys that are neither disabled nor expired nor revoked
---

With the following tooltips:

a) only keys validated/signed by me personally
  Tooltip:
  This option is provided to deal with the danger of faked keys,
  not trusting anybody else.
  Validated keys are keys either signed by you or
  signed by other people you trust.

b) only keys validated/signed by my or others I trust
  Tooltip:
  This option is provided to deal with the danger of faked keys,
  trusting other people you categorized as trustworthy.
  Validated keys are keys either signed by you or
  signed by other people you trust.

c) all keys that are neither disabled nor expired nor revoked
  Tooltip:
  This option forces encryption whenever you have
  a key that is not disabled by you or revoked/expired by the owner.
  Because these keys are not necessarily validated
  by you or people you trust, there is a risk
  that you use faked keys so that others than the
  requested receivers can read the content of the encrypted email.

Some of these policies would then be supported by GPG directly,
but I might have to implement one or two in enigmail directly:
a) This would allow only keys where the user locally signed the key
   with at least casual checking
   - Is there an option I can use to have this policy?
b) This would allow keys valid according to the WoT.
   As the current implementation seems only to check the first key
   for an email address, the workaround would have to be implemented
   in enigmail directly.
c) b) but also allow unknown.
   This would match --trust-model always

And:
We might even split option a) in:
a1) allow keys where I personally signed with casual verification
a2) allow keys where I personally signed with extensive verification

-- 
Nico

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Managing Subkeys for Professional and Personal UIDs

2014-04-27 Thread Mike Cardwell 
* on the Sat, Apr 26, 2014 at 10:21:42PM +, John Sockwell wrote:

> I'm looking for best practices in creating and managing multiple
> subkeys and uids.
> 
> In my scenario, I have a personal computer and personal email address.
> In addition, I have an employer provided computer and employer
> email address.
> 
> I'd like to create a key architecture where if I'm ever compelled to
> compromise, revoke, or lose access to the signing and encryption keys
> on my work computer, the security and integrity of my personal files
> are preserved. The easiest solution seems to be generating separate
> primary keys for both identities. However, I believe this would
> undermine the WoT when I move to a new employer by not having all
> signing and encryption keys originating from the same primary key.
> 
> Is it possible to assign an encryption and signing sub key to a
> specific uid so I can separate the keys used?

I don't believe that is possible no.

> Is there a better way to achieve this goal through other signing
> techniques?

I solve this problem using an OpenPGP smart card. My PGP key never
touches my work machine, so I never have to worry about it being
compromised. When I left my previous job, I revoked the UID
containing the email address assigned by that company, and then
added the new UID for the new company.

-- 
Mike Cardwell  https://grepular.com https://emailprivacytester.com
OpenPGP Key35BC AF1D 3AA2 1F84 3DC3   B0CF 70A5 F512 0018 461F
XMPP OTR Key   8924 B06A 7917 AAF3 DBB1   BF1B 295C 3C78 3EF1 46B4


signature.asc
Description: Digital signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: A few newbie Qs

2014-04-27 Thread Peter Lebbing 
On 27/04/14 03:36, Robert J. Hansen wrote:
> Long passphrases also silently encourage users to do risky things like
> cut-and-paste them. (It's very easy for malware to look at the contents of
> your clipboard buffer.)

Is this really a useful criterium? Sure, by not using the clipboard you might
stop some non-specific malware that simply does data trawling by sending all
likely clipboard contents to a server so a hacker can see if it sees any
passphrases in there. But since the malware is already in the position to
execute arbitrary code with your credentials, you should simply consider your
GnuPG installation compromised whether you use the clipboard or not. It can
simply catch all calls to gpg2 or gpg-agent and prompt you for your passphrase.

If you're talking about a malicious site being open in the browser, I'd very
much like to hear about known, unfixed vulnerabilities that allow
server-supplied code to get at your clipboard. That would be quite a
vulnerability in my eyes.

I use Keepass2 under Debian GNU/Linux to keep all the passphrases I use on this
machine (but my OpenPGP keys are on a smartcard, they're not protected by a
password but by a PIN). Since I'm not aware that there exists a plugin for Linux
integrating Keepass2 and Firefox, I copy-paste all my web passwords, including
high-profile stuff like PayPal. Also, there are some things that will never have
integrated Keepass2 support, like command line tools, which require me to
copy-paste. If I need to check which /other/ websites I have open at the same
time (or rather: close all open websites) whenever I use Keepass2, I'd very much
like to know.

Cheers,

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: C# .dll availability?

2014-04-27 Thread Sten Lindgren 

On 2014-04-25 00:07, Charles Spitzer wrote:


Is there a GnuPGP project anywhere that does PGP encryption that is
usable in a C# application?


Bouncy Castle handles OpenPGP for C# (and Java) you can get it at 
http://www.bouncycastle.org/csharp/ . It uses its own license so its not 
GPL licensed nor part of GnuPG. It still might be useful.





___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users