Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Martin Gollowitzer
* Doug Barton do...@dougbarton.us [110227 05:30]: If you look at the characteristics of the actual messages encrypted mail is very similar whether it's in-line or MIME. It's signed messages that make things interesting because the signature in a MIME message is actually (sort of) an

Re: [SOLVED] SCR3310 reader working for root, but not scard group

2011-02-27 Thread Martin Gollowitzer
* Todd A. Jacobs codegnome.consult...@gmail.com [110227 04:02]: Here are the steps I needed to take under Ubuntu 10.10 to get this particular reader working properly as a mortal user. You could also have run the script [1] linked from the only up-to-date OpenPGP smartcard howto [2] I'm aware

Re: Smart Card Physical Best Practices?

2011-02-27 Thread Martin Gollowitzer
* Grant Olson k...@grant-olson.net [110227 04:11]: I usually just leave it in until I leave the computer for lunch or a meeting or whatever. Same here, but I always take the card with me if I leave the room. One thing I didn't realize at first, is that once you've unlocked either your

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Ingo Klöcker
On Saturday, February 26, 2011, MFPA wrote: Hi On Friday 25 February 2011 at 1:45:03 AM, in mid:87lj14x4yo@servo.finestructure.net, Jameson Rollins wrote: Yikes! I thought we were almost done killing inline signatures! Don't revive it now! If PGP/MIME is broken on android,

Re: GnuPG Card with ssh authentication problems

2011-02-27 Thread Werner Koch
On Sun, 27 Feb 2011 06:43, br...@frogandbear.net said: I do find it a little odd that GnuPG's very own (and from the looks of it, old) documentation (1) lists the 3121 as a supported reader, along with several other outdated models. Sorry for that, the howto is a bit outdated. Omnikey based

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Robert J. Hansen
On 2/26/11 9:24 PM, Jameson Rollins wrote: http://josefsson.org/inline-openpgp-considered-harmful.html * IT DOESN'T HANDLE ATTACHMENTS. That's fine with me: 95%+ of my messages don't require attachments. Any technology that can hit 95% of the use case is fine by me. * IT DOESN'T LIKE

GPA -

2011-02-27 Thread Jeffrey Walton
Hi All, I recently installed GPA. I'm trying to locate a friend's public key by either name or email address. GPA appears to only offer Key ID (which I don't have). Does anyone have tricks for locating a key by name or email? Thanks, Jeff ___

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread David Tomaschik
On 02/27/2011 12:21 PM, Robert J. Hansen wrote: On 2/26/11 9:24 PM, Jameson Rollins wrote: http://josefsson.org/inline-openpgp-considered-harmful.html * IT DOESN'T HANDLE ATTACHMENTS. That's fine with me: 95%+ of my messages don't require attachments. Any technology that can hit 95% of

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Martin Gollowitzer
* David Tomaschik da...@systemoverlord.com [110227 19:22]: How about inline confuses users who don't know anything about OpenPGP? 100% agreed. Thank you! Martin pgpOXtxwgzgho.pgp Description: PGP signature ___ Gnupg-users mailing list

Re: GnuPG Card with ssh authentication problems

2011-02-27 Thread Grant Olson
On 02/27/2011 11:40 AM, Werner Koch wrote: On Sun, 27 Feb 2011 06:43, br...@frogandbear.net said: I do find it a little odd that GnuPG's very own (and from the looks of it, old) documentation (1) lists the 3121 as a supported reader, along with several other outdated models. Sorry for

Re: GPA -

2011-02-27 Thread Werner Koch
On Sun, 27 Feb 2011 17:54, noloa...@gmail.com said: I recently installed GPA. I'm trying to locate a friend's public key by either name or email address. GPA appears to only offer Key ID (which I don't have). You have to use the command line: gpg2 --search-key f...@example.org then

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Robert J. Hansen
On 2/27/11 1:13 PM, David Tomaschik wrote: How about inline confuses users who don't know anything about OpenPGP? 1. Why are you sending them signed emails anyway? 2. And seeing strange MIME attachments doesn't confuse people? ___ Gnupg-users

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Aaron Toponce
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 David Tomaschik da...@systemoverlord.com wrote: How about inline confuses users who don't know anything about OpenPGP? Meh. If anything, inline signatures sparked conversation. - -- Sent from my Android phone with K-9 Mail. Please excuse my

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Martin Gollowitzer
* Robert J. Hansen r...@sixdemonbag.org [110227 20:28]: How about inline confuses users who don't know anything about OpenPGP? 1. Why are you sending them signed emails anyway? I sign *all* my e-mail except for messages sent from my mobile (in that case, my signature tells the receiver why

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Werner Koch
Hi, I once hoped the discussion about MIME vs. crufty inline signatures has been settled a long time ago. Today that even Microsoft Outlook handles it correctly for more than 7 years, the new excuse seems to be some buggy new mail applications. I don't buy such an excuse. MIME is so primitive

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Grant Olson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 02/27/2011 02:37 PM, Martin Gollowitzer wrote: * Robert J. Hansen r...@sixdemonbag.org [110227 20:28]: How about inline confuses users who don't know anything about OpenPGP? 1. Why are you sending them signed emails anyway? I sign *all*

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Robert J. Hansen
On 2/27/11 2:37 PM, Martin Gollowitzer wrote: I sign *all* my e-mail except for messages sent from my mobile (in that case, my signature tells the receiver why the message is not signed and offers the receiver to request a signed proof of authenticity later) or messages to people who can't

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Ingo Klöcker
On Sunday 27 February 2011, Aaron Toponce wrote: David Tomaschik da...@systemoverlord.com wrote: How about inline confuses users who don't know anything about OpenPGP? Meh. If anything, inline signatures sparked conversation. Yeah. I think we should stop this pointless discussion. I doubt

Android PGP/MIME test results

2011-02-27 Thread Grant Olson
Provider: Boost Manufacturer: Motorola Model: I1 Droid version: 1.5 This phone has two mail applications by default, one called 'email' and another called 'gmail'. Both displayed PGP/MIME messages without any trouble. Neither verified sigs of course. I see no easy way to determine the version

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread David Shaw
On Feb 27, 2011, at 2:48 PM, Robert J. Hansen wrote: 2. And seeing strange MIME attachments doesn't confuse people? Less than strange text fragments at the head and the bottom of a message (Some people even think they are being spammed when they see inline PGP data), because an attachment

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Aaron Toponce
On 02/27/2011 12:37 PM, Martin Gollowitzer wrote: I sign *all* my e-mail except for messages sent from my mobile (in that case, my signature tells the receiver why the message is not signed and offers the receiver to request a signed proof of authenticity later) or messages to people who can't

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Doug Barton
On 02/27/2011 02:04, Ingo Klöcker wrote: On Saturday, February 26, 2011, MFPA wrote: Hi On Friday 25 February 2011 at 1:45:03 AM, in mid:87lj14x4yo@servo.finestructure.net, Jameson Rollins wrote: Yikes! I thought we were almost done killing inline signatures! Don't revive it now! If

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Doug Barton
On 02/27/2011 00:25, Martin Gollowitzer wrote: * Doug Bartondo...@dougbarton.us [110227 05:30]: If you look at the characteristics of the actual messages encrypted mail is very similar whether it's in-line or MIME. It's signed messages that make things interesting because the signature in a

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread David Shaw
On Feb 27, 2011, at 2:48 PM, Robert J. Hansen wrote: On 2/27/11 2:37 PM, Martin Gollowitzer wrote: I sign *all* my e-mail except for messages sent from my mobile (in that case, my signature tells the receiver why the message is not signed and offers the receiver to request a signed proof of

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 El 27-02-2011 15:30, Martin Gollowitzer escribió: * David Tomaschik da...@systemoverlord.com [110227 19:22]: How about inline confuses users who don't know anything about OpenPGP? 100% agreed. Thank you! IMHO they would be even more

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Doug Barton
On 02/27/2011 11:36, Werner Koch wrote: Hi, I once hoped the discussion about MIME vs. crufty inline signatures has been settled a long time ago. I love/admire your optimism. :) Today that even Microsoft Outlook handles it correctly for more than 7 years, the new excuse seems to be some

Re: Android PGP/MIME test results

2011-02-27 Thread Aaron Toponce
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Grant Olson k...@grant-olson.net wrote: Provider: Boost Manufacturer: Motorola Model: I1 Droid version: 1.5 This phone has two mail applications by default, one called 'email' and another called 'gmail'. Both displayed PGP/MIME messages without

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Robert J. Hansen
On Feb 27, 2011, at 5:17 PM, David Shaw wrote: Can I see the HCI study that MIME attachments confuse people? ;) I would love to see such a study. However, I never made that claim. :) Someone else made the claim PGP/MIME is superior because inline OpenPGP signatures confuse people. Okay,

Question regarding shared keys

2011-02-27 Thread Denise Schmid
Hello list, first of all: Sorry if my question reaches the wrong list, but I have a question someone on this list may probably answer easily. If a company has shared keys: How does encryption work then? Are several owners of a share needed to encrypt data? I just try to find out how it works

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Robert J. Hansen
I disagree with this. Obviously a bad signature doesn't say much (except perhaps check your mail system - it's breaking things), but there is still value in the continuity between multiple signed messages. It's important to not make of that more than it is: for all I know there are 200

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 El 27-02-2011 20:54, Jean-David Beyer escribió: Faramir wrote: ... IMHO they would be even more confused if they can read the message. And some others see the attached signatures and think Virus! Hit delete, hit delete!. ... If someone

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Robert J. Hansen
I'm not at all surprised that you had those results. A limited subset of people have support for OpenPGP signatures. A limited subset of those people actually verify signatures. A limited subset of those people actually pay attention to what those signatures say. Yes: but one would hope

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread David Shaw
On Feb 27, 2011, at 10:05 PM, Robert J. Hansen wrote: I'm not at all surprised that you had those results. A limited subset of people have support for OpenPGP signatures. A limited subset of those people actually verify signatures. A limited subset of those people actually pay attention

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread David Shaw
On Feb 27, 2011, at 9:38 PM, Robert J. Hansen wrote: I disagree with this. Obviously a bad signature doesn't say much (except perhaps check your mail system - it's breaking things), but there is still value in the continuity between multiple signed messages. It's important to not make of

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Ben McGinnes
On 28/02/11 12:35 PM, Robert J. Hansen wrote: On Feb 27, 2011, at 5:17 PM, David Shaw wrote: Can I see the HCI study that MIME attachments confuse people? ;) I would love to see such a study. However, I never made that claim. :) Someone else made the claim PGP/MIME is superior

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Ben McGinnes
On 28/02/11 2:02 PM, David Shaw wrote: I'm not at all surprised that you had those results. A limited subset of people have support for OpenPGP signatures. A limited subset of those people actually verify signatures. A limited subset of those people actually pay attention to what those

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Robert J. Hansen
I think we're missing each other here. We have Martin (the real one), the fake Martin (let's call him Marty), and various other people on a mailing list. Martin always signs his messages. One day Marty shows up and tries to pretend to be Martin. Martin, not wanting someone else to

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread David Shaw
On Feb 27, 2011, at 10:27 PM, Robert J. Hansen wrote: I think we're missing each other here. We have Martin (the real one), the fake Martin (let's call him Marty), and various other people on a mailing list. Martin always signs his messages. One day Marty shows up and tries to pretend

[was: Re: PGP/MIME considered harmful for mobile]

2011-02-27 Thread Daniel Kahn Gillmor
On 02/27/2011 08:31 PM, Robert J. Hansen wrote: the default mail app on a Verizon Droid X running Android 2.2 has broken MIME support. Please post this bit of useful details to the Android PGP/MIME test results thread started by Grant Olson, which actually has an acceptable signal-to-noise

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Grant Olson
On 02/27/2011 10:22 PM, Ben McGinnes wrote: On 28/02/11 2:02 PM, David Shaw wrote: I'm not at all surprised that you had those results. A limited subset of people have support for OpenPGP signatures. A limited subset of those people actually verify signatures. A limited subset of those

Re: [was: Re: PGP/MIME considered harmful for mobile]

2011-02-27 Thread Robert J. Hansen
Please post this bit of useful details to the Android PGP/MIME test results thread started by Grant Olson, which actually has an acceptable signal-to-noise ratio. As I have said a few times now, I have been out of town at a funeral. I have just now returned and am for the most part

Re: Question regarding shared keys

2011-02-27 Thread David Shaw
On Feb 27, 2011, at 8:25 PM, Denise Schmid wrote: Hello list, first of all: Sorry if my question reaches the wrong list, but I have a question someone on this list may probably answer easily. If a company has shared keys: How does encryption work then? Are several owners of a share

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 El 28-02-2011 0:27, Robert J. Hansen escribió: ... Then we're at an impasse, because that claim wouldn't fly with me. Let's imagine Fake-Martin and Real-Martin (FM and RM). FM: [message] RM: Hey, that's not me! I'm me. See? I've signed

Re: Android PGP/MIME test results

2011-02-27 Thread David Shaw
Not exactly Android, but FWIW, an iPod touch (which has the same mail program as an iPhone) displays PGP/MIME just fine (as in shows the mail - but doesn't verify the signature). David ___ Gnupg-users mailing list Gnupg-users@gnupg.org

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread David Shaw
On Feb 27, 2011, at 8:35 PM, Robert J. Hansen wrote: On Feb 27, 2011, at 5:17 PM, David Shaw wrote: Can I see the HCI study that MIME attachments confuse people? ;) I would love to see such a study. However, I never made that claim. :) Someone else made the claim PGP/MIME is

Re: Rebuilding the private key from signatures

2011-02-27 Thread David Shaw
On Feb 24, 2011, at 9:39 AM, Atom Smasher wrote: On Thu, 24 Feb 2011, Aaron Toponce wrote: However, I was in a discussion with a friend, and the topic came up that it is theoretically possible to rebuild your private key if someone had access to all your signed mail. We debated the size

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Ben McGinnes
On 28/02/11 2:59 PM, Grant Olson wrote: I've been toying with the idea of expiring my key and seeing how long it takes for anyone to notice. In fact, I've just decided I will do this sometime in the next year. It'll be interesting to see how long it takes people to notice even after I've

Re: Android PGP/MIME test results

2011-02-27 Thread Grant Olson
On 02/27/2011 11:29 PM, David Shaw wrote: Not exactly Android, but FWIW, an iPod touch (which has the same mail program as an iPhone) displays PGP/MIME just fine (as in shows the mail - but doesn't verify the signature). David It's worth a lot. Since the rational behind this thread

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Grant Olson
On 02/27/2011 11:48 PM, Ben McGinnes wrote: On 28/02/11 2:59 PM, Grant Olson wrote: I've been toying with the idea of expiring my key and seeing how long it takes for anyone to notice. In fact, I've just decided I will do this sometime in the next year. It'll be interesting to see how long

Re: Android PGP/MIME test results

2011-02-27 Thread Robert J. Hansen
- The service provider Verizon Wireless. - The make and model of the phone. Droid X - The droid version. 2.2.1 - The email application(s) installed. Unknown: just the default Verizon Wireless email messaging app. - If said application(s) displayed the text of a PGP/MIME message so

Re: Question regarding shared keys

2011-02-27 Thread Denise Schmid
It depends on what you mean by a shared key. There is just giving a copy of the key to multiple people (in which case any one of them can use it), or there are various key splitting algorithms where a key is broken into a number of pieces, and a specified subset of those pieces can come