1450 entries in 0.377s
mircea_popescu: today, the masses are in the exact situation, the signature is
gpg.
mircea_popescu: in other news, i'm getting artists to create
gpg keys and at an incredible rate.
mircea_popescu: you're going to "imagine we use
gpg to sign transactions on the client side so even if the attacker gets your server there's jack shit he can do as he can't enter arbitrary txs" ?
mircea_popescu: list of holder
gpg keys encrypted with owner's key publioshed on btctalk
mircea_popescu: wait. you mean
gpg verify or bitcoin addy sig verify ?
mircea_popescu: ThickAsThieves it certainly wouldn't be for an exchange that doesn't offer signed proofs and doesn't use
gpg contracts.
mircea_popescu: have good encryptioon between trade engine and webservers - even if your users don't know
gpg you do.
mircea_popescu: there's parts about mpex that are very open, such as for instance the use of
gpg to protect orderflow
mircea_popescu: on mpex ? you get
gpg signed receipts for trades / acct statements
mircea_popescu: Step 4. Your account is now set up, you can use it in full confidence. Yes, this includes the inconvenient step of transferring
GPG-encoded strings from a cold machine to a hot machine.
mircea_popescu: for some reason
gpg thinks it's a detached signature ?!
mircea_popescu: are you cleanly doing your encoding ? is your key correct ? (siometimes
gpg defaults to wrong key, use a ! at the end of your keyid to force)
mircea_popescu: you can also issue orders through it, via $post blabla, where blabla is the url of a pastebin where you've uploaded your
gpg encrypted clearsigned order
mircea_popescu: the catastrophic failure mode is for each issuer to get a
gpg-encypted list of the holder's fingerprints. much like rg got on the delisting of s.bvps
mircea_popescu: the
gpg parser mostly ignores spaces/newlines/etc EXCEPT it wants a newline after the begin sig tag
mircea_popescu: the structure of a
gpg signed message is, there's a header (begin blabla, comment whatever), then a message, then a signature ehader, then the signature
mircea_popescu: but it's the fact. first financial institution to use
gpg ? mpex.
mircea_popescu: actually the people who deal dope and the people who use
gpg are like oil and water it seems.
mircea_popescu: i know nothing at all. you can create a
gpg sig right now as 34jk5hty895ytg9g4t
mircea_popescu: someone sent me an email which literalyl reads "
gpg --armor --output pubkey.txt -- export <their name>"
mircea_popescu: you just start
gpg and paste the content of gribble's link in there
mircea_popescu: waaah, mpex uses proven encryption but
gpg is hard and the submit screen is plain...
mircea_popescu: i love the shock people get when they discover that... wait!!!! while we knew better and ignoed
gpg and didn't user irc and etc stuff was happening!
mircea_popescu: it's one point that's been gained through experience so far,
gpg is good.
mircea_popescu: but otherwise yes,
gpg is the correct way to handle that.
mircea_popescu: register there and I've never used
GPG or something like that. :)
mircea_popescu: ukto apparently for thinking nefario can run
gpg --clearsing by hand ?
mircea_popescu: all the while, inaba is explaining why the nebulous conflartion of
gpg, wot and everything else in his head is "marginal"
mircea_popescu: knotwork nah
gpg string is just submited as a post to an url.
mircea_popescu: not unless either some servers are seriously broken into or someone cracks
gpg mircea_popescu: and this was like, 3 days after i explained
gpg to him. understand, guy didn't even know linux existed on like, the 5th
mircea_popescu: in truth, much of the beauty of
gpg is lost on the avg internet user.
mircea_popescu: and that faces serious problems because glbse never used
gpg keys. and so...
mircea_popescu: online the
gpg system might be sufficient (hasn't really been tested yet)
mircea_popescu: BTC-Mining well, i'll give you 10 BTC which is admittedly more than market value and you sign a
gpg receipt renouncing any claim on that contract.
mircea_popescu: once he submits a
gpg signed apology for his idiocy yest
mircea_popescu: i think actually it should be "illegal" to have an exchange w/o
gpg from now on.
mircea_popescu: Oct 01 01:47:42 <mircea_popescu> Obsi ty, but it doesn't seem like anyone has a choice. glbse is going away. now's everyone's change to learn
gpg.