tmsr - Search: pgp

900+ entries in 0.279s

anond: 1º line: "-----BEGIN PGP PUBLIC KEY BLOCK-----"

anond: the header is "-----BEGIN PGP PUBLIC KEY BLOCK-----"

mod6: does it say something like "PGP PUBLIC KEY" at the top?

asciilifeform: btw do we have even 1 pgp-signed thing from herr s ?

scriba: Logged on 2016-09-22: [13:18:17] <a111> Logged on 2015-12-14 02:37 PeterL: so I was playing with the idea of http://trilema.com/2015/the-pgp-w-mode/

a111: Logged on 2015-12-14 02:37 PeterL: so I was playing with the idea of http://trilema.com/2015/the-pgp-w-mode/

Framedragger: i mean personally, to be able to exchange pgp-signed sha512 hashes would make me super happy already - maybe premature ejaculation, yes, but it'd be a *useful facility*.

asciilifeform: aaaaand another heathen 'pgp is obsolete, here's a' >> https://github.com/stealth/opmsg

asciilifeform: 'Although boatmanstv at one point switched to PGP-encrypted e-mail (which he referred to as “ppg”) using “darknetstv@outlook.com” with the OCE, because his recipient was in fact an FBI agent, that didn’t matter. ...'

adlai: covertress: you've evidently passed the "register PGP key and operate it" barrier, but you're failing the "not annoy people" barrier. you're not the first person to do this, and won't be the last. I suggest you NOT take this personally, figure out why you're failing this test, and... better luck next time.

asciilifeform: if you trust the counterparty, he pgp's you an addr and you pay to that.

asciilifeform: it isn't pgp where you might have a 16384-bit key or a 1024 etc.

asciilifeform: a while ago i briefly considered showing up at the 'pgp conference' but decided against. there is a difference between entomologist and those fellas who fuck wasp hives

asciilifeform: at the 'pgp conference',

Framedragger: look at that one person knows to actually include human readable timestamp into the inside of a pgp signed message which deals with timing-sensitive info!!!

alice_: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: Keybase OpenPGP v2.0.55 Comment: https://keybase.io/crypto xsFNBFevnesBEAC90aLfcq+wrWVKGcQWUd+NmB/0kK7OONd0Tg2OUgfHE2RtZSzG mqgsiAmyPsz+R6B3VwkMd3pBiuAZ8IN/jf0px+iikmo0vvWemsnVTUM0mtyoFecy /qyj1+mwjLrzR7UMDP8789JBwxecY+1fS6k4BQio3gGvmqzGr76sAjTZlIbkPs80 Nr502+QhvfOSjnjFTfQkXrzjrssjJp+jEH0OdkC/UT7H0lCWy957UPklwXlEPnu/ KQbcDoV2HWSEG0hW3Ig7+4qC03Bp0W9Z9lRTYZVIbTnDLJ+z4/J1fMu1EnmZkEKQ aH0SCtgI

asciilifeform: alice_: you register a pgp pubkey fingerprint.

asciilifeform: alice_: consider registering your pgp pubkey with deedbot.

mircea_popescu: got a pgp key ?

asciilifeform: (e.g., the case of pgp)

asciilifeform: unveiled at the 'pgp conference', no less.

shinohai: Logged 07:22 +VAodminnTer Hi, Can I generate my PGP using this site? https://pgpkeygen.com/ <<< foflmao

VAodminnTer: Hi, Can I generate my PGP using this site? https://pgpkeygen.com/

phf: oh damn it's prof katz, https://www.cs.umd.edu/~jkatz/papers/pgp-attack.pdf

phf: come to think of it sybil is not the right word in this case, on application level there's no psuedonymity and you only talk to people in wot. on transport level an attacker can construct a valid looking (struct layout wise) pgp packet, which in my naive spec implementation is handed over to gnupg. now you have a bunch of potential attack vectors here, but assuming there's no memory attacks in gnupg, race conditions in gpgme,

asciilifeform: adlai: must also point out, 'read signed document and then found matching pubkey' still conceivably leaves you behind a 'great firewall' where all pgp sigs visible match chairman mao's key perfectly

asciilifeform: (notice, if the tale of znort is to be taken at face value, the only thing that kept his edifice from burning down was a pgp sig.)

asciilifeform: the hearnia strategy, 'we'll steal your thing and make idiot version and sell it to EVERYONE as the Real Thing' was tried, yes, with pgp.

asciilifeform: kinda reminiscent of usg's incarnation of pgp.

mircea_popescu: you use pgp to decrypy that.

mircea_popescu: "come see what zimmerman thinks about encryption - a guy who admits to losing his pgp key sometime in the 90s and doesn't see the problem with this"

a111: Logged on 2016-08-17 16:20 mircea_popescu: "I doubt this will ever happen. Even he never cracked any PGP keys at all, the FUD he spread around was a nice way to get some free advertising. Look, people saying his name on gnupg and enigmail lists, which are quite popular I believe."

asciilifeform: 'In the last 4 years developing OpenKeychain, an OpenPGP implementation for Android, we made several unconventional UX decisions. While other implementations are still based on UX paradigms introduced in 1997 by PGP 5, we try to re-invent UX for a broader user base. Some of our decisions are subject to controversy in the OpenPGP community, in particular those of hiding information and complexity from the user, rather than giving them

asciilifeform: https://pad.riseup.net/p/87Mazw3Jsdfe_pm/timeslider#11 << multistory lul tower. for instance, i had no idea what is 'riseup' until its pgp keys began to pop. ☟︎☟︎

asciilifeform: (does anyone find it interesting that modern gpg uses ~same mpi implementation as dark age pgp, but with massaged function names ('mp_' vs 'mpi_') ?

asciilifeform: ' ... I tried this on two different platforms with two different byte orders. In particular, I used a mips-ultrix and sun386i. The results, are the same, and show that there is no problem with PGP 2.3a, or, at least, I cannot reproduce your bug. Sorry.'

asciilifeform: 'In summer of 2000, I had a look at the new key format PGP had introduced. In Europe a number of researchers voiced concerns about the new ADK feature that were routinely being ignored in the US, the home of PGP. This ignorance motivated me to look closer into the new PGP version and I discovered a serious problem with the way additional keys could be added without a user's consent. '

asciilifeform: ('pcp' was an early attempt, it appears, at a stateless and rsa-only pgp replacement)

asciilifeform: mod6: iirc they own the original zimmerman pgp.

mod6: "the PGP team at Symantec" << lel!

asciilifeform: ^ from mircea_popescu's vintage canned preserve pgp 1.4.10.

asciilifeform: e.g., https://www.reddit.com/r/security/comments/36mi86/if_you_are_on_this_list_phuctor_may_have_your_pgp/crfol5x

Framedragger: asciilifeform: apologies if i am mistaken here, but iirc phuctor was reported to have cracked some pgp keys when at that point in time none of the keys cracked had valid self-sigs. the presentation from tmsr (trilema/phuctor) to me appeared to have overstated the results, so to speak. (but then later subkeys with valid selfsigs were found, iirc). this isn't a technical point, i suppose.

mircea_popescu: "I doubt this will ever happen. Even he never cracked any PGP keys at all, the FUD he spread around was a nice way to get some free advertising. Look, people saying his name on gnupg and enigmail lists, which are quite popular I believe." ☟︎

Framedragger: ("random js pgp crap" does not belong in the "(semi)sane software for dealing with openpgp" set)

asciilifeform: (recall how sha1 ended up perma-fixed in pgp.)

asciilifeform: but so is all pgp signature, in nearly same way.

asciilifeform: pgp - base64 for armourgrams.

asciilifeform: lacking a pgp sig, at the very least i will say that the 'two' zookos appear to share a name and a biography.

a111: Logged on 2016-08-15 06:16 BingoBoingo: In other PGP short id collisions https://slashdot.org/submission/6212493/pgp-short-id-collision-attacks-continued-now-targeted-linus-torvalds

BingoBoingo: In other PGP short id collisions https://slashdot.org/submission/6212493/pgp-short-id-collision-attacks-continued-now-targeted-linus-torvalds ☟︎

mats: "BURCHARD used a program called GPG4USB, which automatically used Burchard's Pretty Good Privacy (PGP) private key to decrypt messages sent to him from customers."

asciilifeform: https://www.deepdotweb.com/2016/08/13/caliconnects-private-pgp-key-account-password-asshole209 << moar lel

mircea_popescu: you may think you see whatever ; for all you know some guy "sees" the true meaning of pgp signatures.

mircea_popescu: it has no fucking knobs. one step above pgp'ing in a browser.

a111: Logged on 2016-08-11 14:53 asciilifeform: sooo i attempted test of https://protonmail.com/blog/openpgpjs-email-encryption as a suspected http://btcbase.org/log/2016-08-04#1514630 , and discovered that it is plain and simple nonsense, won't import public keys at all! uses only pantomime of pgp

a111: Logged on 2016-08-04 15:38 asciilifeform: 'though the pgp keys in question do not import into gpg, they can be imported in a couple javascript pgp-trons: https://www.igolder.com/PGP/encryption/ and http://ianpurton.com/online-pgp/ ...'

asciilifeform: sooo i attempted test of https://protonmail.com/blog/openpgpjs-email-encryption as a suspected http://btcbase.org/log/2016-08-04#1514630 , and discovered that it is plain and simple nonsense, won't import public keys at all! uses only pantomime of pgp ☝︎☟︎

mircea_popescu: in other news, check out the epic eff site for spanish noobs : https://ssd.eff.org/es/module/como-usar-pgp-para-windows-pc

mircea_popescu: sedition consider registering your pgp key with deedbot.

mod6: i guess to me, that meant clearsigning a pgp signed message. guess i didn't try that.

asciilifeform: also at www.loper-os.org/pgp.asc

shinohai: so buttfinex hacker told me he doesnt have a pgp key -_-

asciilifeform: 'though the pgp keys in question do not import into gpg, they can be imported in a couple javascript pgp-trons: https://www.igolder.com/PGP/encryption/ and http://ianpurton.com/online-pgp/ ...' ☟︎

asciilifeform: trinque: just about any scenario involving a stooge khadeer would make considerably more sense with a properly-generated pgp key

asciilifeform: trinque: if fella is a stooge, no reason for him not to have ~normal~ pgp key with puppet master having copy of the private.

asciilifeform: https://www.reddit.com/r/netsec/comments/4vu9qm/pgp_key_of_mahmood_khadeer_president_of_the/d62ld86 << moar lelz

asciilifeform: recall how the original pgp collected keystroke fuzz etc.?

a111: Logged on 2016-08-02 19:24 asciilifeform: https://www.reddit.com/r/netsec/comments/4vu9qm/pgp_key_of_mahmood_khadeer_president_of_the << for further lulz.

asciilifeform: boolcrap: didja bury your pgp key in the garden and planted apple tree on top, or wat

asciilifeform: https://www.reddit.com/r/netsec/comments/4vu9qm/pgp_key_of_mahmood_khadeer_president_of_the << for further lulz. ☟︎

mircea_popescu: http://trilema.com/contact-pgp/ << notice anything, speaking of ?

phf: asciilifeform: it's an attack against a pgp key consumer with a specially broken viewer. userid in this case tries very hard to account for specific set of circumstances (i'm seeing 4 vectors so far), and we're only matching for one, specifically fact that ben_vulpes doesn't sanitize his html.

asciilifeform: ancient xss 0day ended up reencoded as pgp key userid field by cosmic rays, and submitted to phuctor also by cosmic rays ?

_FeltPen: actually I mispoke. I meant BTC assets wiki (referred to wrong tab). Anyway, I'm having to refresh my memory on pgp and wot etc. I forgot how good it is.

mircea_popescu: shinohai i'll take your word for it, srs. dun need screenshots in ma pgp

covertress: I have a pgp now.

mircea_popescu: btw, you got your pgp reg'd with deedbot ?

mircea_popescu: seriously, get a pgp and $register it

mircea_popescu: do consider making a pgp key and registering it with deedbot

asciilifeform: (though i have fundamentally nfi who is ACTUALLY kept there, for all i know it is folks who used pgp key that had too many bitz)

pete_dushenski: m your work email, and require a scan of either your passport or driver’s license. And you will comply." << y u no pgp rita ?

asciilifeform: 'The Web of Trust is a buzzword for a new model of decentralized self-sovereign identity. It’s a phrase that dates back almost twenty-five years, the classic definition derives from PGP. But some use it as a term to include self-sovereign identity authentication & verification, certificate validation, and reputation assessment, while the vibrant blockchain community is also drawing new attention to the concept we aim to reboot it.'

a111: Logged on 2016-07-17 16:50 asciilifeform: Framedragger: pgp. drop the 'I'.

asciilifeform: Framedragger: pgp is a sad, duct-tape-laden thing, as discussed on plenty of occasions in the logz. but the proliferation of psyop 'alternatives' casts it in a surprisingly good light.

Framedragger: asciilifeform: actually with pgp you'll just end up trusting your much dreaded aes256 since openpgp will do the whole 'session' thing as you know

asciilifeform: Framedragger: pgp. drop the 'I'. ☟︎

asciilifeform: nor does the thing force a particular type of crypto signature - any program that functions similarly to pgp, generating a detached signature, can be used.

Joshua-I: What's the opinion on pgp smart cards / yubikey around here

asciilifeform: 'Silent Circle already lost some of its key personnel in recent months. Cryptography luminary and co-founder Jon Callas departed for Apple in May and in June, CEO and President Bill Conner resigned, with Neiderman stepping in as interim chief. Co-founder Phil Zimmerman, best-known as the creator of encrypted messaging protocol PGP, remains on-board, living in the firm’s adopted home town of Geneva.'

asciilifeform: Joshua-I: have pgp key ?

phf: well, there's a hack in comment.php, that wraps PGP messages in <code> and that gets somehow rendered differently

asciilifeform: but yes, i will outline the algo, when you throw in a key, you get +1 'submissions', regardless of whether said key has moduli, and +M known moduli, where M is the number of rsa moduli in said pgp key.

a111: Logged on 2016-06-28 10:05 Framedragger: asciilifeform: but have you considered that there are fewer implementations for ssh (and the better part of the ssh servers in the wild run openssh), and more implementations for all kinds of broken pgp? so it may simply be less likely to spot a badly generated ssh key.

Framedragger: asciilifeform: but have you considered that there are fewer implementations for ssh (and the better part of the ssh servers in the wild run openssh), and more implementations for all kinds of broken pgp? so it may simply be less likely to spot a badly generated ssh key. ☟︎

mircea_popescu: an' seriously look into getting a pgp key an' join the crowd. lotta cool stuff going on here, most of which entirely unrelated to your chosen profession.

mircea_popescu: incidentally, do you have a pgp sig ? you can just register it here and self-voice

asciilifeform: http://btcbase.org/log/2016-06-20#1485868 << phuctor is unchanged - Framedragger converted the ssh keys to pgp format. ☝︎

a111: Logged on 2016-06-16 15:41 asciilifeform: this incidentally is why phuctor had been a depressing thing for me. the thing i set out to find, i never found (evidence of diddled rng on pgp users' boxes.)

asciilifeform: unlikely to happen. unix is a half-dead thing, like pgp.