Re: Enigmail speed geeking

[Peter Lebbing]

On 13/03/15 22:33, Robert J. Hansen wrote:
> And if you don't trust /dev/urandom, I'd suggest using a different 
> operating system, because that's a game-over compromise.

I trust both /dev/random and the sanity of the default settings of
GnuPG. And when I'm generating a key in GnuPG, I put my trust in both. I
don't know what is all going on in GnuPG for generating the highest
quality of randomness, but it's more than "cat /dev/random". It was
simply incomplete to just say "Linux's RNG", and it didn't acknowledge
the effort the GnuPG developers put into the code that generates the
randomness.

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Making the case for smart cards for the average user

[MFPA]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512



On Friday 13 March 2015 at 8:13:38 PM, in
,
Joey Castillo wrote:


> Unlocking a card
> with a PIN is a metaphor that people already know and
> use with bank cards.

Yes, and a sizeable minority have problems with this method of using
bank cards.



> Choosing and memorizing a strong
> passphrase, by comparison, is something the average
> user is likely to have trouble with.

This trouble goes away for the "average user" who uses a password
manager.



> Moreover, we're a multi-screen environment now; people
> expect to have access to their stuff across devices.
> With a smart card they can keep their secret keys in
> one place, as opposed to creating multiple points of
> potential compromise.

It there not still potential compromise each time you use it, such as
the possibility of malware substituting the message?



> Plus by integrating NFC
> technology, we open up the potential for use on
> smartphones and tablets, which is where most people's
> computing is moving anyway.

How secure is the NFC communication? Could a situation be contrived
where the person next to you in a crowd managed to get you to sign a
message on their device instead of your own?


- --
Best regards

MFPAmailto:2014-667rhzu3dc-lists-gro...@riseup.net

The best way to destroy your enemy is to make him your friend.
-BEGIN PGP SIGNATURE-

iQF8BAEBCgBmBQJVBC96XxSAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCM0FFN0VDQTlBOEM4QjMwMjZBNUEwRjU2
QjdDNzRDRUIzMUYyNUYwAAoJEGt8dM6zHyXwv1wH/iZAIFd1grKteFhMSpZ7L3Y7
F/nHWqjD5XEHxscYnE/BfVjF72ZBe+PIyBfiFnfdZAHyEDNCukoDxZVP+SbhX5dq
ho1QymCJYds5Uo+uLCbZd3PfabcnMATzNj5uU3MZ4rvR5yBaiSr3uwt5TPQbEFCf
pEYAbixsegGThab8TQHbWru615mIEsM/Sc2xAuwjeSO9o5zaFZDTdv18EFz5vbZs
i1aQkYvI7whalvTakK18+UTGDKagBRIBHTqHrEqNQH0rpFYRRH0EzTMNj/PeS2vE
Ja5tC/9xUMG7KY/jwCO9dxn6zMi0E1Z57COmSdVnGX1hn5UnPDrW+PYOVI2iQmyI
vgQBFgoAZgUCVQQvg18UgAAuAChpc3N1ZXItZnByQG5vdGF0aW9ucy5vcGVu
cGdwLmZpZnRoaG9yc2VtYW4ubmV0MzNBQ0VENEVFOTEzNEVFQkRFNkE4NTA2MTcx
MkJDNDYxQUY3NzhFNAAKCRAXErxGGvd45PEcAQCkvlcPhVcGBKTNX/gAKUIHR9Z6
QZigL/uAQmmvovpTGwEA7sDRSS70YfJVYGDqnyejQDtKIGYFnS+pkmaWYIj1fws=
=mCZy
-END PGP SIGNATURE-


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: gpg in a cybercafé

[flapflap]

Jonathan Schleifer:
> On Thu, 05 Mar 2015 22:27:36 +, flapflap  wrote:
> 
>> The current version (1.3) of Tails comes with GnuPG 1.4.12.
> 
> That's just not true. Not only is the gpg2 command available, but the change 
> log even explicitly states that GnuPG 2 was added to improve smartcard 
> support.

oh sorry, I have missed that. I just tried `gpg --version' and not `gpg2
--version'.

amnesia@amnesia:~$ gpg --version
gpg (GnuPG) 1.4.12
[...]

amnesia@amnesia:~$ gpg2 --version
gpg (GnuPG) 2.0.25
libgcrypt 1.5.0
[...]

~flapflap



signature.asc
Description: OpenPGP digital signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Making the case for smart cards for the average user

[Philip Jackson]

On 13/03/15 21:13, Joey Castillo wrote:
> Hi there,
> 
> I'm working on a Kickstarter right now that aims to popularize smart
> cards as an easier way for the average user to adopt GnuPG.
> 
> https://www.kickstarter.com/projects/joeycastillo/signet-simple-online-privacy-cards
> 
Geographic distribution of the product seems to be limited to US only - at least
for your sponsors.

Philip





___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Making the case for smart cards for the average user

[Joey Castillo]

I'll concede the first point: some minority of people won't get it
even if we make it simpler. As to the second one: even with a password
manager, the security of that still depends on choosing and guarding a
complex password to secure the password store. It's passwords all the
way down.

>> With a smart card they can keep their secret keys in
>> one place, as opposed to creating multiple points of
>> potential compromise.
>
> It there not still potential compromise each time you use it, such as
> the possibility of malware substituting the message?

Certainly; if your system is compromised by malware it could
substitute the message, store session keys, or keylog your PIN for
that matter. If your system is compromised, all bets are off. The
difference is that with your keys on a smart card, at least such a
breach won't compromise your secret key material. And you can prevent
further unauthorized use by simply removing the card; this is not
possible if the attacker has stolen your keyring and passphrase.

Without smart cards, if I want to use GnuPG on my laptop, my iPhone
and my Nexus 7, I have to put my secret key on each of those devices
and enter my passphrase into each of those devices. This dramatically
increases the surface area available for an attack on my secret keys.

> How secure is the NFC communication? Could a situation be contrived
> where the person next to you in a crowd managed to get you to sign a
> message on their device instead of your own?

In practice, you have to more or less touch the card to the device
you're using it with; an attacker would have to generate an RF field
that overpowers the one generated by the device. But yes: with
specialized equipment and close proximity, an attacker could
theoretically modify data or eavesdrop. [1] It's a tradeoff: in
exchange for better security for my secret key material, I'm exposing
myself to a threat from a determined, active attacker that's able to
get specialized gear into the same room as me while I'm using my card.
For some minority of people, that may be a reasonable concern; for
most people, it really isn't.

Also, there's nothing preventing us from better securing the NFC
channel in a future card specification; in particular, NFC's
resistance to man in the middle attacks makes it easy to establish a
shared secret to secure the channel, as proposed in a 2010 standard.
[2]

[1]: 
http://events.iaik.tugraz.at/RFIDSec06/Program/papers/002%20-%20Security%20in%20NFC.pdf
[2]: http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-386.pdf

-- 

Joey Castillo
www.joeycastillo.com

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Making the case for smart cards for the average user

[Joey Castillo]

On 14/03/15 17:52, Philip Jackson wrote:
> https://www.kickstarter.com/projects/joeycastillo/signet-simple-online-privacy-cards
>
> Geographic distribution of the product seems to be limited
> to US only - at least for your sponsors.

I desperately wanted to make it worldwide, but feared running afoul of
U.S. cryptographic export laws. Since both GnuPG and the smart card
application are open source, my sense was that it would be exempt from
export controls, but I didn't want to check the box without speaking
to a lawyer.

To quote the OpenSSL foundation [1], "U.S. exports controls are
complex and quite nonsensical from the perspective of the uninitiated
professional software developer."

[1]: http://www.opensslfoundation.com/export/README.blurb

--

Joey Castillo
www.joeycastillo.com

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Making the case for smart cards for the average user

[Joey Castillo]

On 13/03/15 17:20, Robert J. Hansen wrote:
> (ObWarning: no facts, just opinions.)
>
> I think the biggest problem we face, to be honest, is our conviction
> that there's an answer out there and we just have to find it.
> ...

Thanks for your thoughtful response. I think it's absolutely true that
different people have different security needs, but I wonder if we
can't make progress for an average person's use case.

I'm recalling a message you wrote some months ago making the point
that GnuPG is a cryptographic toolbox, but that it does not provide
policy. That's one of the things I've been trying to get at with this
project, writing guidelines for the people who participate on how they
should use the tools. The goal is to simplify not just everyday things
like how to make a key or encrypt an email, but also more complex
things like "what is my identity and how do I verify it?" [1]

I'm certain that this is not "the answer" for everyone's use case, and
I also know that even if this Kickstarter project gets funded, the end
result will be a small community, not a world-changing critical mass
of people. But it might provide a collaborative place where we can
test out a policy framework and see how well it performs for people
who aren't as intimately familiar with the tools.

That's the thing that excites me, and the thing that I think might
make a difference. Because if the human rights worker in Syria wants
to communicate securely with, say, an academic in the U.S., we have to
figure out a simple way to introduce that person to the tools as well.

[1]: 
https://github.com/josecastillo/signet/blob/master/guidelines.md#certification-and-trust

-- 

Joey Castillo
www.joeycastillo.com

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users