Re: Avoid pinentry-gtk-2 when using console!

2009-06-02 Thread Roger
On Wed, 2009-06-03 at 08:02 +0200, Werner Koch wrote: > On Tue, 2 Jun 2009 22:43, rog...@sdf.lonestar.org said: > > (or .gnupg/option statement or environmental variable) which seeks to > > make gpg/pinentry usage stricter. > > Right; that is why a standard solution would not work. > > > (Grante

Re: Avoid pinentry-gtk-2 when using console!

2009-06-02 Thread Werner Koch
On Tue, 2 Jun 2009 22:43, rog...@sdf.lonestar.org said: > Again, still sounds like a hack as (I could have done this here). It's Or write your own pinentry; it is a separate package for a reason. > Think it's paranoia unless one is on a public network or is being > aggressively sought after al

Re: Security Concern: Unsigned Windows Executable

2009-06-02 Thread Robert J. Hansen
Daniel Kahn Gillmor wrote: > I beg to differ. In today's wireless network, active MitM can be done > by a moderately-skilled hacker on a lark, or by an unskilled user who > can follow directions: > > http://www.ex-parrot.com/~pete/upside-down-ternet.html There is a big difference between hack-

Re: Security Concern: Unsigned Windows Executable

2009-06-02 Thread Daniel Kahn Gillmor
On 06/02/2009 07:02 PM, Robert J. Hansen wrote: > my "philosophical > digression" is what lies at the bottom of that rabbit-hole. I understand (and i very much appreciate the warning), but sometimes it's useful to go a little way into the rabbit hole instead of all the way to the bottom, no? oth

Re: Security Concern: Unsigned Windows Executable

2009-06-02 Thread Robert J. Hansen
Daniel Kahn Gillmor wrote: > guys, with all due respect, the original poster was not asking for a > philosophical digression. he was asking how he could practically > identify the provenance of the copy of gpg he was hoping to use. John Clizbe answered, "[i]f you're so committed to this verified

Re: Avoid pinentry-gtk-2 when using console!

2009-06-02 Thread Roger
On Tue, 2009-06-02 at 12:31 +0200, Werner Koch wrote: > On Sun, 31 May 2009 07:49, rog...@sdf.lonestar.org said: > > > if {environmental variable is set to console/gtk/qt3} > > use the specified pinentry flavor > > You can easily implement this with a little pinentry wrapper script and > using

AUTO: Richard Hamilton is out of the office (returning 06/08/2009)

2009-06-02 Thread Richard Hamilton
I am out of the office until 06/08/2009. I am out of the office until June 8th 2009. If this is a production problem, please call the solution center at 918-573-2336 or email Bob Olson at robert.ol...@williams.com. I will have limited mail and cell phone access. Note: This is an automated res

Re: Security Concern: Unsigned Windows Executable

2009-06-02 Thread Daniel Kahn Gillmor
On 06/02/2009 08:55 AM, Jean-David Beyer wrote: > obert J. Hansen wrote: > > | you're left hand-hacking Assembly > | instructions for a low transistor count CPU you've personally > | lithographed yourself from your own personal design. > > We get into the very problem Rene Descartes was stuck in

Re: Changing the expiration date after the key has expired

2009-06-02 Thread David Shaw
On Jun 2, 2009, at 10:14 AM, Vincent Panel wrote: Hi, I just wondered if it was possible to postpone the expiration date after it has been set and/or after the deadline has been reached. Yes, you can. 2 years ago, I created a personal key and set the expiration to 2y, so it has now expired.

Re: Changing the expiration date after the key has expired

2009-06-02 Thread Daniel Kahn Gillmor
On 06/02/2009 10:14 AM, Vincent Panel wrote: > I just wondered if it was possible to postpone the expiration date > after it has been set and/or after the deadline has been reached. yes, this is possible. Assming you're talking about 56B55C11, it looks like you've successfully done so. > I've tr

Re: Security Concern: Unsigned Windows Executable

2009-06-02 Thread Jean-David Beyer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert J. Hansen wrote: | Insert mandatory "reflections on trusting trust" reference here. | | The sentiment of "I must build it from source if I'm going to trust it" | is great, but then you have to ask questions about your compiler, your | system l

Changing the expiration date after the key has expired

2009-06-02 Thread Vincent Panel
Hi, I just wondered if it was possible to postpone the expiration date after it has been set and/or after the deadline has been reached. 2 years ago, I created a personal key and set the expiration to 2y, so it has now expired. It looks like I can change the expiration date (of the primary key) i

Re: Running GPG from a PHP Script under Windows

2009-06-02 Thread Daniel Kahn Gillmor
On 06/01/2009 05:38 PM, jnhemley wrote: > I'm trying to run gpg in a php script under Windows using Apache. It works > fine using a batch file but using the same code using exec calls fails. Any > suggestions ? This sounds more like a question for php folks than gpg folks to me. I recommend you t

Re: Security Concern: Unsigned Windows Executable

2009-06-02 Thread Robert J. Hansen
John Clizbe wrote: > Your #3 comment is confusing. There is no .SIG to download if verifying > with sha1sum. You run sha1sum against the file you wish to verify and > compare the program output with the published value. > > Are you proposing some MITM attack of a replaced installer executable > wi

Re: Avoid pinentry-gtk-2 when using console!

2009-06-02 Thread Werner Koch
On Sun, 31 May 2009 07:49, rog...@sdf.lonestar.org said: > if {environmental variable is set to console/gtk/qt3} > use the specified pinentry flavor You can easily implement this with a little pinentry wrapper script and using the PINENTRY_USER_DATA envvar which is passed all the way from gpg t

Re: Security Concern: Unsigned Windows Executable

2009-06-02 Thread John Clizbe
Doug Bateman wrote: > I challenged myself to verify all software that I download on my new > machine is verified and signed. Sadly, Win-GnuPG let me down. Heres why. What's Win-GnuPG? Are you referring to the windows installer build of GnuPG from http://www.gnupg.org/download/ as such? It's just

S/MIME certs and GPG

2009-06-02 Thread Sauman Mahata
Hi, I'm having problems using S/MIME certificates in GPG. After importing my keys into gpg(they appear in Kleopatra when I'm done), signing and encrypting with S/MIME is unsuccessful. Using Kleopatra's system tray Clipboard function to sign with the S/MIME cert gives me the error: *Signing Failed:

S/MIME certs and GPG

2009-06-02 Thread Sauman Mahata
Hi, I'm having problems using S/MIME certificates in GPG. After importing my keys into gpg(they appear in Kleopatra when I'm done), signing and encrypting with S/MIME is unsuccessful. Using Kleopatra's system tray Clipboard function to sign with the S/MIME cert gives me the error: *Signing Failed:

Running GPG from a PHP Script under Windows

2009-06-02 Thread jnhemley
I'm trying to run gpg in a php script under Windows using Apache. It works fine using a batch file but using the same code using exec calls fails. Any suggestions ? -- View this message in context: http://www.nabble.com/Running-GPG-from-a-PHP-Script-under-Windows-tp23822809p23822809.html Sent fr

Security Concern: Unsigned Windows Executable

2009-06-02 Thread Doug Bateman
Dear GnuPG Team, I challenged myself to verify all software that I download on my new machine is verified and signed. Sadly, Win-GnuPG let me down. Heres why. Most software was distributed as a signed .exe file (using the Windows signed .EXE format). Some was not signed, but available via an h

Re: S/MIME certs and GPG

2009-06-02 Thread Sauman Mahata
Sorry for the multiple emails. I was having a slow connection. Frustration = multiple clicks. Regards, Sauman ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users