Re: High resource usage when verifying a signature

2015-07-19 Thread Ville Määttä
On 19.07.15 20:22, Crissy Lynn wrote: > Please remove me from this mailing list. Please follow the link at the bottom of each list email and follow instructions. -- Ville signature.asc Description: OpenPGP digital signature ___ Gnupg-users mailing l

Re: [slightly off topic] e-courier.ca

2015-07-19 Thread Ville Määttä
On 18.07.15 17:21, Philip Neukom wrote: > I put "secure" in quotes as they talk about a "proprietary" encryption > algorithm. As soon as I read "proprietary", I have to roll my eyes as I > don't necessarily trust encryption if it isn't open for everyone to verify. Pretty much. > Is this similar

Re: speedo build of 2.1.6 failing on OS X

2015-07-18 Thread Ville Määttä
On 18.07.15 07:38, NIIBE Yutaka wrote: > On 07/18/2015 03:04 AM, Ville Määttä wrote: >> $make -f build-aux/speedo.mk native INSTALL_PREFIX=/usr/local/gnupg >> CC=/usr/local/bin/gcc-5 CXX=/usr/local/bin/g++-5 > [...] >> Undefined symbols for architecture x86_64: >>

speedo build of 2.1.6 failing on OS X

2015-07-17 Thread Ville Määttä
I'm getting a failure at speedo.mk build for 2.1.6 on OS X 10.10.4 Yosemite. I'm using a forced brewed GCC 5.2, that is: $make -f build-aux/speedo.mk native INSTALL_PREFIX=/usr/local/gnupg CC=/usr/local/bin/gcc-5 CXX=/usr/local/bin/g++-5 It's failing at gpg-agent. Just the short snippet below. I

Re: Yubikey NEO OpenPGP advisory

2015-04-27 Thread Ville Määttä
On 27.04.15 12:43, MFPA wrote: >> Right now, they're rolling out a payment system here in >> > The Netherlands where you only need to tap your bank >> > card to the payment terminal to do small payments. >> > That's all that is needed. > We have that in the UK already. Payments up to, I think, GBP

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-30 Thread Ville Määttä
On 25.03.15 22:32, Doug Barton wrote: > On 3/25/15 1:20 PM, Ville Määttä wrote: >> On 25.03.15 21:41, Doug Barton wrote: >>> While this is strictly anecdotal evidence I would argue that it's a good >>> indication that we may not be ready for PGP/MIME as the def

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread Ville Määttä
On 26.03.15 01:38, Daniele Nicolodi wrote: > On 25/03/15 23:56, Ville Määttä wrote: >> > On 26.03.15 00:14, Ingo Klöcker wrote: >>> >> So it's not mailman that's not smart enough, but the mail clients >>> >> the other recipients are using. Mail

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread Ville Määttä
On 26.03.15 18:17, Brian Minton wrote: > I think gmail is the single most popular email client, with 500 million > > users. There are about 7,3 billion people out there that don't have a clue what OpenPGP is. > I think that until there is a way to verify pgp signatures from > > within gmail, pg

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-25 Thread Ville Määttä
On 26.03.15 00:14, Ingo Klöcker wrote: > So it's not mailman that's not smart enough, but the mail clients the other > recipients are using. Mail clients showing a "signature.asc" attachment > probably do not understand PGP/MIME (which isn't that unusual because only a > handful mail clients sup

PGP/MIME efficacy (Was: Weird error during key refresh)

2015-03-25 Thread Ville Määttä
On 25.03.15 21:42, Doug Barton wrote: > > Doug > > -- > I am conducting an experiment in the efficacy of PGP/MIME signatures. > This message should be signed. If it is not, or the signature does not > validate, please let me know how you received this message (direct, or > to a list) and the mai

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-25 Thread Ville Määttä
On 25.03.15 21:41, Doug Barton wrote: > While this is strictly anecdotal evidence I would argue that it's a good > indication that we may not be ready for PGP/MIME as the default. I think that fail, a signature.asc attachment, is still a "cleaner fail" than a non-PGP receiver getting a breakdown f

Re: Email-only UIDs and verification

2015-03-21 Thread Ville Määttä
On 20.03.15 20:47, Daniel Kahn Gillmor wrote: > On Fri 2015-03-20 13:43:27 -0400, Bob (Robert) Cavanaugh wrote: >> > One thought to add to the mix: Phishng attacks by having >> > unknowledgable users "click on this link" are pretty >> > successful. Doesn't this proposal open a new threat vector? Y

Re: bugs.gnupg.org TLS certificate

2015-03-13 Thread Ville Määttä
On 13.03.15 15:27, Werner Koch wrote: > The more expensive CAs are only selling you a fashionable background > color for your the client's address bar. Essentially, that's it :). There are however clearly defined hard requirements to the Extended Validation, aka "green bar" level. That is, more i

Re: bugs.gnupg.org TLS certificate

2015-03-13 Thread Ville Määttä
On 13.03.15 15:04, Mark H. Wood wrote: > On Fri, Mar 13, 2015 at 05:55:53AM -0300, Hugo Osvaldo Barrera wrote: >> > On 2015-03-13 08:21, Werner Koch wrote: >>> > > On Fri, 13 Mar 2015 00:21, h...@barrera.io said: >>> > > > > > No need for a wildcard one. Just get one free certificate for each

Re: Enigmail speed geeking

2015-03-12 Thread Ville Määttä
On 12.03.15 20:52, Robert J. Hansen wrote: >> My point was that you wrote multiple paragraphs worth of stories on >> > two emails from which I really got the impression that people should >> > just not bother. > In response to someone who was thinking that storing keys on your hard > drive was cat

Re: Enigmail speed geeking

2015-03-12 Thread Ville Määttä
On 12.03.15 19:21, Robert J. Hansen wrote: > If you think I'm portraying them as "completely unusable," then I think > you didn't bother to read my message very closely. I read both of your messages quite closely. Had you merely pointed out the downsides of having to carry a card, a reader etc. I

Re: Enigmail speed geeking

2015-03-12 Thread Ville Määttä
> But for just as many users, smart cards are inconvenient and overkill. > Frankly, they have awful usability, just terrible. … > finding the smart card is > easy -- it's in my wallet -- but finding the smart card *reader* is the > sort of thing that leads me to crazed conspiracy theories. That's

Re: Suggestions for a Practical Scheme to Manage Multiple Identities?

2015-03-10 Thread Ville Määttä
On 10.03.15 04:41, NIIBE Yutaka wrote: >> So this is not a question about portable flash drives vs. smartcards per >> > se. I _think_ I understand those risks and trade-offs but if there is >> > something I'm missing then, of course, I'd like to know. > I had an experience that one of my family mem

Re: Thoughts on GnuPG and automation

2015-03-04 Thread Ville Määttä
On 04.03.15 12:48, Werner Koch wrote: >> that doesn't tell you about proprietary projects that have chosen not to >> > use GPGME. I've had clients refuse to use GPGME because of the >> > licensing, even under the LGPLv2.1. (Foolish, I know.) Other times > And I have had several hints that it was

Re: Thoughts on GnuPG and automation

2015-03-04 Thread Ville Määttä
On 04.03.15 18:21, Bjarni Runar Einarsson wrote: > GPGME proponents will be frustrated to hear that this knowledge actually > makes me feel much better about Mailpile's decision to wrap gpg > directly: it means I've removed two layers of abstraction between my > code and gpg! Win! Although supposed

Re: Thoughts on GnuPG and automation

2015-03-04 Thread Ville Määttä
On 04.03.15 01:55, Hans of Guardian wrote: > In Android, you can't really have shared libraries. Apps share functionality > at a higher level (aka Activities and Services). Qt applications can share Qt libraries [1] with an external dependency called Ministro [2]. [1]: http://doc.qt.io/qtcreato

Re: Fwd: Re: German ct magazine postulates death of pgp encryption

2015-03-03 Thread Ville Määttä
On 03.03.15 14:54, Stephan Beck wrote: > as your message hasn't reached the list inspite of being addressed to it It did :). -- Ville signature.asc Description: OpenPGP digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://list

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-21 Thread Ville Määttä
On 21 Feb 2015, at 15:55, Xavier Maillard wrote: > > Hi Ville, > > Ville Määttä writes: > >> I happen to use Mail so for a long time I’ve been using the GPGMail >> plugin with a brewed[2] upstream GnuPG. I.e. *just one of the >> things in the GPG Suite*. I’

Re: Whishlist for next-gen card

2015-02-20 Thread Ville Määttä
On 20.02.15 15:27, NdK wrote: >>> 5 - possibility to export private keys to user-certified devices >> > That pretty much defeats the point of using a smart card in the first >> > place. > That's not "uncontrolled export", and in fact… > …(snip)… > while importing a key (so that you "can't" alter -

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-20 Thread Ville Määttä
On 20.02.15 16:44, Lukas Pitschl wrote: > Pinentry-mac is one project we’ve „revived“ and thus only added stuff on top > of the old code instead of refactoring it. > We’ve been planning to do that for a long time now though, so we’ll > definitely look into that and check out how other UIs do it,

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-20 Thread Ville Määttä
On 20.02.15 11:36, Lukas Pitschl wrote: >> No pinentry, nothing just happens. /Will need to >> > troubleshoot this further on 2.1.2 to try to find out more./ > We’ve noticed that the hang occurs in pcsc_get_status_change. Instead of > receiving a timeout, it simply hangs forever, due to a bug in Y

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-20 Thread Ville Määttä
On 20.02.15 11:29, Lukas Pitschl wrote: > It would be great if there’s an outline of the changes which might break > backwards compatibility (if any). From usage point of view: https://gnupg.org/faq/whats-new-in-2.1.html >> The things that would require a little changing are the launchd >> templ

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-20 Thread Ville Määttä
On 20.02.15 12:42, Jonathan Schleifer wrote: > Might I suggest that you start with pinentry? Agreed. > It would be really helpful if you could instead create a new subdirectory > cocoa and do it like the other pinentries. Oh yes, definitely agreed. Integrate the necessary changes to the upstrea

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-19 Thread Ville Määttä
On 19.02.15 21:18, Ville Määttä wrote: > Surely someone from the KDE / larger community > using pinentry-qt4 has been working on a QT 5 version of pinentry? Ok, found it :). Issue #1806 [1]. [1]: https://bugs.g10code.com/gnupg/issue1806 -- Ville signature.asc Description: OpenPGP d

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-19 Thread Ville Määttä
On 18.02.15 13:05, Jonathan Schleifer wrote: >> > Upstream still does have the issue which now seems to have been fixed in >> > the fork but in a binary removed from upstream… > I really can not confirm this. I am running vanilla GnuPG 2.1.2 (built from > source) on Yosemite (10.10.2 to be exact)

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-19 Thread Ville Määttä
On 18.02.15 07:21, Werner Koch wrote: >> wrappers or fixes upstream. Case in point: Has the fix for gpg-agent / >> > scdaemon hang been discussed upstream at all [4], [5]? In MacGPG there >> > is still ../libexec/gnupg-pcsc-wrapper which has been modified in >> > commit f4c3e1bb to fix the issues o

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-19 Thread Ville Määttä
On 18.02.15 07:21, Werner Koch wrote: >> > command line tools. *I think there is no more reason to develop >> > MacGPG*, i.e. a port, anymore. Let the port die. > Can you briefly explain how Patrick's new installer [1] is related to that? > Would it be an option to use that as the core for gpgtools

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-19 Thread Ville Määttä
On 17.02.15 23:32, Lukas Pitschl wrote: > The best way to reach us is either our support platform at > https://gpgtools.tenderapp.com or t...@gpgtools.org. Ok, that link explains the certificate and it makes more sense. I can see you've already changed at least the first link to the support site

Re: 2.1.2: keyserver route failure

2015-02-18 Thread Ville Määttä
> On 18 Feb 2015, at 19:07, Johan Wevers wrote: > > Admit it, IPv6 has > failed. It may get some uses, but the widespread adaptation of carrier > NAT has made it largely obsolete. Utter, complete, nonsense. -- Ville ___ Gnupg-users mailing list Gnu

Re: 2.1.2: keyserver route failure

2015-02-18 Thread Ville Määttä
> On 18 Feb 2015, at 21:13, Daniel Kahn Gillmor wrote: > > I'm not convinced that it's gnupg's job to compensate for > unreasonably-configured IPv6 stacks that think they have a route but > actually don’t. I agree. I think the actual problem should be addressed at the networking level instead o

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-17 Thread Ville Määttä
> On 17 Feb 2015, at 21:16, Juergen Fenn wrote: > > as you've pointed > out, the GPGTools have decided to go all commercial including, I > didn't realise this before, a closed code repository so that no one > can study the code? Is this true? I can't believe it. That’s not quite true. They must

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-17 Thread Ville Määttä
> On 17 Feb 2015, at 21:03, Sandeep Murthy wrote: > > As a user, not a developer on MacGPG, the issues previously > raised here about the remote execution of scripts etc. may be > questionable, but they do not directly affect my use of the software, > which is nothing but a front end for GnuPG.

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-17 Thread Ville Määttä
> On 17 Feb 2015, at 18:31, Martin Paljak wrote: > > Not sure about overall GnuPG affection with Apple or other closed > source software, but the PC/SC layer in Yosemite is broken (again): > > http://ludovicrousseau.blogspot.fr/2014/12/os-x-yosemite-and-smart-cards-known-bugs.html Yeah, Apple h

Re: Please remove MacGPG from gnupg.org due to serious security concerns

2015-02-17 Thread Ville Määttä
I’ve had some concerns about GPGTools for months now. For some time I've disliked the way the project is being run, the communication of what they are planning and the way they have been doing their development for example. Months went by when their Yosemite betas were not available in source at

Re: MIME or inline signature ?

2015-02-13 Thread Ville Määttä
> On 13 Feb 2015, at 08:25, Christopher W. Richardson > wrote: > > FWIW, Mac Mail marked this message as spam. Not sure if it universally does > that for all inline sigs, but ... FYI. > > Chris Fortunately it certainly does not. -- Ville signature.asc Description: Message signed with Open

Re: Encryption on Mailing lists sensless?

2014-11-18 Thread Ville Määttä
UX-designer-aproach to car design: "We need to remove break and clutch pedals from cars because our user studies say that a 3 pedal interface for driving an automobile is just way too difficult." I say those who can’t be arsed to learn how, do not deserve a driver’s license. You let a child fa

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-11 Thread Ville Määttä
No worries on my part. > it seems to install software in versioned directories. Exactly, under /usr/local… and without messing with the system installed binaries or libraries. Some things, like openssl libraries, it will not link automatically to avoid some issues with system provided libraries

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-11 Thread Ville Määttä
Hi, That’s somehow just the result of running ./configure. Running a fresh (fresh untarred source, no speedo runs) configure reported this for me: … configure: checking for libraries checking for gpg-error-config... /usr/local/bin/gpg-error-config checking for GPG Error - version >= 1.15... yes

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Ville Määttä
Yeah, OS X. I’m sorry, I’m sure this is drowning to all the discussion on this thread, I didn’t think too much about the subject. I was replying to Nicholas’ reported issues with building on OS X. My aim was to expand on Nicholas’ report with the info that it’s failing with that error yes, but b

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Ville Määttä
und for option '-L/usr/local/Cellar/libgpg-error/1.13/lib' make[4]: *** [all] Error 2 make[3]: *** [all-recursive] Error 1 make[2]: *** [all] Error 2 make[1]: *** [/Users/vmaatta/Downloads/gnupg-2.1.0/PLAY/stamps/stamp-gnupg-02-make] Error 2 make: *** [native] Error 2 On 6 Nov 2014, at 16:

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Ville Määttä
Hi, I can’t use speedo.mk as I get "GnuPG has already been build[sic] in-source”. I’m not going to replace 2.0 at this time so I won’t remove it. With just ‘make’ I get an error on linking libgpg-error. I happen to have versions 0.16 and 0.17 but not 0.13 under the referenced path. [shell quot

Re: Pinentry curses fallback for gpg

2014-10-16 Thread Ville Määttä
Hi John, You could try the following environment variable: export PINENTRY_USER_DATA="USE_CURSES=1” If that’s no good maybe something in following thread helps: http://lists.gnupg.org/pipermail/gnupg-users/2009-June/036583.html -- Ville On 16 Oct 2014, at 23:02, John Lane wrote: > Hello, I

Re: Smart Card 4096 Key Question

2014-09-01 Thread Ville Määttä
I bought my SCR3500 and SCR335 V2 from Identive / Chipdrive [1]. I had a problem adding VAT number to the order myself but at least they ship (and kindly handled fixing the bill afterwards). Though, they only seem to have an SCT3511 there, not a 3512. [1] http://www.chipdrive.de -- Ville

Re: Problems installing 2.0.26 on Mavericks

2014-09-01 Thread Ville Määttä
://brew.sh [2] https://www.macports.org [3] https://gpgtools.org [4] http://lists.gnupg.org/pipermail/gnupg-users/2014-August/050677.html -- Ville Määttä On 01 Sep 2014, at 21:33, Travis Millburn wrote: > I’m running into problems compiling GnuPG on my mac running OS X 10.9.4. signature.

Re: default user and recipient

2014-08-30 Thread Ville Määttä
You'll need to import the other person’s public key as that is what you are encrypting to. If the other person has uploaded their key to a key server you should be able to find it there: gpg --search-key recipi...@example.com If you already know, preferably the long form, key ID you can just u

Re: So on & so forth

2014-08-20 Thread Ville Määttä
I’d actually like to know why the pinentry / pinentry-curses that come from homebrew don’t seem to work at all. I am now using pinentry-mac but I wouldn’t mind getting the normal pinentry working. All I get is "Agent admitted failure to sign using the key.” without any PIN queries. I can see the

Re: So on & so forth

2014-08-20 Thread Ville Määttä
Maybe a little off topic, but then again we are talking about keeping gnupg up to date. TL;DR: I think either MacPorts or Homebrew can be used and one or the other is quite necessary. I do most of my work on the command line / Vim, etc. and using either is just as convenient as apt-get / yum et

Re: So on & so forth

2014-08-19 Thread Ville Määttä
GENT_INFO export SSH_AUTH_SOCK export SSH_AGENT_PID fi [4] END -- Ville On 19 Aug 2014, at 22:33, Doug Barton wrote: > On 8/19/14 11:17 AM, Ville Määttä wrote: >> 1. The package and gnupg2 version used has not been updated since October >> 2013 (2013.10.22). If I’m not co

Re: So on & so forth

2014-08-19 Thread Ville Määttä
Yeah. Ok. Assuming the Mac guys / fork referred to here are GPGTools / MacGPG2 I can see a couple bigger issues there than just patching in support for bigger keys. 1. The package and gnupg2 version used has not been updated since October 2013 (2013.10.22). If I’m not completely mistaken the ve

Re: So on & so forth

2014-08-19 Thread Ville Määttä
Quite. Who are the "Mac guys" and what did they fork? -- Ville > On 19.8.2014, at 12.14, Nicholas Cole wrote: > >> On Fri, Aug 15, 2014 at 6:54 PM, Richard Outerbridge >> wrote: >> Still waiting for my email address, yet my blackphone is already in >> my hands. Keep up the good work. >> >>

Re: card reader (was: riseup.net OpenPGP Best Practices article)

2014-06-28 Thread Ville Määttä
I'm using the FSFE card [1] with SCR3500 [2]. Ok yeah sure, that’s a fellowship card but I actually also wanted to point out the SCR3500 which is a nice similar form factor option for a reader. https://www.dropbox.com/s/jbaxi8ulfdz5585/fsfe_with_scr3500.jpg [1] http://fsfe.org/fellowship/card.h

Re: hkps ssl problem

2014-05-01 Thread Ville Määttä
Hi… any other problems with GPG Tools version? I was using the brew -installed gpg first, had some issues with getting it to recognise OpenPGP card, I switched to GPG Tools version and it’s been ok. Now I’m having trouble getting non-card based keys to work with SSH through gpg-agent. I.e. they

Re: Access to www.gnupg.org only via TLS

2014-04-30 Thread Ville Määttä
So, when was the last time you were offered a parachute on flight? :), sorry I just had to. I have to say I agree with Doug on StartSSL, I think they’re doing a more of a service to the community by offering affordable certs and the revocation fee is understandable. And reasonable. And sometime

Re: C# .dll availability?

2014-04-25 Thread Ville Määttä
-the-gpgme-library-from-net -- Ville Määttä On 25 Apr 2014, at 01:07, Charles Spitzer wrote: > Greetings > > Is there a GnuPGP project anywhere that does PGP encryption that is usable in > a C# application? I know I can execute commands at a command line to do this, > but tha