Re: Slightly OT - mobile OpenPGP usage

2019-08-31 Thread Stefan Claas via Gnupg-users
Andrew Gallagher wrote: > > > On 31 Aug 2019, at 11:45, Stefan Claas via Gnupg-users > > wrote: > > > > Can you please tell me what web mailer you have installed in > > order to run Mailvelope on an own domain? > > I recently migrated from squirrelmail to roundcube on my own domain and I > wou

Re: Slightly OT - mobile OpenPGP usage

2019-08-31 Thread Andrew Gallagher
> On 31 Aug 2019, at 11:45, Stefan Claas via Gnupg-users > wrote: > > Can you please tell me what web mailer you have installed in > order to run Mailvelope on an own domain? I recently migrated from squirrelmail to roundcube on my own domain and I would recommend it. Mailvelope will support

Re: Slightly OT - mobile OpenPGP usage

2019-08-31 Thread Stefan Claas via Gnupg-users
Daniel Clery wrote: Hi, > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 [snip] > -BEGIN PGP SIGNATURE- > Version: Mailvelope v4.1.0 > Comment: https://www.mailvelope.com I just noticed that you use Mailvelope on your site, awesome! Can you please tell me what web mailer you have i

Re: Slightly OT - mobile OpenPGP usage

2019-08-28 Thread Peter Lebbing
On 28/08/2019 12:07, Peter Lebbing wrote: > Whether a compromise is game over depends on your scenario. Sorry, I meant, it depends on your definition of "game over", definitely *not* on the scenario. I think it is perfectly acceptable to say "compromise = game over", the only way I see that could

Re: Slightly OT - mobile OpenPGP usage

2019-08-28 Thread Peter Lebbing
On 28/08/2019 00:41, Chris Narkiewicz via Gnupg-users wrote: > This is not true. Many crypto systems are designed to perform damage > control and recovery in such cases. Damage control in the case of GnuPG would be using a smartcard: while you are using the smartcard, so can the attacker, but once

Re: Slightly OT - mobile OpenPGP usage

2019-08-28 Thread Stefan Claas via Gnupg-users
On 2019-08-28 00:44, Chris Narkiewicz via Gnupg-users wrote: > On 27/08/2019 20:50, Stefan Claas via Gnupg-users wrote: >> But what would be, when using computers at work or public places, then >> the best strategy for using OpenPGP, without carrying a Notebook or >> smartphone? > The strategy I ad

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Chris Narkiewicz via Gnupg-users
On 27/08/2019 20:50, Stefan Claas via Gnupg-users wrote: > But what would be, when using computers at work or public places, then > the best strategy for using OpenPGP, without carrying a Notebook or > smartphone? The strategy I advice would be to not use GnuPG and look for alternatives. I wouldn'

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Chris Narkiewicz via Gnupg-users
On 27/08/2019 22:41, Peter Lebbing wrote: > If a computer is compromised, this is game over for cryptography. Full > stop. This is not true. Many crypto systems are designed to perform damage control and recovery in such cases. If the compromise is game over for the user - it depends on threat pr

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Peter Lebbing
On 27/08/2019 21:50, Stefan Claas via Gnupg-users wrote: > But what would be, when using computers at work or public places, then > the best strategy for using OpenPGP, without carrying a Notebook or > smartphone? If a computer is compromised, this is game over for cryptography. Full stop. > Ther

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Stefan Claas via Gnupg-users
Andrew Gallagher wrote: > On 27/08/2019 17:01, Stefan Claas via Gnupg-users wrote: > > Would you consider these both methods secure enough for entering > > passphrases in Mailvelope, like outlined in article [1] while using Oxynger > > KeyShield [2]? > > If you think there's a keylogger on your m

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Wiktor Kwapisiewicz via Gnupg-users
Hi Chris, On 27.08.2019 17:52, Chris Narkiewicz via Gnupg-users wrote: On 26/08/2019 19:47, Wiktor Kwapisiewicz via Gnupg-users wrote: If one sets URL field on the token then just plugging the token when OpenKeychain is opened is enough to get the key ready-to-use. Can you explain what kind o

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Andrew Gallagher
On 27/08/2019 17:01, Stefan Claas via Gnupg-users wrote: > Would you consider these both methods secure enough for entering passphrases > in > Mailvelope, like outlined in article [1] while using Oxynger KeyShield [2]? If you think there's a keylogger on your machine, then don't type in a passwor

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Stefan Claas via Gnupg-users
Stefan Claas via Gnupg-users wrote: > Due to some tests I found Mailvelope an OpenPGP extension for > Firefox and Chrome and installed it on my Kanguru Defender 3000 > USB stick. Besides the new Mailvelope keyserver I added also Hagrid. > Key management is quite comfortable and messages sending i

Re: Slightly OT - mobile OpenPGP usage

2019-08-27 Thread Chris Narkiewicz via Gnupg-users
On 26/08/2019 19:47, Wiktor Kwapisiewicz via Gnupg-users wrote: > If one sets URL field on the > token then just plugging the token when OpenKeychain is opened is enough > to get the key ready-to-use. Can you explain what kind of workflow do you mean here? signature.asc Description: OpenPGP d

Re: Slightly OT - mobile OpenPGP usage

2019-08-26 Thread Stefan Claas via Gnupg-users
Wiktor Kwapisiewicz via Gnupg-users wrote: > W.r.t. NFC there is this minor detail: > https://lists.gnupg.org/pipermail/gnupg-users/2018-December/061375.html Interesting. Well, for important and very short messages one could additionally use the modern ElsieFour handcypher, by Prof. Kaminsky.,

Re: Slightly OT - mobile OpenPGP usage

2019-08-26 Thread Wiktor Kwapisiewicz via Gnupg-users
On 26.08.2019 19:37, Andrew Gallagher wrote: Tangentially related - I've seen docs recommending having your portable keychain have a subkey for signing, and that keychain to lack the master secret key entirely ( and putting that one in an undisclosed secure location), with a different passphra

Re: Slightly OT - mobile OpenPGP usage

2019-08-26 Thread Andrew Gallagher
> On 26 Aug 2019, at 18:17, Daniel Clery wrote: > > Tangentially related - I've seen docs recommending having your portable > keychain have a subkey for signing, and that keychain to lack the master > secret key entirely ( and putting that one in an undisclosed secure > location), with a diff

Re: Slightly OT - mobile OpenPGP usage

2019-08-26 Thread Daniel Clery
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Tangentially related - I've seen docs recommending having your portable keychain have a subkey for signing, and that keychain to lack the master secret key entirely ( and putting that one in an undisclosed secure location), with a different passphras

Re: Slightly OT - mobile OpenPGP usage

2019-08-26 Thread Michael Kesper
Hi Chris, On 25.08.19 21:22, Chris Narkiewicz via Gnupg-users wrote: > Shortly, I know only one combination that provides reasonable > use experience on mobile. > > Android + K-9 Mail + OpenKeychain + YubiKey with NFC. Do you know a good guide for setting this up? Best wishes Michael signatu

Re: Slightly OT - mobile OpenPGP usage

2019-08-25 Thread Stefan Claas via Gnupg-users
On 2019-08-25 21:22, Chris Narkiewicz via Gnupg-users wrote: > On 25/08/2019 19:40, Stefan Claas via Gnupg-users wrote: >> Hi all, >> >> I am curious what apps you are using when not at home, to send >> OpenPGP compatible email messages? Do you carry a Notebook with >> GnuPG or do you use an OpenPG

Re: Slightly OT - mobile OpenPGP usage

2019-08-25 Thread Chris Narkiewicz via Gnupg-users
On 25/08/2019 19:40, Stefan Claas via Gnupg-users wrote: > Hi all, > > I am curious what apps you are using when not at home, to send > OpenPGP compatible email messages? Do you carry a Notebook with > GnuPG or do you use an OpenPGP smartphone app? Shortly, I know only one combination that provide

Slightly OT - mobile OpenPGP usage

2019-08-25 Thread Stefan Claas via Gnupg-users
Hi all, I am curious what apps you are using when not at home, to send OpenPGP compatible email messages? Do you carry a Notebook with GnuPG or do you use an OpenPGP smartphone app? Because I do not have a smartphone and I do not want to carry a Notebook with me I came up with the following solut