Why hashed User IDs is not the solution to User ID enumeration (was: Re: Creating a key bearing no user ID)

2012-01-24 Thread Daniel Kahn Gillmor
On 01/23/2012 06:23 PM, MFPA wrote: > It sounds like you value the flavour of privacy that could be afforded > by a scheme involving the use of hashes in UIDs to protect names and > email addresses. Such a scheme would (for example) allow somebody with > one of your email addresses to locate your k

Re: Using root CAs as a trusted 3rd party

2012-01-24 Thread Gregor Zattler
Hi Mike, gnupg users, * gn...@lists.grepular.com [22. Jan. 2012]: [...] > I sometimes wonder if the traditional public web of trust is even a good > idea. Are you happy to be associated with everybody you've signed the > key of and those who have signed yours? Are you sure that none of these > peo

Re: Using root CAs as a trusted 3rd party

2012-01-24 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 El 21-01-2012 18:50, Gregor Zattler escribió: > Hi Aaron, gnupg users, * Aaron Toponce > [21. Jan. 2012]: >> I just signed an OpenPGP key with cert level 0x12 (casual >> checking) given the following scenario: >> >> * A PGP key was signed by an SSL

Re: Using root CAs as a trusted 3rd party

2012-01-24 Thread brian m. carlson
On Tue, Jan 24, 2012 at 03:13:46PM -0300, Faramir wrote: > Well, if Trent signs Alice key, Bob, who trust Trent, might sign her > key too. Charly doesn't know Trent, but he trusts Bob's judgement, so > he might accept Alice's key as valid, not because of Trent's > signature, but because of Bob's

Re: Using root CAs as a trusted 3rd party

2012-01-24 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 El 24-01-2012 16:26, brian m. carlson escribió: > On Tue, Jan 24, 2012 at 03:13:46PM -0300, Faramir wrote: >> Well, if Trent signs Alice key, Bob, who trust Trent, might sign >> her key too. Charly doesn't know Trent, but he trusts Bob's >> judgement

Forcing use of software pinentry instead of hardware pinpad

2012-01-24 Thread gnupg
I've got myself an SPR-532 smart card reader. It's working fine on my Ubuntu laptop with my OpenPGP card. It makes very noisy beeping sound effects when using the pinpad though. I was planning on using it in an office environment, but the noise would draw unwanted attention and annoy people... I h

Re: Forcing use of software pinentry instead of hardware pinpad

2012-01-24 Thread Hauke Laging
Am Dienstag, 24. Januar 2012, 22:45:10 schrieb gn...@lists.grepular.com: > Would it be > possible to use this reader and enter the pin in software, using > pinentry, instead of the hardware pinpad? scdaemon knows the option --disable-keypad Hauke -- PGP: D44C 6A5B 71B0 427C CED3 025C BD7D 6D27

Re: Using root CAs as a trusted 3rd party

2012-01-24 Thread Hauke Laging
Am Dienstag, 24. Januar 2012, 22:10:35 schrieb Faramir: > > This is why OpenPGP implementations have trust settings. If Bob > > trusts Trent's assertions, then he can give Trent full trust and > > Bob's implementation will believe that Alice's key belongs to > > Alice. There's no need to sign th

Re: Creating a key bearing no user ID

2012-01-24 Thread John Clizbe
MFPA wrote: > On Monday 23 January 2012 at 3:04:45 PM, Holger wrote: > >> Please simply accept that it's an issue for me as well as many others. >> Harvesting is supereasy: full keydumps are readily available. Yep, Full keydumps are readily available. http://www.keysigning.org/sks/ Yep, harvesti

Re: Creating a key bearing no user ID

2012-01-24 Thread Robert J. Hansen
On 1/24/2012 11:10 PM, John Clizbe wrote: > However, testing I did a few years ago found the amount of SPAM attributable > to > a key on a keyserver was not significantly different from that received as > just > random SPAM noise from an unused ISP account. My own experience may be worth mention