Enabling and using ECC keys (any reason not to?)

2015-03-26 Thread Mike Ingle
The current version of Confidant Mail for Windows includes GPG 1.4.19. However, the code is written to support version 2.1 and ECC keys. If you point it to GPG 2.1, it will let GPG handle passphrases, and will let you create and rotate ECC keys. Is there any reason not to start using them? I h

Re: Enabling and using ECC keys (any reason not to?)

2015-03-26 Thread Werner Koch
On Thu, 26 Mar 2015 09:59, m...@confidantmail.org said: > Is there any reason not to start using them? I have been reluctant to > bundle version 2.1, because once people start using ECC keys, using There is no deployed base of ECC capable OpenPGP implementation yet. Thus ECC is not enabled by def

Re: upgrading v1 to v2

2015-03-26 Thread Pete Stephenson
On Mar 26, 2015 4:47 AM, "Dave Kimble" wrote: > > Ubuntu 14.04 with gnupg 1.4.16 installed from Ubuntu repository. > Enigmail says it is about time I upgraded to gnupg v2. > Ubuntu Software Centre says I have the latest version. > > I have git cloned gnupg ?v2.0.26? and attempted to configure. An

Re: upgrading v1 to v2

2015-03-26 Thread Philip Jackson
On 26/03/15 03:39, Dave Kimble wrote: > Ubuntu 14.04 with gnupg 1.4.16 installed from Ubuntu repository. > Enigmail says it is about time I upgraded to gnupg v2. > Ubuntu Software Centre says I have the latest version. > I have a ubuntu flavour 14.04 and gnupg2 is certainly available in its reposi

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread Brian Minton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 I think gmail is the single most popular email client, with 500 million users. I think that until there is a way to verify pgp signatures from within gmail, pgp/mime will continue to show up as an attachment. There are ways to use pgp/mime or i

Re: Enabling and using ECC keys (any reason not to?)

2015-03-26 Thread Johan Wevers
On 26-03-2015 9:59, Mike Ingle wrote: > Is this just a backward > compatibility thing, or is the security of ECC keys not fully trusted yet? The buzz about Dual_EC_DRBG made it clear that it is possible to design curves where the designers have access to data that allows them to compromise the sy

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread Ville Määttä
On 26.03.15 18:17, Brian Minton wrote: > I think gmail is the single most popular email client, with 500 million > > users. There are about 7,3 billion people out there that don't have a clue what OpenPGP is. > I think that until there is a way to verify pgp signatures from > > within gmail, pg

Re: Enabling and using ECC keys (any reason not to?)

2015-03-26 Thread Pete Stephenson
On Thu, Mar 26, 2015 at 5:55 PM, Johan Wevers wrote: > On 26-03-2015 9:59, Mike Ingle wrote: > >> Is this just a backward >> compatibility thing, or is the security of ECC keys not fully trusted yet? > > The buzz about Dual_EC_DRBG made it clear that it is possible to design > curves where the des

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread Antony Prince
On 3/26/2015 1:57 PM, Ville Määttä wrote: > On 26.03.15 01:38, Daniele Nicolodi wrote: >> On 25/03/15 23:56, Ville Määttä wrote: On 26.03.15 00:14, Ingo Klöcker wrote: >> So it's not mailman that's not smart enough, but the mail clients >> the other recipients are using. Mail clients s

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread Ville Määttä
On 26.03.15 01:38, Daniele Nicolodi wrote: > On 25/03/15 23:56, Ville Määttä wrote: >> > On 26.03.15 00:14, Ingo Klöcker wrote: >>> >> So it's not mailman that's not smart enough, but the mail clients >>> >> the other recipients are using. Mail clients showing a >>> >> "signature.asc" attachment pr

Re: upgrading v1 to v2

2015-03-26 Thread Hugo Osvaldo Barrera
On 2015-03-26 13:45, Dave Kimble wrote: > Ubuntu 14.04 with gnupg 1.4.16 installed from Ubuntu repository. > Enigmail says it is about time I upgraded to gnupg v2. > Ubuntu Software Centre says I have the latest version. > > I have git cloned gnupg ?v2.0.26? and attempted to configure. > It says I

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Thursday 26 March 2015 at 4:17:46 PM, in , Brian Minton wrote: > I think gmail is the single most popular email client, Gmail is an email service provider, not an email client. They provide access via a webmail site for those who wish to

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread Brian Minton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Thu, Mar 26, 2015 at 3:49 PM, MFPA <2014-667rhzu3dc-lists-gro...@riseup.net> wrote: > > Gmail is an email service provider, not an email client. They provide > access via a webmail site for those who wish to process their email > using a web brows

Re: One alternative to SMTP for email: Confidant Mail

2015-03-26 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Tuesday 24 March 2015 at 3:27:47 AM, in , Mike Ingle wrote: > More > information and downloads at: > https://www.confidantmail.org The intro page on your website says "SMTP-compatible address format: keep your existing email address". Have

Re: One alternative to SMTP for email: Confidant Mail

2015-03-26 Thread Antony Prince
On 3/26/2015 4:27 PM, MFPA wrote: > Hi > > > On Tuesday 24 March 2015 at 3:27:47 AM, in > , Mike Ingle wrote: > >> More >> information and downloads at: >> https://www.confidantmail.org > > The intro page on your website says "SMTP-compatible address format: > keep your existing email address".

Re: PGP/MIME

2015-03-26 Thread Peter Lebbing
On 2015-03-26 21:10, Brian Minton wrote: but for comparison, searching my ~12GB of mail on Thunderbird takes a lot longer and is a lot clunkier of an interface than the nearly instant search using gmail's web interface. With IMAP, you can run searches on the server as well (I'm assuming you're

Re: PGP/MIME (Was: One alternative to SMTP for email: Confidant Mail)

2015-03-26 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Thursday 26 March 2015 at 8:10:08 PM, in , Brian Minton wrote: > I meant what I said about them gmail being a client. This is only true in the limited sense that they provide a webmail interface that performs a function equivalent to an em

Re: One alternative to SMTP for email: Confidant Mail

2015-03-26 Thread Mike Ingle
> From the bit of testing I did with it, it seems the "email address" is > merely used as a user identifier. The domain is irrelevant. You could > use nob...@nonexistent-domain.com and it would still work. The email > address doesn't actually have to exist. > > I don't think it does since the emai

Re: One alternative to SMTP for email: Confidant Mail

2015-03-26 Thread Mike Ingle
At present, there is no key verification built in and you have to check the key fingerprint (which is always shown to the right of the address) or check a signature chain on your key using a GPG key manager. Or you can Trust On First Use, if it suits your threat model. That's more or

Re: One alternative to SMTP for email: Confidant Mail

2015-03-26 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Thursday 26 March 2015 at 9:26:35 PM, in , Mike Ingle wrote: > Yes, the email address is just an identifier. The > address is used in two ways. One, it is hashed with > SHA1 and used to look up the user's key id. I'm in favour of hashing

Re: upgrading v1 to v2

2015-03-26 Thread Dave Kimble
It seems I've been replying to individuals rather than the list, sorry. Thanks to all who helped sort me out. I have been back over the website, trying to find the point where I got on the wrong track. I think it is down to https://gnupg.org/download which has the GnuPG Binary Releases section