Re: Docs central, with 'Email Self-Defence'

2014-06-10 Thread Mark H. Wood
meone more knowledgable will correct my errors. I figure that, if I trot out my limited knowledge, I may help someone to understand just a bit, and I too may learn something in the process. > I suggest: Just give it a try. That is my suggestion as well. -- Mark H. Wood, Lead System

Re: adele

2014-06-12 Thread Mark H. Wood
; > A name is not copyrightable, in particular not a common name like that > of Peter's Grandma. In any case, if it is really GPL, it is not a > problem at all. Copyright isn't used for names, but a name in association with a business or service can, in some jurisdictions, be prot

Re: mascot_p

2014-06-17 Thread Mark H. Wood
We have one, but it's a secret. :-) > How about an Octopus? As I understand it, they like to try and open > locks. Alas, the octopus is already associated with GitHub: https://octodex.github.com/original/ -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should

Re: mascot_p

2014-06-18 Thread Mark H. Wood
Assuming that there *should * be a mascot, the discussion seems to concentrate on the secrecy aspect of GnuPG. But what about the other aspect -- assertion of identity? Does that spark any ideas? What sort of mascot would combine the two aspects? -- Mark H. Wood, Lead System Programmer mw

Re: mascot_p

2014-06-19 Thread Mark H. Wood
On Wed, Jun 18, 2014 at 01:56:45PM +0100, Brad Rogers wrote: > On Wed, 18 Jun 2014 08:45:26 -0400 > "Mark H. Wood" wrote: > >What sort of mascot would combine the two aspects? > > Racoon? Easily recognised so an allusion to identity there. Their face > has a &#

Re: Key distribution via NFC

2014-07-04 Thread Mark H. Wood
an do that. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be friendly. Machines should be obedient. signature.asc Description: Digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/ma

Re: symmetric email encryption

2014-07-21 Thread Mark H. Wood
> can only be kept for a while. Yes, that's an immense difference. > > Old Hell's Angels saying, "3 people can keep a secret if two of them are > dead". Not a very sophisticated bunch but.. Often attributed to Benjamin Franklin. -- Mark H. Wood, Lea

Re: Automatic e-mail encryption

2014-07-21 Thread Mark H. Wood
s is only exposed on the sending SMTP server and > the receiving SMTP and mailbox servers (f.e., IMAP). The mailbox server I treat hop-by-hop encryption, not as an alternative to end-to-end, but as defense in depth. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not

Re: Fwd: It's time for PGP to die.

2014-08-18 Thread Mark H. Wood
ps it would be a start if sites providing SMTP would turn on STARTTLS. -- Mark H. Wood Lead Technology Analyst University Library Indiana University - Purdue University Indianapolis 755 W. Michigan Street Indianapolis, IN 46202 317-274-0749 www.ulib.iupui.edu signature.asc Description: Digital signatur

Re: Fwd: It's time for PGP to die.

2014-08-18 Thread Mark H. Wood
On Mon, Aug 18, 2014 at 08:15:49AM -0600, Aaron Toponce wrote: > On Mon, Aug 18, 2014 at 09:59:33AM -0400, Mark H. Wood wrote: > > Perhaps it would be a start if sites providing SMTP would turn on > > STARTTLS. > > STARTTLS does not encrypt mail. It only provides safe passag

Re: It's time for PGP to die.

2014-08-18 Thread Mark H. Wood
(c) rely on some large corporation to handle the encryption and decryption > for us Same answer as (b). -- Mark H. Wood Lead Technology Analyst University Library Indiana University - Purdue University Indianapolis 755 W. Michigan Street Indianapolis, IN 46202 317-274-0749 www.ulib.iupui.ed

Re: Fwd: GNU hackers discover HACIENDA government surveillance and give us a way to fight back

2014-08-27 Thread Mark H. Wood
it evaporates entirely. Lies, rumors, and faulty logic readily die of exposure. Expose them! If someone attacks your secrets...attack his! The falsity of a false argument is one of your opponent's centers of gravity, so strike it to keep him busy protecting it. Secrecy alone is defensive. Th

Re: NSA, PGP and RSA

2014-10-02 Thread Mark H. Wood
honestly answer that question, if the suspected weakness has never been found? We don't know that it exists, and if it does exist we don't know its nature. -- Mark H. Wood Lead Technology Analyst University Library Indiana University - Purdue University Indianapolis 755 W. Michigan Stre

Re: Encryption on Mailing lists sensless?

2014-11-18 Thread Mark H. Wood
as I know, the principal effect of MTA-based antivirus in my life is to prevent me consciously emailing known innocuous code that I wrote to people who ask for it. So I for one wouldn't miss it. That's selfish of me, of course. -- Mark H. Wood Lead Technology Analyst University

Re: Encryption on Mailing lists sensless?

2014-11-18 Thread Mark H. Wood
eath my collected letters to someone, how do I arrange the transmission of the necessary passphrases as well? I wonder if the lawyer who draws up my will would even understand the question. -- Mark H. Wood Lead Technology Analyst University Library Indiana University - Purdue University In

Re: Thoughts on Keybase

2015-01-06 Thread Mark H. Wood
lot of labels ("identities") stuck on me by family, friends, enemies, employers, trading partners, etc., each of which is more or less independent. Various sets of these labels make up how my associates retrieve their concepts of me.) -- Mark H. Wood Lead Technology An

Re: MIME or inline signature ?

2015-02-13 Thread Mark H. Wood
XKVDstXV2FbgO9Jvkze9Uo+10oQ6XNntG/xi > TTBnF6pFGsG8yrS1ecK/Oq2dSqif0g8cjjJ1SKUHhZr91pGWdr5X0UkmXjJIvP8= > =KuOK > -END PGP SIGNATURE- > > ___ > Gnupg-users mailing list > Gnupg-users@gnupg.org > http://lists.gnupg.org/mailman/listinfo/gnupg-users -- Mark H.

Re: surrendering one's passphrase to authorities

2009-03-04 Thread Mark H. Wood
rive cannot be examined by the court, the government's case is somewhat weaker. So that's one non-ulterior motive for wanting the password entered. It matters less, in court, what LE know, than what they can demonstrate. This of course does not dispose of other possible motives. -- Mark H. Woo

Re: Web of Trust itself is the problem

2010-01-07 Thread Mark H. Wood
and "trust" are seriously discussed in grade school (perhaps in smaller words :-) then we'll begin to build a society (as opposed to a few experts and enthusiasts) which is prepared to use these tools effectively. As it is, few know *how* to care about their privacy. -- Mark H.

Re: Web of Trust itself is the problem

2010-01-12 Thread Mark H. Wood
ings that we don't care about. I think that technology can't help this as much as would knowing why we want some technology. People who feel a need will look for tools to deal with it; people who feel no need will ignore the finest tools. -- Mark H. Wood, Lead System Progra

Re: distributing ones public key (email)

2010-01-22 Thread Mark H. Wood
t about what it is and why my correspondent might find it desirable. -- Mark H. Wood, e-mail geek mw...@iupui.edu Friends don't let friends publish revisable-form documents. pgpF2fegslsgy.pgp Description: PGP signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: key question

2010-03-03 Thread Mark H. Wood
e then they'll wise up. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Friends don't let friends publish revisable-form documents. pgpx31WJoe1R2.pgp Description: PGP signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://

Re: key question

2010-03-03 Thread Mark H. Wood
re is a strong assumption among OpenPGP users that our community is, *ahem*, open. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Friends don't let friends publish revisable-form documents. pgpDQqoKbNvWl.pgp Description: PGP signature

Re: David's findings

2010-03-03 Thread Mark H. Wood
I think this exercise says something about the relative value of attempts to control the distribution of one's personal data, and of power to effectively punish those who abuse one's personal data. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Friends don't let

Re: key question

2010-03-04 Thread Mark H. Wood
d be drawn toward tools whose methods carry no identity data themselves. You can't accidentally misuse a feature that isn't there. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Friends don't let friends publish revisable-form documents. pgpf3FFEhJTrB.pgp Description: PGP si

Re: upgrading from 1.4.7 to 2.0.14

2010-05-28 Thread Matthew Mark Drew
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Charly Avital made the following observation on 5/28/2010 1:02 AM: > Olav Seyfarth wrote the following on 5/28/10 1:07 AM: >> Hi, >> >>> i have gnuPG 1.4.7 currently installed on windows xp >>> i want to install gnuPG 2.0.14 >>> question: will ther

Re: Keyserver spam example

2010-06-11 Thread Mark H. Wood
an RFC, it's rubbish; I run an MTA at home on my dynamic address, and it works just fine, and is quite valid. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Balance your desire for bells and whistles with the reality that only a little more than 2 percent of world populat

Re: AUTO: Richard Hamilton is out of the office (returning 06/24/2010)

2010-06-21 Thread Mark H. Wood
RFC2919, anyone? This list uses the List-* headers. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Balance your desire for bells and whistles with the reality that only a little more than 2 percent of world population has broadband. -- Ledford and Tyler, _Google Analytics

Re: Seahorse

2010-10-08 Thread Mark H. Wood
nservative, but some of them will become curious and try the alternative. Cost, from the user's point of view: a small dab of complexity (the tab panel) and a small slice of screen real-estate (the tabs). -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Balance your desire for bel

Re: Gpg4Win 2.0.4 with GnuPG 1.4.11??

2010-11-18 Thread Matthew Mark Drew
You can have both versions of Gnupg on your system (I do). The only problem I ever had was that WinPT used the latest executable installation irregardless of the defaults set within the program - to fix this I installed Gnupg 2.* (with whatever utilities you wanted) and than reinstated Gnupg 1.4.1

Re: What is the benefit of signing an encrypted email

2011-01-13 Thread Mark H. Wood
blem comes from paying attention to illusions rather than interpreting the evidence as it is. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgp0ZGInB3rvX.pgp Description: PGP signature

Re: What is the benefit of signing an encrypted email

2011-01-13 Thread Mark H. Wood
27;t think about what they are doing will at least confront the opportunity to think before doing one thing they may rue. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpFwbdU6O2Sn.pgp Description: PGP

Re: Help with OpenPGP plugin in Mozilla Thunderbird and Claws Mail

2011-02-16 Thread Mark H. Wood
e to you. You don't have to understand every single one of them right away, though you *do* need to thoroughly understand the ones you use. Just the use of personal cryptography is a large and complex topic. I recommend you do some further reading before relying on your understanding (or m

Re: Some SHA-2 news

2011-02-21 Thread Mark H. Wood
n of complexity over time probably belongs to the Creeping Featurism family. -- 1 Brooks, Frederick P., jr.: _The Mythical Man-Month_, p. 55 -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pg

Re: GPG and PGP

2011-03-16 Thread Mark H. Wood
re robust algorithms. > > Only if IDEA gets broken (or the pgp 2.x implementation of it turns out > flawed) or, very unlikely, 128 bit can be brute-forced in the future. On that day it would be well to already know what to do about it and already have the tools in hand. It would be best

Re: Deniability

2011-03-23 Thread Mark H. Wood
us from my online presence, and on the basis of those conclusions makes decisions on my employment or my insurance premiums or whether I ought to be prosecuted for something, can I punish her *enough to make her stop*? If she's following company policy, can I punish the company *enough to

Re: Signing a key (meaning)

2011-04-08 Thread Mark H. Wood
Sounds like some people could use a signature type which means: "I disclaim all signatures made by ". -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpp2yNFuADwp.pgp Description: PGP

Re: A better way to think about passwords

2011-04-18 Thread Mark H. Wood
ed on and do work without first spending an hour trying to recall something that looks like line noise. A legitimate user should not have to crack his own password more than three or four times in a decade. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are eff

Re: A better way to think about passwords

2011-04-18 Thread Mark H. Wood
On Mon, Apr 18, 2011 at 12:11:24PM -0400, Robert J. Hansen wrote: > On 4/18/2011 11:46 AM, Mark H. Wood wrote: > > It's easy to build gadgets which yield passwords that are > > mathematically very strong. The problem is that such passwords tend > > to be psychologica

Re: A better way to think about passwords

2011-04-19 Thread Mark H. Wood
I find more or less equally memorable as the word alone. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpUSmHDgEIfX.pgp Description: PGP signature ___ Gnupg-

Re: Passphrase

2011-04-27 Thread Mark H. Wood
se brute force will *always* succeed. It may not succeed in your lifetime, however. :-/ To the OP: someone probably could suggest a brute-force tool, but if your passphrase is strong enough to have been worth using then the tool would likely run far longer than you care to spend. That's t

Re: Passphrase

2011-04-27 Thread Mark H. Wood
out. Maybe he thinks that the key might be compromised in the future. It's still out there. There is a lot of future left. He has lost control of the key. (I know: I'm arguing both sides. I don't have a key guesser to share, and we don't know enough about the problem as the OP

Re: Is the OpenPGP model still useful?

2011-04-27 Thread Mark H. Wood
away with HTTP-not-S, not-S-SMTP, etc. and this just extends the argument to another layer.) o Agreed: most people don't care about most of their messaging. o Just so long as those who *do* care can plug in or wrap on something stronger and more manageable if they wish. -- Mark

Re: PGP and "Smart" Cards

2011-05-10 Thread Mark H. Wood
uers. The customer is the only one with a compelling incentive to change the system. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpUojP7ImyKO.pgp Description: PGP

Yet Another Mail Encoding Thread

2011-07-20 Thread Mark H. Wood
that this yields something more readable than what the sender thought I would see. But some MUAs do not even mark their HTML output as HTML, foiling this. :-{ When I open a message and see nothing but a farrago of markup, I generally throw it away unread. Unless it's an anticipated mess

2.0.18/GOG4Win

2011-09-17 Thread Matthew Mark Drew
Any idea when 2.0.18 will available via GPG4Win? Thanks ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: STEED - Usable end-to-end encryption

2011-10-18 Thread Mark H. Wood
door like free DDNS does. (I should read the paper; maybe this has been addressed.) -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpJcR3QKfU0G.pgp Description: PGP signature _

Re: STEED - Usable end-to-end encryption

2011-10-18 Thread Mark H. Wood
cess is an unreasonable expectation which can never be met. We need to teach our kids to expect to protect themselves online the same way we teach them to look both ways before crossing the street. Probably at the same age. Otherwise they'll grow up to believe the hype that you can buy se

Re: private key protection

2011-10-18 Thread Mark H. Wood
you very probably won't. You are guaranteed to get it right if you try every possible value. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpEM0NhDGA98.pgp Description: PGP signature

Re: private key protection

2011-10-18 Thread Mark H. Wood
is willing to work for). I was pleased to see room for different classes of users in the STEED paper. When I encounter software that tries to be helpful, my own first thought is: how do I turn that off? But I recognized long ago that I was never a "typical" user and my own inclination

Re: STEED - Usable end-to-end encryption

2011-10-20 Thread Mark H. Wood
What proportion of consumer-grade ISPs have bothered to implement DNSSEC for serving their customers? I don't think mine does, and they're a big outfit. If I asked, I expect they'd think I was speaking Aldebaranese or something. -- Mark H. Wood, Lead System Programmer mw...@i

Re: The problem is "motivational"

2011-10-20 Thread Mark H. Wood
Will Happen And I Didn't Warn Them. That's all I can think of right now. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpw5gM4CyipF.pgp Description: PGP signature ___

Re: The problem is "motivational"

2011-10-20 Thread Mark H. Wood
le in most circumstances.) -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpRe5Gr1rxur.pgp Description: PGP signature ___ Gnupg-users mailing list Gnupg-users@gnup

Re: The problem is "motivational"

2011-10-20 Thread Mark H. Wood
ose notions *are* secure. (Assuming they are. :-) -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpwl8L89XpQw.pgp Description: PGP signature ___ Gnupg-

Re: STEED - Usable end-to-end encryption

2011-10-24 Thread Mark H. Wood
the only thing worth saying to them (initially) is to point out real-life examples of bad things happening to average people who didn't think about privacy. No one can desire salvation until he believes that he is in jeopardy. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking w

Re: STEED - Usable end-to-end encryption

2011-10-24 Thread Mark H. Wood
On Mon, Oct 24, 2011 at 11:24:40AM -0400, Robert J. Hansen wrote: > On 10/24/11 11:15 AM, Mark H. Wood wrote: > > No one can desire salvation until he believes that he is in jeopardy. > > Although hellfire-and-damnation preachers are a popular cultural idea, > they're

Re: STEED - Usable end-to-end encryption

2011-10-25 Thread Mark H. Wood
t can I do?" Maybe someday there will be a panic and everybody will be asking. It's good to have an answer. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgposLjY6QnZN.pgp Descri

Re: digitally signing contracts

2011-10-31 Thread Mark H. Wood
n-EV customers. In any case you probably ought to read the CA's Certification Practice Statement and decide whether their procedures are acceptable to you. There may be sound ways to use X.509 material to initialize OpenPGP exchanges if that's important to you, or you could use P

Re: Using root CAs as a trusted 3rd party

2012-01-23 Thread Mark H. Wood
t little bit of fussiness won my repeat business, BTW. I figured that being fussy is what we were paying for. I wouldn't spend a dime at one of those CC-clearance-is-good-enough-for-us outfits. I guess that the lesson is: don't assume. Find out for yourself whether a CA is worthy

Re: hashed user IDs redux [was: Re: Creating a key bearing no user ID]

2012-01-27 Thread Mark H. Wood
hat someone does once they have your > private information: harvesting is the act of collecting. A difficulty here is that "spamming" is fairly specific, while "privacy" (it seems to me) is huge, amorphous, and defined differently by different people. -- Mark H. Wood, L

Re: On message signing and Enigmail...

2012-02-02 Thread Mark H. Wood
jects don't come from you. The pattern that you establish is evidence but not proof. I would like to say that, while proof settles the matter, evidence short of proof often has value. I'm going to continue to sign every email. Besides, I'm too lazy to turn it on and off. :-)

Re: SSH Agent keys >4096 bit?

2012-05-04 Thread Mark H. Wood
Let me turn things around. Other than providing opportunities to discuss the practicalities of large RSA keys, is there any reason why the agent should care what size key it is storing? -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking

Re: Testing GPG EMail encryption

2012-05-24 Thread Mark H. Wood
signed message to myself at another address, from Thunderbird, using Enigmail. It arrived signed, with a valid signature. Thunderbird + Enigmail + gpg2 works. You should consider the possibility that you have a different problem. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu

Re: Testing GPG EMail encryption

2012-05-25 Thread Mark H. Wood
works on my system, even though there is no GPG v1 installed on it anywhere, does demonstrate that gpg v1 is not required and gpg v2 is not the problem. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgpSQ

Re: Testing GPG EMail encryption

2012-05-25 Thread Mark H. Wood
On Thu, May 24, 2012 at 08:27:59PM +0100, michael crane wrote: > >> mwood@mhw ~ $ dir /usr/bin/gpg* Sorry, that's lingering evidence of my VMS habits: mwood@mhw ~ $ alias dir alias dir='ls -l' -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether

Re: Draft of nine new FAQ questions

2012-05-25 Thread Mark H. Wood
to deaddiaeresis. For German I also need a lower quote. Finding > 3 new keys with Emacs is hard ;-). And life is too short to go trawling the Internet for X Compose sequences. If I could find a comprehensive table I'd probably use them more. -- Mark H. Wood, Lead System Programmer mw.

Re: getting an encrypted file to show what public key was used

2012-05-30 Thread Mark H. Wood
n't guarantee reducing it to a single-element space. * And anyone who puts socks in one drawer and shirts in another has used hash indexing. :-) -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are s

Re: changing the default for --keyid-format

2012-05-30 Thread Mark H. Wood
re it is. Perhaps the search function (when there is one) could scroll it, or sort all of the current hits to the top of the table widget's viewport. I've been meaning to do something about that but, I'm ashamed to say, I haven't gotten it done. -- Mark H. Wood, Lead System Pr

Re: Why "trouble"?

2012-08-27 Thread Mark H. Wood
locks and sealed envelopes, but they are not taught to generalize these acts. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart. pgp8zojtuQtPo.pgp Description: PGP signature ___

Re: what is killing PKI?

2012-08-28 Thread Mark H. Wood
ful (in his eyes) that he might want assurance that only the intended recipient be party to the discussion. I doubt there ever was anyone who had *nothing* to hide. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are effici

Re: what is killing PKI?

2012-08-29 Thread Mark H. Wood
tor or lawyer who adopts a pervasive records security plan (of which customer communications would be but a part) should be able to negotiate lower insurance premiums. It seems to me that people are leaving money on the table all over. -- Mark H. Wood, Lead System Programmer mw...@iupui.

Re: what is killing PKI?

2012-08-30 Thread Mark H. Wood
ryone from my more intimate conversations with my wife -- we feel comfortable being vulnerable in the presence of those who love us, but uncomfortable showing that same vulnerability to others. In every society there are questions it would be highly improper for a stranger t

Re: what is killing PKI?

2012-08-30 Thread Mark H. Wood
isclose my public key, which is not secret, to my correspondents; my private key never leaves my equipment unless someone penetrates *my* system or steals *my* backups. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people

Re: what is killing PKI?

2012-08-30 Thread Mark H. Wood
On Thu, Aug 30, 2012 at 10:33:32AM -0400, Mark H. Wood wrote: > On Wed, Aug 29, 2012 at 03:14:50PM -0400, Landon Hurley wrote: > [snip] > > I do have a question about where you talk about backups though. How > > does PKI prevent back up loss? > > If I can prove that I pos

Re: what is killing PKI?

2012-08-31 Thread Mark H. Wood
;me + anybody in the IT department at ${giant e-tailer} + anybody at the records management service they use" to "me". I think that's a significant reduction. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like askin

Re: what is killing PKI?

2012-10-04 Thread Mark H. Wood
in the virtual world as in the physical world and I had better understand how to get it. If more people would cross that bridge, I wouldn't have to work so hard, because more of the burden would be shared. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Who also thinks locks are i

Re: OT: USB key with hardware encryption?

2012-12-03 Thread Mark H. Wood
ed-flapped or zipped pocket, for example, or even a money belt or a traveller's concealed document shoulder pouch) in which you will carry the medium, and write out a checklist to make certain that you've followed your procedure. -- Mark H. Wood, Lead System Programmer mw...@iupui.ed

Re: Is a document signed with hellosign legally binding?

2013-01-04 Thread Mark H. Wood
I don't know, but I must say that I'm wary of dealing with unknown people who are collecting signature samples from all over Europe, offering a service which seems to accomplish very little and making disputed claims about its legal effect. -- Mark H. Wood, Lead System Progr

Re: Paperkey 1.3

2013-01-07 Thread Mark H. Wood
than the on-the-shelf lifespan of already written > data. I'd suggest assuming some periodic read-only use, since we *should* be testing our backups regularly to discover decay *before* it makes something irretrievable. -- Mark H. Wood, Lead System Programmer mw...@iu

Re: Paperkey 1.3

2013-01-08 Thread Mark H. Wood
On Mon, Jan 07, 2013 at 05:54:15PM +0100, Peter Lebbing wrote: > On 07/01/13 16:39, Mark H. Wood wrote: > > I'd suggest assuming some periodic read-only use, since we *should* be > > testing our backups regularly to discover decay *before* it makes > > something irretrie

Re: US banks that can send PGP/MIME e-mail

2013-02-25 Thread Mark H. Wood
ghtly difficult to steal or forge, is not something that most people can realistically do with the current crop of CAs. Long-distance relationships in the security realm make trust difficult, in both directions. None of this has a great deal to do with OpenPGP or GnuPG as such. -- Mark H. Wo

Re: US banks that can send PGP/MIME e-mail

2013-02-26 Thread Mark H. Wood
their jaws up off the floor. This is probably the origin of the closed, private email system locked away inside each bank's site. That is, perhaps, where one should work on acceptance of suitable encryption and signing. ("Suitable" including wh

Re: Questions about OpenPGP best practices

2013-02-26 Thread Mark H. Wood
ct: No route to host > gpg: keyserver internal error > gpg: keyserver send failed: Keyserver error The site doesn't want unencrypted connections, and they way they enforce this is by returning "no route" to requests for connection to port 80. I would have used "administ

Re: [OT] Why are you using the GPG / PGP keys?

2013-05-28 Thread Mark H. Wood
ven sure who would study such things. Anthropologists, I suppose. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be friendly. Machines should be obedient. signature.asc Description: Digital signature ___ Gnupg-users

Re: Relevance of e-mail (was [OT] Why are you using the GPG / PGP keys?)

2013-05-28 Thread Mark H. Wood
ils I've sent, but I assert that I sign all emails addressed to humans. (Some mailing-list robots are fragile and have trouble with signatures when directly addressed. Boo.) -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be friendly. Machines should be o

Re: Relevance of e-mail (was [OT] Why are you using the GPG / PGP keys?)

2013-05-29 Thread Mark H. Wood
Ha, that reminds me, when I submit artifacts to Maven Central (a public code repository) I'm required to OpenPGP sign them. Maven has a very nice plugin which handles this automatically. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be friendly. Machines s

Re: [OT] Why are you using the GPG / PGP keys?

2013-05-29 Thread Mark H. Wood
use now. The world is changing > but most of the changes aren't good. Wow, *real* military use? I want to see an iPhone after Raytheon has had a go at it. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be friendly. Machines should be obedient. signature.asc

Re: Why OpenPGP is not wanted - stupid is in vogue right now

2013-06-10 Thread Mark H. Wood
it is right and proper for me to control, and it is wrong and improper for others to attempt to control them, because my society generally agrees that this is so and my government is (generally) willing to enforce laws codifying these norms. -- Mark H. Wood, Lead System Programmer mw...@i

Re: Recommendations for handling (multiple) user IDs - personal and company ones

2013-06-10 Thread Mark H. Wood
at the real cost of crypto: you have to think about it. There is no escape; you have to think deeply about slippery things like identity and trust and threat models, and then you have to apply your resulting policies a hundred times a day. Software can relieve large parts of the latter

Re: Multiple email addresses - any alternative to ask everyone to sign all my keys?

2013-07-24 Thread Mark H. Wood
mail sent to my > unversity addresses on the computer at university. And I want to use > encryption, since the mails might contain sensitive information, such as > exams, grades, etc (and the mail servers are maintained by students). It's called compartmental design. No one compromise

Re: Multiple email addresses - any alternative to ask everyone to sign all my keys?

2013-07-24 Thread Mark H. Wood
urreptitious monitoring, how do "they" know that I am not doing surreptitious monitoring? Remote log servers, firewall logs, 'tripwire', cheap cameras the size of an aspirin tablet -- Mark H. Wood, Lead System Programmer mw...@iupui.edu M

Re: Multiple email addresses - any alternative to ask everyone to sign all my keys?

2013-07-24 Thread Mark H. Wood
rent dimensions of communication security. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be friendly. Machines should be obedient. signature.asc Description: Digital signature ___ Gnupg-users mailing list Gnupg-us

Re: Why trust gpg4win?

2013-07-26 Thread Mark H. Wood
or people to find out for themselves who is reliable and form open-eyed trust relationships. If one wishes to be more self-sufficient, one must learn a great deal about work formerly left to others. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be friendly. Mach

Re: Why trust any software?

2013-08-06 Thread Mark H. Wood
t; Fri, 26 Jul 2013 09:22:32 -0400 > "Mark H. Wood" wrote: > > > Well, Windows users who aren't programmers, who switch to e.g. Linux, > > will then be Linux users who aren't programmers, so this alone changes > > little for the individual. He is stil

Re: Can I create domain keys?

2013-08-14 Thread Mark H. Wood
natures. Suspicious, verify out-of-band. It seems unduly risky. Traditional methods of forgery try to bury one identity under another, but forging PK certificates *asserts* a new identity. It feels to me like making too much noise -- it attracts attention just when and where the forger wants to

Re: Can I create domain keys?

2013-08-14 Thread Mark H. Wood
es mingled. It would depend on how I have known him to use his identities. But if they are the same person, then what harm? I try to keep my personal and professional identities distinct, but some people don't. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Machines should not be

Re: Don't Panic.

2018-05-15 Thread Mark H. Wood
On Mon, May 14, 2018 at 04:48:31PM +0100, Mark Rousell wrote: > Amongst other things this includes the following paragraph which, as I > understand it, is essentially untrue: > > "There are currently no reliable fixes for the vulnerability. If you > use PGP/GP

Re: A postmortem on Efail

2018-05-21 Thread Mark H. Wood
us. o What we have done, and are doing, to keep *your* cost down. o What else would we need to do, to make this something *you* want? -- Mark H. Wood Lead Technology Analyst University Library Indiana University - Purdue University Indianapolis 755 W. Michigan Street Indianapolis, IN 462

Re: A postmortem on Efail

2018-05-22 Thread Mark H. Wood
On Tue, May 22, 2018 at 01:42:07AM +0100, Mark Rousell wrote: > On 21/05/2018 15:17, Mark H. Wood wrote: > >> Break backwards compatibility already: it’s time. Ignore the haters. I > >> trust you. > > (I understand that that's a quote of a discussion-opener from th

Re: A Solution for Sending Messages Safely from EFAIL-safe Senders to EFAIL-unsafe Receivers

2018-05-30 Thread Mark H. Wood
We can't enforce technical security without proper OPSEC. Regarding the > > Subject, Reference, etc, it is way easy and more secure to educate the > > user about the fact that only the content is _end-to-end_ encrypted and > > other parts, like the Subject, are required to

<    1   2   3   4   >