OpenPGP Meetup 24
An anonymous reader writes "Please mention the upcoming OpenPGP meetups, http://openpgp.meetup.com/. getting crypto out there into the mainstream is the only defence we have from outside interference." Consider it mentioned. I don't really know how getting together at local bar or whatever brings crypto "into the mainstream", but maybe you can sign the bartender's key or something.
Mainstream crypto (Score:2)
Umm...network effects from keysignings, which (to be technically accurate) require in-person identity verification?
I never really went out for that much effort. If I've emailed a person back and forth a few times, and their email address is on their web page, I pretty happily sign their key. PGP should be *useful*, not an anchor around one's neck
Re:Mainstream crypto (Score:1)
When one's working a lot with people from all over the globe via the internet, and you're never going to meet most of them, you can't really make this connection. However, there could be other useful connections to make.
For example, once I've emailed with the creator of software Foo a number of times, I do know that h
Re:Mainstream crypto (Score:2)
Just an email address...that's all you really need.
For example, Red Hat signs their RPMs with a GPG key that isn't used for sending mail or anything else.
Hello drunk person (Score:2)
Sure, I didn't know you 3 hours ago, but after a few rounds, I'll sign your key right away!
Re: Hello drunk person (Score:1)
So can someone explain these things? (Score:3, Informative)
I've had a PGP key for about 8 years, and it's been used by others to send a sekret mezage to me less then a dozen times. Off of the top of my head , I can think of dozens of people who have a Key, and only 1 other person who does have a key.
Why is this important? Why should I care?
Re:So can someone explain these things? (Score:1)
Hash: SHA1
High level overview here.
E-mail sent via SMTP is the electronic equivilant of a postcard. Anyone handling the message en-route can read it in clear text. But because it is digital, the likelihood of it being read by at *least* a 'bot (like Carnivore) is quite high.
The other major problem with e-mail is accountability; how do I know who this message *really* came from?
OpenPGP implementations like PGP and GnuPG address both of these issues.
You can encrypt a
Re:So can someone explain these things? (Score:2)
A plaintext email can easily be read by anybody who wants to read it, and emails aren't at all hard to spoof, either. PGP provides a way of verifying that the email you are reading was in fact written by the person who claims to have written it (assuming it's signed and you trust their key), and that nobody else read it inbetween his writing it and your reading it (assuming it's encrypted).
Sure, it might not matter much to you if John Q. Hax0r reads your correspon
Re:So can someone explain these things? (Score:2)
And alot provide an md5 signature instead.
So much encryption, so little time.
I can see it now... (Score:3, Funny)
-----BEGIN PGP MESSAGE----- Version: PGP 8.0.2 - not licensed for commercial use: www.pgp.com qANQR1DBwU4Dycxpn5YWMKIQB/4jcQBenjBJUnUCg4BX7mSmJ
BarKeep: That'll be
-----BEGIN PGP MESSAGE----- Version: PGP 8.0.2 - not licensed for commercial use: www.pgp.com qANQR1DBwU4Dycxpn5YWMKIQB/4hSvhixkEZ+CYj4Ow+8fK+D
Re:How does one revoke a PGP key from keyservers? (Score:1)
Re:How about with lost keys? (Score:2)
Aka "Pgp Key signing party" (Score:3, Interesting)
The problem is doing PGP signing the right way. I really suggest anyone attending one of these events take a look at web pages that describe "PGP Key Signing Parties" (just google, you'll find a bunch) to get the idea. In brief, to be absolutely sure that you trust a key belongs to someone, you need to verify the following:
- The key ID (2BCA871D for example)
- The key type (DSA, RSA, etc)
- The key bits (768, 1024, 2048)
- The key fingerprint (A028 82B4 14CC
...)
Any one of these items can be forged while maintaining the others, so you need to verify them all.Now, the hard part is how do you verify that this human who has brought these bits of data is the actual human associated with the key? You can check their driver's license and things like that. But of course this is where it's much better to only sign keys of people you know, rather than just total strangers.
Re:Aka "Pgp Key signing party" (Score:2)
Terms of service for beer? (Score:3, Informative)
You'd think with all the talent out there someone would have written a quick CGI to do this, rather than using a commercial service (meetup.com).
-- Bob
Re:Terms of service for beer? (Score:2)
Biglumber [biglumber.com] has. It currently has 498 people listed.
Re:Terms of service for beer? (Score:2)
Well, there is Biglumber [biglumber.com], which I rather like; it's just a shame that they didn't use it.