3 ms·
$ echo "Hello world" > message.txt gpg --sign message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST u
by dvh 10y ago
$ echo "Hello world" > message.txt
gpg --sign message.txt
$ gpg --verify message.txt.gpg
gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E
gpg: Good signature from "John Smith <john.smith@example.com>"
$ echo "evil" > message.txt
$ gpg --verify message.txt.gpg
gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E
gpg: Good signature from "John Smith <john.smith@example.com>"
- martin-adams 10y agoI don't think I'm smart enough to infer what you're trying to say. Care to elaborate?
- StavrosK 10y agoHe's saying that, even though he changed the message, the signature still validated. He doesn't realize that the resulting GPG file contains the message, so it's verifying it against its own, stored copy.
- martin-adams 10y agoThat's what I thought, but couldn't confirm. Basically he's verifying a valid file and inferring it relates to a different file. Sounds like a UX problem than a technical one. It's equivalent to me zipping up a folder, changing the contents of that folder, then expecting the zip file to have the change as well.
- smnscu 10y agoThis reminds me of Craig Wright's blog post where he "proved" he is Satoshi, albeit that one was deliberately misleading. Off-topic, I think in addressing people with 'they' is more polite when the gender is ambiguous, despite the stats being in your favour.
- martin-adams 10y agoFunny you mention 'they'. I usually do that but noticed in one of my replies I used 'he'. Turns out I reciprocate what other's say without thinking about it.
- Freak_NL 10y agoI think dvh is confused about detached signatures and signatures that contain their payload. For detached signatures: gpg --verify message.sig message For signed files: gpg --verify message.sig gpg --output message --decrypt message.sig It's all documented¹. Dvh: what are you getting at? 1: https://www.gnupg.org/gph/en/manual/x135.html https://www.gnupg.org/gph/en/manual/x135.html
- dvh 10y agoI'm just trying to point out that it is easy to make mistake by checking normal signature and detached signature.
- Tepix 10y agoI agree that it's confusing. To get the expected result, the user would have to use either $ gpg --clearsign (makes it obvious that the message is part of the resulting message.txt.asc file) or $ gpg --detachsign (which creates a .txt.sig file) or $ gpg -a --detachsign (which creates a .txt.asc file).
- X86BSD 10y agoI use pgp daily with my email. I value it. It's good software. But let's be honest, SSL and pgp are the best we can do to secure comms from http to smtp today? Key/cert management is an epic fail from a usability pov. Is it done? Yes, because there is NO other choice. But pgp will never ever be anything but a niche application for the paranoid. SSL? I don't think anyone is going to argue it doesn't need to be scrapped and rewritten from scratch or replaced entirely. Encryption must be transparent for it to be ubiquitous. We're not there yet. I know this is a hard problem to solve but someone eventually will.
- dom0 10y agoPGP-People often talk about a "web of trust". Sometimes I wonder if any of them ever saw a web (like a spider web)? From the UX of popular PGP tools I can only assume no one did, because none of them can answer basic questions (and indeed, the data model doesn't support it, either), like "What's the relation of key XYZ [from an untrusted source, say keyserver] to my key?"
- dom0 10y agoGPG - without trying to devalue the good work put into it - is also one of the tools with one of the worst command line interfaces I know; by default it prints a confusing amount of wholly irrelevant, debug level information, to the point where it's hard to see where the actual output is (eg. --verify success). A slew of different key identificators (short ID, long ID, fpr, name, email, ...) that are all mixed in a bunch of places and only sometimes interchangeable etc. etc. The UX is just horrendous, and none of the GUI tools improve on that.