3 ms·

So it appears that this site has the perceived advantage of turning a web developer's SSL cert into key for encryption, which at first sounds like a good idea.

by iuguy 16y ago

So it appears that this site has the perceived advantage of turning a web developer's SSL cert into key for encryption, which at first sounds like a good idea. If on the other hand you don't exclusively communicate with SSL-using web developers, you're better off using a PGP implementation. Unfortunately Symantec bought PGP Corporation, but GPG4Win[1] is free, as are GPG-based PGP implementations for almost every other platform. Worried about it being hard? It really isn't. In fact it's easy to get up and running with encrypting your Gmail in Firefox[2] even if you have a Mac or something else[3]. [1] - http://www.gpg4win.org/ http://www.gpg4win.org/ [2] - http://www.instructables.com/id/Send-and-Receive-Encrypted-E-mail-in-Gmail/ http://www.instructables.com/id/Send-and-Receive-Encrypted-E... [3] - http://www.instructables.com/id/Encrypt-your-Gmail-Email/ http://www.instructables.com/id/Encrypt-your-Gmail-Email/

adamtj 16y ago
Here's what he's using it for: http://vulnarb.com/ http://vulnarb.com/ It's not for communicating with web developers. It's for publicly and provably, but responsibly exposing vulnerabilities in software. The people/entities who write such software are likely to have a public website with SSL. If they don't, it's unlikely to be very important or widely used software. In that context, PGP makes no sense.
defen 16y ago
If you use the Firefox Gmail extension, watch out for the autosave drafts feature of Gmail, which will put a bunch of copies of your unfinished unencrypted email on Google's servers.
jevinskie 16y ago
Can you point me to a site that discusses the best practices for generating and securing my keypair? I don't have enough faith in an Instructable to get all the details right. How would I go about becoming part of this "web of trust" that I keep hearing about in relation to PGP.
- tptacek 16y ago
  While there are Internet services that purport to realize an actual "web of trust", the "web of trust" concept is really notional. It's more an idea than a thing. The idea is, instead of having a central authority that vouches for every key, you get your keys directly from your acquaintances, verify them directly with your acquaintances, and in turn vouch for those keys with your peers.
- kgo 16y ago
  The GNU Privacy Handbook does a pretty good job of blending both the how and why of everything. http://www.gnupg.org/gph/en/manual.html http://www.gnupg.org/gph/en/manual.html The biggest thing to worry about is that you only want the private key on systems you trust. If you put your private key on a USB stick, and use the local library or computer lab, you've already lost the battle. If you're running a totally infected Win95 machine, you've already lost the battle. Second biggest thing is to make sure you properly generate a revocation certificate, and a backup, and store them in a location you consider secure. (And maybe that secure location is just a shoebox in your bedroom closet unless you're worried about the NSA or something.) Then if you realize you've done something stupid, you can just revoke the key and create a new one. Other than that, there's not much to screw up if you follow the default settings when creating a key with gpg. For email, I would also highly recommend using a local MUA that connects to gmail. Most people use Thunderbird + Enigmail, but there are other options. Enigmail also has a pretty good manual that covers both the how and why. http://enigmail.mozdev.org/documentation/handbook.php.html http://enigmail.mozdev.org/documentation/handbook.php.html The various gpg-related mailing lists are also pretty friendly. They're low-traffic enough that people are always happy to answer basic questions; no RTFM replies.
jevinskie 16y ago
Can you point me to a site that discusses the best practices for generating and securing my keypair? I don't have enough faith in an Instructable to get all the details right. How would I go about becoming part of this "web of trust" that I keep hearing about in relation to PGP.

by iuguy 16y ago

adamtj 16y ago

Here's what he's using it for: http://vulnarb.com/ http://vulnarb.com/ It's not for communicating with web developers. It's for publicly and provably, but responsibly exposing vulnerabilities in software. The people/entities who write such software are likely to have a public website with SSL. If they don't, it's unlikely to be very important or widely used software. In that context, PGP makes no sense.

defen 16y ago

If you use the Firefox Gmail extension, watch out for the autosave drafts feature of Gmail, which will put a bunch of copies of your unfinished unencrypted email on Google's servers.

jevinskie 16y ago

Can you point me to a site that discusses the best practices for generating and securing my keypair? I don't have enough faith in an Instructable to get all the details right. How would I go about becoming part of this "web of trust" that I keep hearing about in relation to PGP.

tptacek 16y ago
While there are Internet services that purport to realize an actual "web of trust", the "web of trust" concept is really notional. It's more an idea than a thing. The idea is, instead of having a central authority that vouches for every key, you get your keys directly from your acquaintances, verify them directly with your acquaintances, and in turn vouch for those keys with your peers.
kgo 16y ago
The GNU Privacy Handbook does a pretty good job of blending both the how and why of everything. http://www.gnupg.org/gph/en/manual.html http://www.gnupg.org/gph/en/manual.html The biggest thing to worry about is that you only want the private key on systems you trust. If you put your private key on a USB stick, and use the local library or computer lab, you've already lost the battle. If you're running a totally infected Win95 machine, you've already lost the battle. Second biggest thing is to make sure you properly generate a revocation certificate, and a backup, and store them in a location you consider secure. (And maybe that secure location is just a shoebox in your bedroom closet unless you're worried about the NSA or something.) Then if you realize you've done something stupid, you can just revoke the key and create a new one. Other than that, there's not much to screw up if you follow the default settings when creating a key with gpg. For email, I would also highly recommend using a local MUA that connects to gmail. Most people use Thunderbird + Enigmail, but there are other options. Enigmail also has a pretty good manual that covers both the how and why. http://enigmail.mozdev.org/documentation/handbook.php.html http://enigmail.mozdev.org/documentation/handbook.php.html The various gpg-related mailing lists are also pretty friendly. They're low-traffic enough that people are always happy to answer basic questions; no RTFM replies.

jevinskie 16y ago