4 ms·
>So, why break PGP if you can politely ask the victim's mail client to include the private key? If your PGP private key has a good passphrase then you are stil
by upofadown 6y ago
>So, why break PGP if you can politely ask the victim's mail client to include the private key?
If your PGP private key has a good passphrase then you are still OK. This attack suggests that there is some value in how most PGP implementations attempt to protect the private key locally.
As a counter example, Signal Messenger does not even try to protect the private key or saved messages except with a short pin (and that is a new feature). That is probably based on the idea that any local attack is going to end up being a complete compromise of the end point ... which is not an unreasonable assumption. Then you can sniff any passphrase without any extra trouble.
In the end, message security is endpoint security.
This attack is entirely generic. It seems odd that the authors only mention the possibility of a PGP compromise and ignore all the other messengers out there that could be also compromised by arbitrary remote file access. It would of made things more compelling.
- sukilot 6y ago> That is probably based on the idea that any local attack is going to end up being a complete compromise of the end point ... which is not an unreasonable assumption. It's absolutely unreasonable. If my endpoint is compromised, should I assume my key is potentially violated, and so change it? Yes But should I assume that everything in my life is tainted and therefore pre-emptively expose all my secrets to attackers immediately? Of course not.
- gvjddbnvdrbv 6y agoI think the OP is actually suggesting that password protection provides a layer of defence in depth.
- gvjddbnvdrbv 6y ago.ssh/id_rsa... Nasty!
- frutiger 6y agoYou likely mean .ssh/id_rsa (or perhaps .ssh/id_ed25519). The .pub variants are safe to share.
- gvjddbnvdrbv 6y agoOf course I updated my OP.
- packetlost 6y agowhat's wrong with RSA?
- se32point1 6y agoThe original poster refers to sending your SSH private key, not RSA. Your SSH private key can be used for very malicious purposes. For example, if you use Git over SSH to upload code to your remote Git repositories, someone malicious can take your SSH private key, and hijack your Git repositories.
- packetlost 6y agoOh I got it, the nasty part is nabbing the SSH private key, not the fact that it's RSA... duh :)
- simlevesque 6y agoreminder to use a passcode on your private key with ssh-agent.