Keychain

benzyme · Oct 12, 2018

benzyme · Oct 12, 2018

I couldn't find a thread on this, so I created one. That's one of my keys (Benzyme)

MachienDome · Oct 16, 2018

Excellent! A sure-fire way to know you are indeed talking to the real person. Also helpful in keeping jackboot thugs out of your conversations - where they belong.

Allow me to add mine (updated):

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGEkXyoBEADcKOh1VCyA90xompTq0U+M01zkSSb20TuGHfVmuyt56LDg6Rk7
Lj8WuKQFEZmjM6+uCIkZAdLuH7L9pKHubGQf8wIjFhzpISDRgRmHRPENjvgwlYQk
pKOCNBtZ2hqQF9xBqEg1/sJ+ZSNP6upUbP0tYys/0nph8P13TCSZZG0ekhYmjTxN
w/2mSSa+o243iZXnyRjLLOt0Cz+VvZ9BtIDVlZjwnhIcRz0UUoF4ItMFklHNOHyg
ktlenEm/2ciJ/Nqjq+kNkTNEeUQfBM3Z9OeA/ou167ZfWHTH41qd5dbumarvtdTb
lJdsPNfrmlCQ3d+0BArSNKPqbBq9S7KgsQujpZtxOSO/14nNV/escZXsYBh6dw7x
1SYvZn4GWeUr5Rr6jEPS8LeT5GWtv2pIPvmtqvocRqCKD5gKJZJ3IS4653Zn8MzD
9ca7ciSDSCcGCJr5oGD31tg6WvNjQkswqaFKgscDEmX4ULEuAFojtw4Rov9Tlkt6
YDWS5iqO2s0imdyWOPsmqP1lGF7aTHOiz0rb1xTnDvAOHL+8DwFJPI7sEiW/zzGm
BuwJBTh14waQdYQWeLx9N8wzWx0bgW3Hs5DqJRWdXNKyzDu9ERagxL6DdhBjZDw+
4yPvqENpCYxeypEgJQQzHdkhXHtt2edHx26cuv1IDTkjxJFe2EjPeenr8QARAQAB
tAtNYWNoaW5lRG9tZYkCVAQTAQoAPhYhBEYgQ4gRW1TfkoQTwDqPaknrhnJOBQJh
JF8qAhsDBQkRmVWWBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEDqPaknrhnJO
4a0P/RM46VoJVHJs3H1dGzewZyVuu43oqgwFWcDbVWlTDXwWs5zfHW9hiV06LVy8
YvyIG9VqHhHnRJQC4NS72p/YSGKBOdGwr76LZIIFIfcmfJ4Lx2szRDrPzf1FoEv0
Sd/q3wxVbZXNTkulO4l1zKiZGhrG/bs2xhjVNhu5pctVJIqZdXCdSmDHelbS5FYA
ouT35qWDUkcJfFg53CD5kbQkKZXMBEvxui+ngzeQT1Ugyp2nD3ZhaY6chkgy/5yo
RPAiAoUrpE51qHzpFLIAcEkJtZRC40csiP2d+TT80eTOPme69mdg9V+mnn53cdNm
6HBHS55kkWlS8RRytwMpWJUfdJslE34ESufcCOgI1gKJ13kZbhWwCdMJ2wA8pNNA
DCLs5LbRLZhEVU+5AVo/00vbPAAzauwHT/CQtlzUG9mb0uLmGyba3HgHNDMkKhP0
wo5ahuK+C7mVUaLgxcljwMTMgavaWW059BpWOa6W9R/QwXRAdTt8gbwGjBChY0mA
Q4GfCOR+OIpeRbNr6LsOGZSvOLiT4uynE6b2uBaX/hVGoaZ3iYMUMsfD+w1FyFU5
+Id8/3iF0xeo/KxzuvKGOXoNOanfsAf8vpn0AE2grMG+mSr9vg/iAW/GLc48Q+4K
g9ZlTysaqAPD0ZWuhPPB4mcpMW0NX8OSujaz3LX1/gl75GsduQINBGEkXyoBEADA
rxZTvsKHihM/5nVeaKDWJTGGLWGy7yzZPeI47twJcP8FuVaaxBlarUY48WgY+wAJ
WGdW0/q1W8/ow21OGqdvXbEc+jXjONVmdPaF214R8D7WuMgaI8bKsgqEGGaeLFmq
Yl9N01Ltknt0VAByItGydS5JrWap0oS0CzC0ed9OgIuD1hyNl7Yffg2vIWmQUEIB
lhwy7G0t9tpRbPR/FLEtlIDJ3luMINGzd+u8zGD2gqdU8jRqRmDHZQxGk2pssT+5
LtFqfSibO45kp4/Q0JTOkEx8yzqImhBhV9u2XfNufO4qP0RG4dHtO3U0f/Myfkl5
nuwd00m1n4vTiheTluTPM7jH+wIutgYu1GGJobWKSrgym5blM20rb6GSuRugS/Pl
bk+IcQAZUypXKKODXHUP/yWH5lyFXlpGIQ58eZ53Q7gIzFCEBg90yqWAPBBWlnXm
3xxcyQShog1pPh0j9dCLFpInufhVAxXHPAy+IGsxKRK43vU18j5quSUXGBiwN9io
SisERF61lRHTD1AHkKOl4URWU295AEPcj7/iJmqKyMJwnjj+D8AV7mtbV5HjKsbd
Ciuu5QMMBW72Kw9Kqsn0wkcklxnc5fIRD1wn0nfiB6MT4tzHx9MLmUumlbgPpqxw
NvDm5nNoLi7HFFa3vObCh96GN9kFsFUeUuM/iNwwkwARAQABiQI8BBgBCgAmFiEE
RiBDiBFbVN+ShBPAOo9qSeuGck4FAmEkXyoCGwwFCRGZVZYACgkQOo9qSeuGck45
MhAAx+QvXIw5jgEuzywY0jY7goAoJwgkknwdPZXwJBZBZmuhgpcRIYO290PnVKXI
aiKZIfzKo0oe5jP9DpZw/0eVmcYEtR5xhocFjfIefmTvQKjC89lUdo4yTzMh+tVS
Z5saTBW+whxLS/itgdlqY6cn8DJPPF2vGQmG3NXK+Pa0kxbdyXBTwktrjfpKIYdk
FmsGwEjIBdoGZk6QjqaHeoWu2J588Kc7ILX1ZXoKkQ0CQTLgLBT8d7xe5JPQq6jm
dhhXCmpNpt0HKvkWk0TnGxca4MoVPNqGFIkSwiLFTgbLjZKwm5qVCo/6rUqRUakl
1lxHMr/QN7L9hESHpr7ubnCzCE0GdhpeXxvOnHdGWsDKWrwDuV9fvNE5Qh8MSmGx
qYUfuMMNVr133c6oRP8x3UeaDcXJtzxhSujyD9bUM8plkbUtNTB/T39vsEzBq23w
cZIQCfz3ycWMazVyb/wkQFGDU44ndkskkqbtk6Xkhs6CJD6H53zeGafRxp1DqVI0
Z9XYIwAn4xxAYN//yrqDw3TQYAdhZlOgJGR/iHA66Ee7nVrvruqZJ2sM2CxNyEu7
9OcY8n4iXfGed2f1VIIZm+Gbxss2ZaGdCy9JSUadjol4ByEc1rtHHcKYBUgNUjs6
MgyDdrN2nSX21VsSFi79OU4fC4DwA3+NdSBzKPIOuvKtzeY=
=pMFR
-----END PGP PUBLIC KEY BLOCK-----

○ · Mar 9, 2019

Nydex · Mar 9, 2019

Popping in mine as well

Tony6Strings · Mar 9, 2019

Ok I'll bite. I've read about encryption and PGP and still don't really understand this thread. Will somebody please explain, in layman's terms, what these large blocks of text are for?

Nydex · Mar 9, 2019

Tony6Strings said:
Ok I'll bite. I've read about encryption and PGP and still don't really understand this thread. Will somebody please explain, in layman's terms, what these large blocks of text are for?

Long story short - those large blocks of text are the public PGP keys of other people. Having that, you can encrypt a message that only they can decipher with their private key.

I highly encourage using PGP encryption when discussing sensitive topics and exchanging sensitive information with someone else. A very simple to use and effective software for that is gpg4usb. You can check out their documentation section (one of the best written documentations on PGP software out there) to get a general idea what encryption is, and why you should use it.

Also what's cool about this particular software is that you can upload it to an USB drive and literally attach it to your keychain and bring it with you everywhere in case you need to discuss something sensitive urgently with someone while you're out.

Be well.

ducdevil · Mar 10, 2019

great idea, Benz...to have these accessible. wonder if there's a way we can list these in our profiles?
here's mine:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFwL/jkBEAC9KzCT4imH+3DEf/0MoEwhyguYKQZlL8dyxopE6I/B94r08OSy
eH7DBYhnvoGyBDwMEIPcXUbbwiE5kLX7mfwzoqHuwjP8OoMZ7A6hLe5voPEd6Z+A
aLcNgpvNJRrIu92ctdXNqe0z3aomdOuMzsL0mghD1kmSZt+MqBw1F+kGDK0qny73
Ck/q0PF/LXXZ1YjJxs/dWGlrRglDI/ro3REI4HQJoT9X1Pb6CZqPS0eS8FZGq+Qk
cFL6zsGsUBhaMj1mvCARkyZTVky8FOF6JYS5Ru9lNwLAFr2Nq2ZUMPJqS69wULM7
E9OtLrGizo8lWRydnD0I6hwyPL4fMD5/gZ7pyqN75HdjKjlbJhLsA/DXgEEnsgx9
nCZHxraC9DkJyFkTpMNRs57NzUd0WgSrhRaJwK9Zxcj4ryZ+go++3LvRjWkrNb0Y
uDL/UX3UWATlkTz+XLwNfZX5k2gKzBDNSE794apo55qAejPAnkdgRxLnTI5HIEhv
h9ebIad9C4ocyLLEVKPtbgEqCUPII77ecjU6SoVdMilxntRYHwc7UVIcGvgcRbla
U1VGJAM6my02gQhuTiPshiAzRLSio99YhrQum/+zXLfB4MwBYFdL1ODas69n/h3J
g3GdPufX1c1sjuDANv+6VibaAGIQlboTaJ41JjOeJ7urXXayn/gEz7phNQARAQAB
tCpKb2huIEJlcmczIDxwdXJpdHkub2Yuc3RpbGxuZXNzQGdtYWlsLmNvbT6JAlQE
EwEKAD4WIQTucWfW2UeDT3caJd9sXmkt9mgUkwUCXAv+OQIbAwUJB4YfgAULCQgH
AwUVCgkICwUWAgMBAAIeAQIXgAAKCRBsXmkt9mgUk3e9D/95L5yW1IblnblT2K8M
N1iacH16szuMmFlH4QQwnkDOmrhcclYrwW395g4/S8FO/h0ttGamFcFc5oABx4d4
2eoomWPtC+ERogMDrrZRusW2H7TSeKNLFr7iG74FmJ5JfR+hlhNPpSWzzICjv8Ni
316HEELD5ECqEuKDdgZNeyGVn5nNUaUZ2vYYTIcXXwvLAOVKgDGRl2EQirZhAPiz
OuFh5qAu2fvlBnxYYhFzf4fDC52Y1wtbexQawEdBfQTAczqoCa1/TDc9Znonz174
/X4GY0j8y9ZtrOT1MGlxWLs3R9D4gLy25WtkLNtUnsniB1iKzKYnzmbTpbU43zv8
xq+PjnR2XBl1GSkYuU3mX6eshsfBAHj9aMoE7EYTnuUOZ2bU0BKOqnfoOStg/v1p
SgBbuL00hMmpe2e0njnfOgymnnHNccQ8h1lJIdADLwMSUCDy4HZCmJRyHT5OJ4zB
VML9qDMPR6ognLY0c9SfBW+pOgOTmYa8+HJ5OP3eK0dleMdOWKY/dbiyr+R3Nsuo
MwmqI68UeeLH/ja9Nt1gkmcoENlX3iYLjSCMt48wmok6o1ZjVT/v383znZk9yX7L
XUf1Uhm9LBrPfZUHPyyfwgl/2RO/J+aw+zs+QTJ6+J4fp6USYsIIvlbEmCPBO0ap
TwX2ni/zfDJVhIxTwwPDkT2J9bkCDQRcC/45ARAAttvz74BaJ0L39vqmO8i2y4QW
Hi1+VPvXDy3D81LrECnqKv1n0/OUKOfep3WnBEn+0RTxiyElbQ0RwjdVwZdezLEy
lCSBCgFLBXJhrqnf8PbKSf8McNuKUDleMYDtvIq62/RlFE3r/ChxkqTjGvVrngss
aWomDTzVFHDKZLqxSaFgMlQOuPVAqQcxtPfTIGWLfVk4Z5tuy2DNss/WSHu0caao
rTzf/8dpcVRvf8t2zOXYlBdJwGim9sH+R4ALA89HKW97T8WsVM7mkhkBeQjrJudr
jJh+cv8mIccmWOcJLJF3VVF45F5Ons/Nk4TVmBCf9K50dRX9GCAt9uig22lNPlYP
Yg6pqDJe19rELbyA8FOVhBxGeZ0/55xZkgfcEPz9/7SLLoQOCEAhWtiJvobYkzP9
lX1pxwaDivcSkWUVdtMZgWO83R/kEBFHcSz5eY2J2LQD4l3Wz5Hnb3MC1+WwXkWU
iuv2SgbGLlILseRlVt4+I4T3gXRmOI6PuooDP7fTsK7l5DrCR8YI7vyi6ZILofD7
cv2IYtocl0IjeUNuOi0UJduhxupsSXZJ8yLj56ULXMdV/R8bDclugk70OyXZ1mxp
/SKZmN28zXWf1FVAcTotPnTg4HV4AZ5Cyg9vWHAUxHtCswM9t+kL8YBTLIfwUF27
lU8h7jX4uQVl1YJ5EC8AEQEAAYkCPAQYAQoAJhYhBO5xZ9bZR4NPdxol32xeaS32
aBSTBQJcC/45AhsMBQkHhh+AAAoJEGxeaS32aBST1boP/AtD2sBYcgjKro86ihUE
vQXgYTRz90zm4rYXWRnbQ24Rwoo2UnDV6q601fukbXvDH0jQveJcFKGVcWI+dx4T
QKa+4NV+Ue5Iw3PGF/GiFTN5v1rTuAlCoHCCf4rAakSmU2oNPsLROIWVy/KQ2o7B
TwEihXglnzJ0C654VjU+TyRZlpFmS13YcFedLZXGMS2Oa92PzJ3JoY7OkEID825V
fXjzmVFZF1SOnNP9Ex0A4XBhJcH4D+6c3MHV4xsKDgEbuyFhNy7GQPDgjInj+1SF
9cB/udmPaRVWyCLtkJH0tXjorlsgDHmWDnpBsoTzEUKFGezaJx7GzQ+9rbqTGw/y
FdZdTUCVToXSk7BKIeDXMO38jmI+1HK5ayaFlYnyPgpCb/bR8ccicXC8w3tmpcBV
2MGeQGwD+6THt4eVqF2YVed/U4pWoaMrKDNYUamWv3X7R+MHsgSL2hBmHy9twXoV
TPQPzwjHl0UA+YkJ5b9T2HE8ONJ6XBg9GetVo6Zcm3zJdpeHk9JtD2g39gQGkfQp
zr6MFCKIdSg9jTOym0eqpOk/CocTxWhGzaaAkuoTZaIR+QATgnbHjqFSaz0kV/b4
fu1c7rQlN62bfFZZpJa72KUXVQBWeuXqlpaZjVfh012bgaSykG5x3uVjbhelRu1V
Fv1CrwGu8KPi250XeMPsKN/x
=UZOO
-----END PGP PUBLIC KEY BLOCK-----

some one · Mar 29, 2019

Wired - We're calling it: PGP is dead
Motherboard - Even the Inventor of PGP Doesn’t Use PGP

MachienDome · Aug 14, 2021

some one said:
Wired - We're calling it: PGP is dead
Motherboard - Even the Inventor of PGP Doesn’t Use PGP

It still provides non-repudiation, message integrity, and a sufficient level of encryption for limited personal use. No sense in just getting rid of it and using nothing at all in its place...sure its old...really old...and depreciating...but its not broken.

MachienDome · Aug 14, 2021

Tony6Strings said:
Ok I'll bite. I've read about encryption and PGP and still don't really understand this thread. Will somebody please explain, in layman's terms, what these large blocks of text are for?

PGP is public key cryptography. This means you give people your public key so they can use it to encrypt a message to you. Those big blocks are our public keys. You then use your secret key (which you keep secret from others) to decrypt the message. Since no one else has your secret key no one else can decrypt messages to you.

downwardsfromzero · Aug 22, 2021

○ · Oct 1, 2021

The efail vuln didn't/doesn't directly exploit pgp nor any of the encryption standards.

The primary vuln comes from how the victims email client makes use of the html tags [particularly the img tag] due to alterations that the attacker had made to one of the original [intercepted] [&&] [encrypted] emails prior to sending it to the victim. This proof of concept relies also on said attacker having a server endpoint to receive the request, once the malformed img tag w/ ciphertext is loaded on the victim/client, the deciphered plaintext then being visible in the request url.

And the [other] cbc gadget attack relies on the attacker needing/having previous [in part] plaintext, then continual appending cbc gadgets in order to be able to insert an img tag. Similar proof of concept as above, though this 2nd attack is more resistant to most email client standards.

Even so both of these style of attacks [as with most things in this field] need several things to line up prior to in order for any of this to even work. And even then in the wild, especially today, these sorts of attacks are very limited.

Claiming pgp is flawed is simply not true. It's how pgp's been/being implemented within the email clients themselves, so this falls on the developers as such ..not pgp.

** Just want to highlight that when i say 'pgp' I'm referring mainly to the openpgp standard. Apologies for the synonymous talk.

*** Also wanted to say that these scenarios are incredibly watered and simplified. The leverage of these sorts of attacks is very minimal && the requirements alone for this to succeed and be of any significant use is small.

some one · Oct 14, 2021

:thumb_up:

○ · Oct 17, 2021

The biggest issue relating to openpgp and the various email clients implementations of it at that time was that despite the mdc warning if the mdc was missing or malformed - the client apps were still allowing decryption of sent message, despite this built in warning from openpgp.

[ae/aead is of utmost importance]

openpgp-able'd email does have a couple primary issues [amongst lesser known issues]:
-no forward secrecy
-headers still in plaintext

though openpgp [in my view] is good for specific use case scenarios, imo it's good for ensuring the entire process through 'manual' [off-app] means [cmd line or gui tool then copy/pasting to an email app to send, then vice versa].

^^ [a very simplified overview]

** though an mdc isn't even necessarily needed if said sender/recipient just digitially sign their messages.

[though it never hurts to have both the mdc/check && and the message being digitially signed]

just dug up an old page I had saved from 18', a response [quoted] from gpg after all the efail jazz:

gpg team said:
In 1999 we realized OpenPGP's symmetric cipher mode (a variant of cipher
feedback) had a weakness: in some cases an attacker could modify text.
As Werner Koch, the founder of GnuPG, put it: "[Phil Zimmermann] and Jon
Callas asked me to attend the AES conference in Rome to discuss problems
with the CFB mode which were on the horizon. That discussion was in
March 1999 and PGP and GnuPG implemented a first version [of our
countermeasure] about a month later. According to GnuPG's NEWS file,
[our countermeasure] went live in Summer 2000."

The countermeasure Werner mentions is called a Modification Detection
Code, or MDC. It's been a standard part of GnuPG for almost eighteen
years. For almost all that time, any message which does not have an MDC
attached has caused GnuPG to throw up big, clear, and obvious warning
messages.

GnuPG also throws large warning messages if an MDC indicates a message
has been modified. In both cases, if your email client respects this
warning and does the right thing -- namely, not showing you the email --
then you are completely protected from the Efail attack, as it's just a
modern spin on something we started defending against almost twenty
years ago.

funnily enough we'd talked about this some months back over on ycomb/hckrnews, and seeing the previous posts in this thread i figured i'd respond

&& to quote my bud over there:

It is irresponsible to encourage at-risk people to use PGP-encrypted email. It's malpractice.

Keychain

benzyme

Moderator

benzyme

Moderator

MachienDome

Rising Star

○

Esteemed member

Nydex

Silicon-based Lifeform

Tony6Strings

Rising Star

Nydex

Silicon-based Lifeform

ducdevil

Rising Star

some one

Esteemed member

MachienDome

Rising Star

MachienDome

Rising Star

downwardsfromzero

Boundary condition

○

Esteemed member

some one

Esteemed member

○

Esteemed member