Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Fri, 08 Mar 2019 22:00:20 +0100
schrieb Ralph Seichter :
 
> Seriously, it strains my patience if participants in a discussion fail
> to pay attention.

O.k. understood and sorry for that i only wanted to point
out the disadvantages of centralization etc. while there
are are proper and proven methods available.

Maybe someone can tell then the OP to use Google and
search for the string "anonymous message board" and
help him then with the required anonymous PGP posting
workflow.

eod

Regards
Stefan


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Multiple dev one signing key

[Phillip Susi]

On 3/8/2019 2:05 PM, john doe wrote:
> Hi,
> 
> I'm considering working  on a project that has only for now a couple of
> developers.
> As part of that project everything that will be released will need to be
> gpg signed.
> 
> What is the best way forward?
> - One signing key accessible on the release system
> - Eatch dev having a copy of the key to be able to sign a release
> - Other suggestions

Each dev just uses their own key to sign a release?



___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Ralph Seichter]

* Stefan Claas:

> Well, mail in a "forum" like a Usenet group is there a prefered delivery
> method, thanks to mail2news gateways. [...]

a) We're moving ever further off topic in terms of GnuPG.

b) Once again, the OP wrote about "an anonymous PGP messaging board". I
happen to have created and run messaging board software, also known as
bulletin board software, since the 1980s (e.g. FidoNet, Z-Netz), and I
don't see the necessity for using mail in a MBS/BBS at all.

c) the OP proposed a centralized approach and stated "The general
process of the server would be to receive a message via HTTPS".

Seriously, it strains my patience if participants in a discussion fail
to pay attention.

-Ralph

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Multiple dev one signing key

[Konstantin Ryabitsev]

On Fri, Mar 08, 2019 at 08:05:53PM +0100, john doe wrote:

Hi,

I'm considering working  on a project that has only for now a couple of
developers.
As part of that project everything that will be released will need to be
gpg signed.

What is the best way forward?
- One signing key accessible on the release system
- Each dev having a copy of the key to be able to sign a release
- Other suggestions


From the perspective of kernel.org, we've tried very hard not to have 
signing keys residing on any kind of centrally managed infrastructure.  
The general rule is that we place trust into developers, not into 
infrastructure or systems admins.


Therefore, all tags and tarball releases are signed by developers 
themselves, using their own PGP keys, and those keys are signed by the 
lead developer (i.e. everyone signing tags on kernel.org can trace their 
key via the web of trust to Linus Torvalds). So, if anyone wants to 
verify a tag or a tarball sig, they can trace that developer's key to 
Linus. I'm willing to bet that this happens extremely rarely, if ever -- 
most people just use "Trust On First Use."


If, for some reason, you can't use this approach and all your releases 
must be signed by the same key, a solution I can suggest is having a 
single Certify ("master") key with multiple Signing subkeys. Each 
developer is given their own Signing subkey, but not the master key.  
The master private key is kept offline with the passphrase split between 
multiple members of the project using something like Shamir's Secret 
Sharing. When someone new joins the team, a new Signing subkey is 
created and given to them, and if someone leaves, then their subkey is 
revoked.


There are downsides to this approach -- for example, everyone would need 
to remember to refresh the pubkey regularly in order to get information 
about new and revoked signing subkeys. If they don't do that, the 
signatures would fail to verify due to "unknown key" error -- so if your 
intended target for these signatures if the public at large, then you 
are likely to have a lot of confusion about what is going on.


Anyway, I don't recommend having central infrastructure storing private 
keys -- unless you invest a lot of effort into setting that up properly, 
that's going to be a very interesting target for attackers to get into.


Best,
-K



signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: user id question

[john doe]

On 3/8/2019 9:15 AM, Werner Koch wrote:
> On Sun, 24 Feb 2019 10:09, johndoe65...@mail.com said:
>
>> What I understand is that there is no clear convention.
>

'Consensus' and not 'convention'! :)

> Meanwhile I would suggest to only use the mail address, that is
>
>   j...@example.org
>
> and leave out all other parts.  There are even mail providers which
> demand this for data privacy reasons.  However if you prefer to have
> your mail in it, do it in the same was as it is common in your
> country/culture like
>
>   John Doe 
>
> If you plan to take part in that nerdy key signing game, some
> participants have the policy to check the real name agains a passport;
> obviously you would need the latter form then.
>
> I used to include my real name in my keys but for my new ed25519 key I
> use only the mail addresses (I use 3 different mail addresses in my
> keys).
>

Thank you Werner for your answer.
If the former is acceptable to you, I might as well do that.

Looks like your are not keen on key signing party, may I ask why?

--
John Doe

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Multiple dev one signing key

[john doe]

Hi,

I'm considering working  on a project that has only for now a couple of
developers.
As part of that project everything that will be released will need to be
gpg signed.

What is the best way forward?
- One signing key accessible on the release system
- Eatch dev having a copy of the key to be able to sign a release
- Other suggestions

In other words: What is, if any, the best way to sign a file, when the
same key is to be used by multiple persons.

Any help is appriciated.

--
John Doe

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Thu, 07 Mar 2019 16:01:05 +0100
schrieb Ralph Seichter :

> * Aleksandar Lazic:

> > I think the mixmaster approach should be still in place also when
> > you use Tor, IMHO.  
> 
> I wrote "using the Tor Network as a foundation", but in this case it
> might actually be enough. The OP presented his idea for "an anonymous
> PGP messaging board", and such a messaging board could in all
> likelihood be accessed using only the Tor Browser (I don't see a
> reason for mail in a forum application). Providing this as an onion
> service would of course also be an option.

Well, mail in a "forum" like a Usenet group is there a prefered delivery
method, thanks to mail2news gateways. Also if you host a centralized
message board on a web server it can be easily taken down, regardless
if .onion site or not. In the past many .onion sites have been shut
down. With decentralised Usenet groups or Bitmessage chans you don't
have these problems.

Regards
Stefan


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Default trust-model TOFU

[Teemu Likonen]

Werner Koch [2019-03-08 09:15:43+01] wrote:

> If you plan to take part in that nerdy key signing game, [...]

Maybe you refer only to key signing parties as nerdy things but I think
the whole social web of trust concept is very nerdy. It's useless for
most people and I'd say that TOFU model would be better default. Do you
have plans for that, to set the default trust model to "tofu" or
"tofu+pgp"?

-- 
/// Teemu Likonen   - .-..    //
// PGP: 4E10 55DC 84E9 DFF6 13D7 8557 719D 69D3 2453 9450 ///


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: user id question

[Werner Koch]

On Sun, 24 Feb 2019 10:09, johndoe65...@mail.com said:

> What I understand is that there is no clear convention.

Meanwhile I would suggest to only use the mail address, that is

  j...@example.org

and leave out all other parts.  There are even mail providers which
demand this for data privacy reasons.  However if you prefer to have
your mail in it, do it in the same was as it is common in your
country/culture like

  John Doe 

If you plan to take part in that nerdy key signing game, some
participants have the policy to check the real name agains a passport;
obviously you would need the latter form then.

I used to include my real name in my keys but for my new ed25519 key I
use only the mail addresses (I use 3 different mail addresses in my
keys).


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: OPENPGPKEY on DANE

[Werner Koch]

On Wed,  6 Mar 2019 21:58, gnupg-users@gnupg.org said:

> 2019-03-06 21:25:50 dirmngr[2855.6] DBG: chan_6 -> OK Dirmngr 2.2.4 at
> your service

Between 2.2.4 and 2.2.10 we fixed a couple of bugs in the DNS resolver.
This should explain why it works on macOS, where you use 2.2.10.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users