Re: PGP/MIME considered harmful for mobile

2011-02-26 Thread Jameson Rollins
On Sat, 26 Feb 2011 21:02:08 -0500, Avi avi.w...@gmail.com wrote: Why? Inline is simple and effective. I'm curious as to why you feel MIME is so much better. http://josefsson.org/inline-openpgp-considered-harmful.html jamie. pgpha2dSJArgJ.pgp Description: PGP signature

Re: PGP/MIME considered harmful for mobile

2011-02-24 Thread Jameson Rollins
On Thu, 24 Feb 2011 20:22:03 -0500, Robert J. Hansen r...@sixdemonbag.org wrote: Just as an FYI to the list -- On Android's mail application, PGP/MIME attachments are nigh-unusable. It won't render even the plaintext portions: it has to be downloaded and opened with a text reader. If

Re: moving user ID Comments to --expert mode

2011-02-04 Thread Jameson Rollins
On Fri, 4 Feb 2011 20:08:08 +, MFPA expires2...@ymail.com wrote: IMHO, the comment field is firmly in the you don't need this at all category. If Heinrich Heine really wants his UID to be Heinrich Heine (Der Dichter) heinri...@duesseldorf.de he can type Heinrich Heine (Der Dichter) in the

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Jameson Rollins
On Thu, 03 Feb 2011 17:10:58 -0500, Robert J. Hansen r...@sixdemonbag.org wrote: On 2/3/11 4:30 PM, Daniel Kahn Gillmor wrote: my user survey is from several years of trying to personally help dozens of people of all skill levels learn how to use OpenPGP for secure messaging. Regardless

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Jameson Rollins
On Thu, 03 Feb 2011 17:54:39 -0500, Robert J. Hansen r...@sixdemonbag.org wrote: But i suspect he would not want to certify this User ID: Daniel Kahn Gillmor (I am really Robert Hansen) d...@fifthhorseman.net Correct. Because the presence of my signature means something. The

Re: How to handle user passphrase input from python script

2011-01-30 Thread Jameson Rollins
On Mon, 31 Jan 2011 03:41:51 +0100, orionbe...@gmail.com wrote: I use a python script to (a) open a file encrypted with a symmetric cipher using a passphrase, (b) do some operations on it, and (c) re-encrypt it. You might try using one of the many python gpg interface libraries that exist

Re: What does the sub entry of a key mean?

2011-01-15 Thread Jameson Rollins
On Sat, 15 Jan 2011 19:17:27 +0100, Bo Berglund bo.bergl...@gmail.com wrote: THanks, indeed the --with-colons gave a completely different output... I was just about to ask of the date format (if it changes between operating systems or such) but now I have a different problem in understanding

Re: gpgkey2ssh

2010-10-21 Thread Jameson Rollins
On Thu, 21 Oct 2010 19:58:31 -0600, Aaron Toponce aaron.topo...@gmail.com wrote: So, help? Hi, Aaron. You might be interested in some of the tools that come with the Monkeysphere [0] package, which deals with a lot of OpenPGP for SSH stuff. It comes with the utility openpgp2ssh, which

Re: Confirmation for cached passphrases useful?

2010-10-15 Thread Jameson Rollins
On Fri, 15 Oct 2010 18:23:04 -0400, Robert J. Hansen r...@sixdemonbag.org wrote: I'm not. This idea isn't good. Do you use ssh-agent? Do you think their implementation of the same thing is not good? If so, have you complained to them about it, or asked why the implemented it? jamie.

Re: Confirmation for cached passphrases useful?

2010-10-15 Thread Jameson Rollins
On Sat, 16 Oct 2010 01:05:11 +0200, Hauke Laging mailinglis...@hauke-laging.de wrote: I just don't like the idea that access to the agent is not noticed by design. I strongly agree with this point. Let's think about it another way: what if the user is themselves doing something that is

Re: Confirmation for cached passphrases useful?

2010-10-15 Thread Jameson Rollins
On Fri, 15 Oct 2010 19:12:21 -0400, Robert J. Hansen r...@sixdemonbag.org wrote: Do you use ssh-agent? Do you think their implementation of the same thing is not good? If so, have you complained to them about it, or asked why the implemented it? This seems to be an argument from

Re: how slow are 4Kbit RSA keys? [was: Re: multiple keys vs multiple identities]

2010-09-27 Thread Jameson Rollins
On Mon, 27 Sep 2010 15:56:52 +0200, Vjaceslavs Klimovs vklim...@gmail.com wrote: I did some quick tests on Nokia N900 (600 MHz ARM CPU), with gnupg 1.4.6, here is what I got: Encrypting and signing, 2048 bit RSA keys: real0m 2.50s user 0m 0.50s sys 0m 0.02s Decrypting and

Re: how slow are 4Kbit RSA keys? [was: Re: multiple keys vs multiple identities]

2010-09-27 Thread Jameson Rollins
On Mon, 27 Sep 2010 16:28:07 +0200, Vjaceslavs Klimovs vklim...@gmail.com wrote: 2048 bit keys are suitable - it's user+sys what matters in this case, but not real by all means, as that includes waiting for passphrase input too. I think this is really a UI issue, in which case real is what

Re: how slow are 4Kbit RSA keys? [was: Re: multiple keys vs multiple identities]

2010-09-27 Thread Jameson Rollins
On Mon, 27 Sep 2010 21:25:21 +0200, Ludwig Hügelschäfer mlis...@hammernoch.net wrote: Ack. 1.5 seconds is about the limit where a good GUI should issue a reaction. This is where the human mind is starting to think there's something wrong. We should be careful not to overstate the impatience

Re: local signatures: should they be importable by default in some cases?

2010-06-22 Thread Jameson Rollins
On Tue, 22 Jun 2010 09:27:46 -0400, David Shaw ds...@jabberwocky.com wrote: On Jun 22, 2010, at 2:36 AM, Daniel Kahn Gillmor wrote: Can you elaborate on the usage you're describing? I'm thinking of a situation involving three people: Alice, Bob, and Charlie. Alice has met Bob in

Re: local signatures: should they be importable by default in some cases?

2010-06-22 Thread Jameson Rollins
On Tue, 22 Jun 2010 09:51:58 -0400, Jameson Rollins jroll...@finestructure.net wrote: I think the situation Daniel points out is one of the better usages for local signatures, and probably the main reason for having them in the first place. Actually, looking at the RFC 4880 now, I see

keyserver queries over TLS [was: Re: auto refresh-keys]

2010-06-20 Thread Jameson Rollins
On Sun, 20 Jun 2010 02:50:41 +0100, MFPA expires2...@ymail.com wrote: So in order to be safe you need additional CPU load either for TLS or for signing. Signing is superior IMHO because it allows reuse of the data (one crypto action (covering less data) for several users vs. one for each

Re: Test mail to gnupg.u...@seibercom.net

2010-06-11 Thread Jameson Rollins
On Fri, 11 Jun 2010 06:27:12 -0400, Jerry gnupg.u...@seibercom.net wrote: I am assuming that you wanted me to reply to this message. Its intended purpose was not overly clear. At least not to me, but then again I have not had my second cup of coffee this morning. I think if he had wanted you

Re: Keyserver spam example

2010-06-10 Thread Jameson Rollins
On Thu, 10 Jun 2010 11:32:05 -0400, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: And i should probably add that it is indeed an infinitesimal drop in the bucket compared to the other spam i receive; i'm not concerned about it. Not to mention that the bother of a couple of extra spams is

Re: Keyserver spam example

2010-06-10 Thread Jameson Rollins
Speaking of spam, I'm getting more spam from some sort of automated ticketing system that seems to be subscribed to this list that I ever have from a keyserver. The mail seems to come from: secure.mpcustomer.com and it often sets the From: to be from someone else. This is totally uncool. Is

Re: Crypto Stick released!

2010-06-03 Thread Jameson Rollins
On Thu, 03 Jun 2010 16:43:19 +0200, Crypto Stick cryptost...@privacyfoundation.de wrote: Each of the three keys can be up to 3072 bit. In fact they can even be 4096 bit long; but GnuPG does currently not support such key length in cooperation with the Crypto Stick (but GnuPG can handle 4096

RE: Migrating from PGP to GPG question

2010-02-25 Thread Jameson Rollins
On Wed, 24 Feb 2010 20:33:14 -0800, Smith, Cathy cathy.sm...@pnl.gov wrote: We are migrating from OpenPGP which is a freeware version of PGP. Sorry for the confusion. I'm not familiar with OpenPGP, the software. I'm familiar with the PGP Corporation's implementation (which I think is just

Re: Migrating from PGP to GPG question

2010-02-24 Thread Jameson Rollins
On Wed, 24 Feb 2010 18:46:33 -0800, Smith, Cathy cathy.sm...@pnl.gov wrote: We are starting to migrate from OpenPGP to GnuPG. Just for clarification, GnuPG is software tool that is actually an implementation of the OpenPGP specification [0]. OpenPGP is not actually a piece of software itself,

fragility of --edit-key interface [was: Re: Changing trust in GPGME]

2010-01-13 Thread Jameson Rollins
On Wed, Jan 13, 2010 at 10:39:28AM +0100, Werner Koch wrote: On Tue, 12 Jan 2010 23:41:52 +0100, Piotr Bratkowski wrote: I have this code. And when I see output owner_trust = 4, but in gpg from system I get 0. Do I need to somehow save this changes?? This is not directly supported by