Re: GPG on Android

2018-11-05 Thread Wiktor Kwapisiewicz via Gnupg-users
On 03.11.2018 19:13, Juergen BRUCKNER wrote: > Hello Masha, > (...) > You need to install the additional Flipdog CryptoPlugin[3] on your > device, where you import and manage the keys. > You have to create the keys for example on a desktop computer and import > it to your android device and into

Re: GPG on Android

2018-11-05 Thread Wiktor Kwapisiewicz via Gnupg-users
On 04.11.2018 22:55, Roland wrote: > Hello list, > > I share the wish for encrypted email on Android, but I am afraid of > storing a secret key on my android phone. (theft, hacking, loss, etc) > > How do you feel about that? > > Could a pincard be connected via micro USB? And made to work?

Re: GPG on Android

2018-11-05 Thread Juergen Bruckner
Hi Werner I know its not the perfect setup, but it is practicable for me, and as i usually just work with subkeys i feel on a more safe side with this. Tokens are always a good idea, and if anyone can use them its recommended to do it that way. There are good reasons why GPG supports

Re: [openssl-users] OpenSSL vs GPG for encrypting files? Security best practices?

2018-11-05 Thread open...@foocrypt.net
Hi Nick Have You tried The FooKey Method ? https://foocrypt.net/the-fookey-method Also, I will be sourcing public addendum's as addendum's to my submission into the Parliamentary Joint Committee on Intelligence and Security [

Re: GPG on Android

2018-11-05 Thread Werner Koch
On Sun, 4 Nov 2018 23:20, juer...@bruckner.tk said: > I for myself did configure MailDroid that way, that for each > crypto-operation, decrypt, sign, encrypt I have to enter my passwort > each time. That does not help. A bugged phone will for sure employ a keylogger and thus you can also work

[admin] Re: OpenSSL vs GPG for encrypting files? Security best practices?

2018-11-05 Thread Werner Koch
Hi! Please do not post commercial advertisements to a gnupg mailing list. There is no problem to _mention_ proprietary software on the GnuPG lists if that mentioning is related to technical questions. But sales pitch or ads are unwanted. Thanks, Werner ps. I removed the openssl list from

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Damien Goutte-Gattat via Gnupg-users
Hi, On Mon, Nov 05, 2018 at 05:13:41PM +0100, Juergen Bruckner wrote: > I just tried to register with a key who has several user-ID's > (e-mail-adresses) and I always got the error that the user-ID is not the > same as in log-in/registered e-mail. From what they say on the home page [1] this is

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Viktor
On 05/11/2018 18:13, Juergen Bruckner wrote: I just tried to register with a key who has several user-ID's (e-mail-adresses) and I always got the error that the user-ID is not the same as in log-in/registered e-mail. We use the rule, that userID should contain user's fist and last name

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Wiktor Kwapisiewicz via Gnupg-users
On 05.11.2018 15:21, Viktor wrote: > Dear All, > > (...) > > I would be very interested to hear feedback, criticism and suggestions > on our project. And also to establish contacts with people interested in > cooperation. Looks interesting. But the language on the registration dialog [0] seems a

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Juergen Bruckner
Hello All! I just tried to register with a key who has several user-ID's (e-mail-adresses) and I always got the error that the user-ID is not the same as in log-in/registered e-mail. And yes to see the list of Notaries before registration would be very good. regards Juergen Am 05.11.18 um

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Juergen Bruckner
Hello all, there is a lot of hassle about using Gmail, but this is not really the topic here. If I want an "independent" ID verification on my GPG key, I can also use CAcert. There the signing of GPG keys is offered for a long time. best regards Juergen Am 05.11.18 um 18:03 schrieb Damien

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Viktor
On 05/11/2018 18:01, Wiktor Kwapisiewicz wrote: user personal data provided for key verification stored for forever and can not be deleted or removed by user's request. Yes, that's the point. If my counterparty had signed some contract or document, he/she should not be able to delete

OpenPGP key verification + legal framework

2018-11-05 Thread Viktor
Dear All, we create a service for OpenPGP key verification: https://cryptonomica.net It's open sourced https://github.com/Cryptonomica/cryptonomica and it has legal part ( see: https://github.com/Cryptonomica/cryptonomica/wiki/Cryptonomica-White-Paper ) aimed at creating an international

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Viktor
On 05/11/2018 21:12, Juergen Bruckner wrote: If I want an "independent" ID verification on my GPG key, I can also use CAcert. There the signing of GPG keys is offered for a long time. Signing is easy. The difficult part is 1) to create a system in which you can prove that the key really

Re: OpenPGP key verification + legal framework

2018-11-05 Thread vedaal via Gnupg-users
On 11/5/2018 at 3:39 PM, "Viktor" wrote: >You can register a Google account with any email address. Simply, >instead of creating an account on our service (another password >that >needs to be saved), you create an account on Google, or use an >existing one. = Ok, But suppose I want to

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Viktor
On 05/11/2018 19:03, Damien Goutte-Gattat via Gnupg-users wrote: From what they say on the home page [1] this is expected: your key is supposed to have only one user ID whose email component must match the email address of your Google account... ... which, by the way, is a big "no" for me.

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Damien Goutte-Gattat via Gnupg-users
On Mon, Nov 05, 2018 at 09:30:48PM +0200, Viktor wrote: > Because of Google or because of "only one user ID" ? Both, even though the requirement of using only one user ID would be more acceptable if the address did not have to be associated with a Google account. Damien signature.asc

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Wiktor Kwapisiewicz via Gnupg-users
On 05.11.2018 21:37, Viktor wrote: >> Sending an encrypted e-mail additionally verifies that the user controls >> the key in question. > > But you can easily send email with any address in 'from' field. > It does not mean you really control this email address. Maybe there is a small

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Viktor
On 05/11/2018 21:50, Wiktor Kwapisiewicz wrote: Have you considered an alternative approach to email verification? For example just sending an e-mail (probably encrypted) with a one-time verification link? Yes, we considered this option. But we can not be sure that user uses secure email

Re: OpenPGP key verification + legal framework

2018-11-05 Thread Wiktor Kwapisiewicz via Gnupg-users
On 05.11.2018 20:28, Viktor wrote: > > We use the rule, that userID should contain user's fist and last name > exactly as in passport, and only one email - the same as used for login. > So we can verify it's really your email. Have you considered an alternative approach to email verification?

Re: OpenPGP key verification + legal framework

2018-11-05 Thread NdK
On 05/11/18 17:56, Viktor wrote: > If my counterparty had signed some contract or document, he/she should > not be able to delete his/her public key certificate and data used for > its verification. IMVHO You're just (badly) reinventing X509. > This is exactly the part that is difficult to

encrypt linux backup folder using gpg

2018-11-05 Thread Kaushal Shriyan
Hi, I am using CentOS 7.5 Linux OS in my setup. I have compressed a folder using tar utility tar czvf backupfolder.tar.gz backupfolder. Is there a way to encrypt backupfolder.tar.gz using gpg? Are there any best practices to use gpg application to encrypt the data. Any help will be highly