Posts

Showing posts with the label cryptography

Stateless password keychains

There are several solutions to saving you from the hassle of having to remember a multitude of passwords. One common way is to install a password manager . These store your randomly generated or manually created passwords in an encrypted manner. You need to devise a method to synchronize these passwords between your devices. A different approach to this problem is to generate all your passwords in a deterministic manner on the fly without saving any state. This spares you from the pains of synchronization and potentially losing all your passwords in case your vault gets damaged. Here are a few of these: https://github.com/waldyrious/hash-my-pass/ http://plevyak.com/dpg.html https://passwordmaker.org/ (old site: http://passwordmaker.sourceforge.net/ ) http://angel.net/~nic/passwd.sha1.html Of course, both methods require using a really strong master password that you can learn by heart.  My personal recommendation is to use at least two separate vaults with diffe...

How to make wise use of public key cryptography

The correct usage of GnuPG (public key cryptography) is to offer a download link of your public key in every channel you communicate and also include your full fingerprint on your business card. It doesn't make sense in this combination to distribute either your key ID or your fingerprints electronically, because it opens up all kinds of bad practices involving trusting the unverified and confusion. Key servers and the web of trust itself erodes your privacy as your social relationships are publicly revealed, and your e-mail address is also opened up for easy spamming. However, a key server does make initial contact easier if you forgot to provide a link on the business card and it also enables key updates if you do use the web of trust by mutual key signing. No single solution is perfect for everybody. Note that both the PGP protocol and GnuPG internally reference a so-called 64-bit long key ID, however many tutorials erroneously use only the short key ID instead. Also note t...

Public key

I have the fingerprint with me on paper slips if you'd like to verify any time. I also have a downloadable version . -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.11 (GNU/Linux) mQENBFP4fKsBCADSCOuM1/Dtd9f52Pp0ZYVmjB4KkXisVpw5Qq3rEdXisC+xtreZ jwp0FKZnYnAudTFXHE1ZLFbFgO7A05d1N+JHJIz0ZRcYfG3mS2NO+J1yHBMZsq+n Z5HI+ZNpw3vONIVBBJM11e4hRNQ37HLOA78lUGgpf32J50BbAQ+xnncs1hr/4hvS v0EJDShbHZvBSQCxu73r7IE68ASZeTdnHKobhdWTOVza1xE6dOj/3EnB8pL2Ekno eckjOq2TxoUQCFKQjczw5cklqZjwjWHxSGgNZD71YSj/FXgd6twSDgyMfEg4Hs57 PPRfDdUcG9nsna5xDugm9/aXIejm0W9y8sINABEBAAG0O1Rob21hcyBOYWd5IChl bWFpbCBzaGExOiBhMzY3Zjc0MzU3MzVjNTA3NDdiMDAyNjU1MWJhZGYzYTIpiQE4 BBMBAgAiBQJT+HyrAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRDy2MPO 03KDbXvACACR9dvQHt6SFJd7qE/uBO24hWYh56CBHRHWpIfT5/V1n0mdNNq8pf4/ KcqISQXQK+t3EijwUWgDVfkiy+eUq9yjCCSePsmg7t6nxZEyisikf6f1atZjA6fH S/+QvqPCG9CS9bIMdEpBrt2vehfY/vTEPOvIVWV0J0IhzxI6BzaTbWansmroRZpl WIyGnFkKdqr4tatcUSDNveA+LSW1k1Psi5AyZJ3oe2nNPBbVv+5FOGCpNE2UvVBs 5Zv0vNwMYdMt7Gc74uVSxDt...

New e-mail anti-spoofing protocol built on SPF

I've always wondered what best practices should be applied when handling DKIM mail, and started considering manual verification and domain based whitelisting. I welcome the draft that is emerging to offer a standard framework for just these questions. News entry: new anti-spoofing protocol built on SPF - DMARC