Public Address | Cafe | OnPoint: Ich bin ein Cyberpunk

Ian Dalziel

Sat, 07 Sep 2013 07:41:03 +1200

Chipping away...
the Stuxnet worm...
...and Flame and DuQu and other spy/mal-ware...
...one wonders just how far those have spread, since being released into the wild by their indolent and arrogant creators?

Matthew Poole

Fri, 06 Sep 2013 20:01:45 +1200

The classic way of social engineering a worm into a secured environment is to drop an infected USB key or few in the parking lot of the target organisation. Infect a computer that's inside the border protections and then let the worm do its thing. Getting information out is a…

Matthew Poole

Fri, 06 Sep 2013 19:51:11 +1200

SELinux is open source. That means that many eyes outside the NSA will have inspected it to see if there are any holes.

Particularly since the NSA is not widely trusted by the Linux development community. That SELinux was an NSA project is just a guarantee that it has been…

Stephen R

Fri, 06 Sep 2013 16:51:44 +1200

The only really secure way to do this would appear to be to physically copy emails to some kind of storage media...and decrypt them on a second system that isn't EVER connected to any network of any kind.

As someone pointed out to me today, the Stuxnet worm that was…

Rich of Observationz

Fri, 06 Sep 2013 16:45:36 +1200

SELinux is open source. That means that many eyes outside the NSA will have inspected it to see if there are any holes. And given that what it does (annoy people trying to admin a system, mostly) is fairly obvious, that should be quite straightforward.

OTOH, if what you mean…

Steve Withers

Fri, 06 Sep 2013 16:35:52 +1200

I just saw this. If the NSA have ensured there are weaknesses in encryption specs / standards, how useful is PGP encryption?

Also.... "SELinux" came from the NSA. Everything based on it can only be hopelessly compromised.

http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?nl=us&emc=edit_cn_20130905

Steve Withers

Fri, 06 Sep 2013 16:16:49 +1200

BenWilson

Tue, 27 Aug 2013 17:46:22 +1200

The counterbalancing force is that it becomes harder and harder to maintain a deception, the more people who are involved. It's extremely unlikely that Trojans would go unnoticed by every single person involved all the way down a chain of manufacture, starting in hardware. Something hiding in a compiler is…

Matthew Poole

Tue, 27 Aug 2013 10:00:31 +1200

I'm told (reliably) that there's a Cisco factory in Mexico which exists for the sole purpose of allowing people who know the correct item code to order network hardware which has been manufactured right from the silicon level in premises that are acceptable to the most paranoid arms of the…

Rich of Observationz

Mon, 26 Aug 2013 17:17:51 +1200

At least as recently as the early 90s the (UK) military was loathe to deploy any kind of OS (which in those days was usually VMS), at least on things that were meant to fly or go bang. They liked to be able to examine each byte of the code…

Stephen Judd

Mon, 26 Aug 2013 16:34:11 +1200

Every level.

BenWilson

Mon, 26 Aug 2013 16:02:59 +1200

Yes, every level. Considering most hardware is built by software nowadays, you can't draw the line at hardware, even. It could have Trojans built into it. And that's even harder to detect than bugs in code. But there's a blurring line here with the entire Cartesian method of doubt. You…

Matthew Poole

Mon, 26 Aug 2013 14:25:46 +1200

Couldn't follow the code (I'm not a programmer) but the explanation is pretty clear. Certainly a good lesson, and interesting that the USAF was talking publicly in 1974 about the risk posed by not having total control of every level of the software build stack.

Rich of Observationz

Mon, 26 Aug 2013 09:17:28 +1200

Have a classic paper on that subject.

nzlemming

Mon, 26 Aug 2013 06:43:12 +1200

Provided you assembled the compiler from scratch and verified the source code of the tools you’re using the build the keys, of course :P

Before or after you change your name to Richard Stallman? ;-)

Keith Ng

Sun, 25 Aug 2013 17:27:07 +1200

umm, not really. It means the request has a classification level of Secret, that its subject relates to communications intelligence (you got that bit right), and that it may be released to the members of Five Eyes.

My "it means that.." statement was supposed to be a summary of the…

Paul Campbell

Sun, 25 Aug 2013 12:35:28 +1200

Well yes – bear in mind that I'm not saying that MS does this, just we know that they've already done stuff for the NSA and that the NSA can happily make them do it should they want to and we'd probably never know – because those "security updates" make…

Matthew Poole

Sun, 25 Aug 2013 11:56:49 +1200

Not your general conspiracy theory, thanks very much. Never been a big fan of the whole "The NSA pwns Windows" crap, but there are some pretty serious issues with the way that MS is using UEFI to lock users out of their own computers.

Paul Campbell

Sun, 25 Aug 2013 11:41:18 +1200

yes remember we know that Microsoft has done deals with the NSA, they're compromised, and every Tuesday(well Wed here) they roll patches into your windows system, they can send you the generic NSA/GCSB backdoor, or target you with a specific one tailored just for you ....

And of course the…

Matthew Poole

Sun, 25 Aug 2013 11:15:54 +1200

The biggest advantage of rolling your own keypair is KNOWING that there was no compromise in the process, IMHO.

Provided you assembled the compiler from scratch and verified the source code of the tools you're using the build the keys, of course :P

You're right, though, that the only way…

Brian Murphy

Sun, 25 Aug 2013 09:18:35 +1200

http://www.theregister.co.uk/2013/08/22/guardian_snowden_advice

The register has some sage and tongue in cheek, but true, information here.

nzlemming

Sat, 24 Aug 2013 22:22:34 +1200

You need a third-party-signed certificate, but there are free providers

And you know these haven't been compromised because...?

The biggest advantage of rolling your own keypair is KNOWING that there was no compromise in the process, IMHO.

Matthew Poole

Sat, 24 Aug 2013 18:14:15 +1200

Get a client that supports OTR (Off The Record), on the Mac that’s Adium. So long as you’ve clicked the “generate key” and both people have OTR installed, messages are encrypted.

But it’s only worthwhile if you take the key verification seriously, because if you don’t you could be getting…

Moz

Sat, 24 Aug 2013 18:03:04 +1200

TrueCrypt how much random seed is enough?
It doesn’t take much initial randomness to escalate into massive entropy after they start cycling the hashes.

Thanks. That's handy because I fairly regularly find myself regenerating keys for TB+ drives, and aside from going "gosh, that's a lot of bits", I've never…

Matthew Poole

Sat, 24 Aug 2013 18:02:42 +1200

Key distribution, that’s the hard part. Ensuring that you have the public keys of everyone you want to contact and that these haven’t been tampered with.

It’s a hard problem, partly because of the risk of the man-in-the-middle attack (where somebody intercepts your traffic, substitutes the key and encrypts/recrypts your…

Matthew Poole

Sat, 24 Aug 2013 17:23:55 +1200

“SECRET//COMINT//REL TO NZL, AUS, CAN, GBR, USA”. In other words, the selectors were entered into a secret communications intelligence system, and this secret system was considered related to Five Eyes:

umm, not really. It means the request has a classification level of Secret, that its subject relates to communications intelligence…

william blake

Sat, 24 Aug 2013 16:52:39 +1200

if you encrypt you MUST be guilty....therefore METADATA.

Andrew C

Sat, 24 Aug 2013 15:23:09 +1200

Also, I wish TrueCrypt gave some indication of how much random seed is enough… if I watch a half hour TV episode while jiggling the mouse is that much better than a 30 second scribble? How much? Does it matter? Who knows?

No, it itsn't greatly better Moz. It doesn't…

Keith Ng

Sat, 24 Aug 2013 13:10:39 +1200

BEGIN PGP MESSAGE

HenryB: Got it! And thanks!

Kumara Republic

Sat, 24 Aug 2013 11:07:54 +1200

For browsing, the Tor Network is a good start, even if it means a slight speed penalty.

Ian Dalziel

Sat, 24 Aug 2013 09:15:17 +1200

living in the Tron...
“GCSB doesn’t even operate their own spy cloud.
... it's a bit sad that,
of all countries,
Aotearoa has no
intelligence cloud
to call its own...

Martin Lindberg

Sat, 24 Aug 2013 08:44:38 +1200

Cool Keith front page of /.

Now also front page of Ars Technica: New Zealand appears to have used NSA spy network to target Kim Dotcom.

BenWilson

Fri, 23 Aug 2013 21:26:03 +1200

Recently we’ve all learned that the old maxim “you’re not paranoid if they really are out to get you” applies to being worried about secret police reading all your online communications too

Isn't the saying "Just because you are paranoid doesn't mean they are not out to get you"?

Cameron Junge

Fri, 23 Aug 2013 21:23:24 +1200

For those mentioning Little Brother, the main point (that I got) of the book is that if the watchers are looking at you (ie. they're Big Brother) then the response is to look at them (ie. become Little Brother) . Encryption does not stop "them" spying on you, or abusing…

Moz

Fri, 23 Aug 2013 19:26:00 +1200

At least a couple of people have gone to gaol over that clause.

I half expect to go the same way. Not because I'm unusually prone to breaking the law, or doing anything particularly dodgy (I ride a push bike, so I'm not exactly mainstream), but because I have no…

HenryB

Fri, 23 Aug 2013 17:10:06 +1200

BEGIN PGP MESSAGE

Version: GnuPG v1.4.12 (MingW32)

hQEMA4M1NX6HbamyAQgAt9GgDIEMzUtLgD/u/7yM7QWLJoRIzSBpfFaRY8eaLxcp
F0dDUK6WYHMglrEW6qQr7u2LymFxWQdSHrlyIItwtgj2TqrsxXEYOBBCtZz2lGgq
/R84A5TZS3RkI4CGLaVshEoDcEuX95CEn3g0p1hJAkr4ibn6ZtH3z1KIwZZEaStB
fR7+Q98T5dAEppFP5TN4dMqbEC2W/TuM1w4oQTBd60kZIfvLaX0XmOM8T/ELaCgS
KErNJL5dxFdfSSUX04rmoH/oUFyZPnsS/OGB4hkZ238WMScSe043tuRfX0tAxQiX
3ls0XLqZQPGXq78kgiKYOrubLjUiX5ZPvtaVc3wtJYUBDAM51OvWrWXIjgEIAKUg
pB5YsjkwD08fMlEfUL2G3pKmCsWwhHS3VJYDgb/XL3xmHBR13arDi3mEVEOKekVh
emLE0NTbdWZ79+8u8rs9KO/tFwnwGspUSp+p+FxjIHqRwmflhApo19ZBK9nix9dF
1/2J96PaYAnLy25XgkLr6yncpc6F0zPdSHFHTx4JOGX+Q7lxLsNv94b0BxgcKX8I
2SDxpqV926HUKKxXb///ua5wOC76KZDSBEayji4GpHghkXjpQhG7LchiIqZpBC8+
Km/AicuO7l+htxM9hYnwwy7iNQdoiFXBfpnLhrkGGQHEEN/SFQo5YYEREXXvl0FO
OciyulidWqvDhU9h6z7S6QF5jGnEFinp+UFPa9vqR7da4uNJXbDzgPrY4+nYcJXh
9cBuVIE3Y/VSp5LXotlwsn0czalXJosclGLj0YpnysSZtZN8uYmB7lLyBgN4JtvW
p+6cTchOqtlb0lCvmGZwVy6pLmOxLcQXnYBxfATxNoc00UGQoUhGY/JD5yh0b/Xn
8wPnvceRpxQyUnAWadKAKivtWU+QzTcjkIzQOpfnI3ykVNfjIGB4IdEmnYT08vba
wwROS3lWUkBHHp08vC8DwZ5QdCk2xfRfFdqKRWQAl5tHKuPQ1NbL0T+uTTJsHiWN
sBq2kctBuyiMOPhHUnqRdt6l99STXj2I5rhjByGQmlHt0wk/47o1TeN4DRa2z3Nf
Rbfpx5n8Sz13efGHN+K8VbTWehdZv55G5xv1ppQWTmkZwNA56NmDc4iXwXzS8lt3
2a51bf03W4guUYM0zOZ1+fjEZCEId7ijmGbPlqSGOyA21qhmBzbtUR2U0wcOulmz
7Ri49XwKTu4H02qKleqrNTB/PSMx6uK5KX17bAy48eAt2agaGHlnSDtrkf92KEj9
j4RpzEvvnZt+R9ePrRxQySZsvAfnFXugGwE0h3Kci6qU3kTaCL0T3bHJg0wr+c+i
lvD72KvK/pE2AMBMt4GCJhWBoDQFhg2PYxUdc00yZ9bl2V1zJetLZZilCEFaiBi5
e3D0q5a/1vj9xTBXRPvaxhvdO0dMS9a5kereKqh3kwUZWG6hn1dNLz2PfjRHkhCB
7/r/fYP76yOo4LXi3GZlj36umjmlyDHWGr00JsXK4MA32gNm3T+M5rOt169QHVNZ
a4w6nwZhM/1f4tCzh/SYJfcuGQRD5hgU7vtDbg==
=Ozim

END PGP MESSAGE

Stephen R

Fri, 23 Aug 2013 17:04:37 +1200

In NZ, it's give up your password, or face 3 months in jail.

In the UK it's worse. From Wikipedia's article on the RIP act

Especially contentious was Part III of the Act, which requires persons to supply decrypted information (which had been previously encrypted by the owner) and/or the…

Paul Campbell

Fri, 23 Aug 2013 16:56:25 +1200

Cool Keith front page of /.

Discussion of the effectiveness of various forms of cryptography is fraught, it's not to be done by amateurs, and most of the professionals seem to work for 3-letter agencies, don't forget that the NSA helped set up TOR and have blessed various forms of…

Keith Ng

Fri, 23 Aug 2013 16:53:05 +1200

Second Little Brother. I'm wondering if I need to have a key-signing party sometime.

YES. I'll work something out for my next post.

Keith Ng

Fri, 23 Aug 2013 16:48:50 +1200

Not that I do this, but I just thought it was kinda cool. These guys have thought stuff through.

Oh yeah. That's precisely why I'm going to go through Truecrypt. This is from the Police Search Manual:

A specified person may not be required to give any information tending to…

Andrew C

Fri, 23 Aug 2013 15:03:54 +1200

General comment: Baby steps, folks. Tor, Truecrypt, everything else will come.

I like how Truecrypt pads out empty space with random noise. If you create a Truecrypt partition and fill it with your sooper dooper secritz, you can then include this partition inside/within another Truecrypt partition. This way if you…

Ianmac

Fri, 23 Aug 2013 13:49:07 +1200

Wasn't Kim Dotcom's new cloud based on encryption? Be ideal if you wanted to store stuff then retrieve it to yourself.

Zen

Fri, 23 Aug 2013 13:43:53 +1200

NSA spread digital AIDS to the Cloud.
http://youtu.be/3aJN4hjhALY
What encryption options would you recommend there?

Amanda Wreckonwith

Fri, 23 Aug 2013 13:26:14 +1200

I understand that.
But in my dystopia, La Collins was incarcerating merely for act of employing encryption...
'no smoke without fire' seems to be quite a popular conjecture from what I am hearing on my rounds

Idiot Savant

Fri, 23 Aug 2013 13:14:19 +1200

(Emphasis mine) That's one of the ones that concerns me a lot, among others. Possibly also corresponding with unknown agitators, and corresponding with people who correspond with agitators.

The NSA was leaked as using three hops. So if you talk to someone who talked to someone who talked to a…

izogi

Fri, 23 Aug 2013 13:10:12 +1200

it's just that nobody cares enough to do it provided I don't stick obvious keywords in there, or correspond with known agitators, or have offline activities that might draw attention

(Emphasis mine) That's one of the ones that concerns me a lot, among others. Possibly also corresponding with unknown agitators,…

Rich of Observationz

Fri, 23 Aug 2013 12:55:08 +1200

If you have keys in multiple places, then any man-in-the-middle or other hacking attempt becomes obvious, and is likely to reveal more about the attacker and their methodology than they would like.

(For this reason, I'd regard M웃M intereption of SSL traffic by government agencies as unlikely, even if they…

Idiot Savant

Fri, 23 Aug 2013 12:41:13 +1200

Second Little Brother. I'm wondering if I need to have a key-signing party sometime.

Re: Key fingerprints, you're right. The problem is that I'm currently managing multiple key pairs for different accounts. But I've stuck it on my Twitter profile, I'll stick it on my filedump website to increase the…

Idiot Savant

Fri, 23 Aug 2013 12:27:48 +1200

Smiling, she raises her fist and the crowd erupts into chants of the Presidents Official Campaign Slogan – GIVE US THE KEY OR YOU'RE NOT FREE!!

That's already the law. See s130 and s178 Search & Surveillance Act 2012.

Amanda Wreckonwith

Fri, 23 Aug 2013 11:57:55 +1200

And it started out so hopeful...
The more I read from you boffins, the more it seems to me that the solution to this problem is political rather than technical.

How about a Green/Labour promise to release the details (on request) of all the NZ people that have had their…

David Hood

Fri, 23 Aug 2013 11:46:38 +1200

a) I don’t think this is true yet

My impression is that, at the moment, intelligence agencies are more likely to take an interest in you if you are using encryption (because it is seen as suspicious) but can't read the contents (so will be concentrating on who you send…

Stephen R

Fri, 23 Aug 2013 11:28:44 +1200

Fair cop guv.

Keith Ng

Fri, 23 Aug 2013 11:27:03 +1200

General comment: Baby steps, folks. Tor, Truecrypt, everything else will come.

Stephen R

Fri, 23 Aug 2013 11:25:08 +1200

Maybe this is a silly question, but given that I understand encryption that can't be cracked by governments isn't supposed to be publicly available (limit to number of keys) – isn't there a risk with encryption that using it attracts attention in and of itself, and that with small volumes…

Keith Ng

Fri, 23 Aug 2013 11:10:55 +1200

I guess the first part of the article nicely disposes of ex-GCSB head Bruce Ferguson's claim that the GCSB only provided assistance to Police by seconding staff to them.

Hang on though – this was not quite the same, in that they believed (genuinely or not) that Kim Dotcom was…

Keith Ng

Fri, 23 Aug 2013 11:08:42 +1200

Ian Dalziel

Fri, 23 Aug 2013 10:25:19 +1200

“Little Brother” by Cory Doctorow
and available as a free download from Cory 'boing boing' Doctorow at Craphound

...and while you're there, grab Makers as well for a FAB read...

Cory actually knows a bit about this stuff too, so it’s probably worth reading...
...even Google listens...

B Jones

Fri, 23 Aug 2013 10:21:19 +1200

Chatham Island State Prison

Because that worked so well last time.

Stephen R

Fri, 23 Aug 2013 10:16:46 +1200

The two reasons I gave up bothering with PGP ten years ago was
a) The number of people I wanted to exchange email with who had a public key and could remember their passphrase was practically nil
b) Wanting to access mail from multiple locations/devices makes private key management (especially…

Ian Dalziel

Fri, 23 Aug 2013 10:15:42 +1200

Curds awhey...
Got some Gorgonzola.
Bit scared to try…
...point taken, I can see the shattered
Redcoated carapace giving way to
those Blue Green veins!
(such a redolently political palette)

Maybe you could ease on in with Bries
or some other French cheeses on the cross
from The Netherlands to…

Stephen R

Fri, 23 Aug 2013 10:12:35 +1200

It would also be great to see some information on anonymous browsing via Tor (this is now fairly easy to set up – I posted this via Tor) and darknets such as I2P if you have the time or inclination.

I've read suggestions that some Tor gateways might already be…

AndrewH

Fri, 23 Aug 2013 10:11:39 +1200

This looks like a promising adjunct product for encryption further down the tcp stack: http://tcpcrypt.org/index.php

I shied at the package compilation hurdle, but perhaps Keith with his doctorate in geekery can make sense of it..?

Amanda Wreckonwith

Fri, 23 Aug 2013 09:50:10 +1200

…what happened next?
wont know till tonight...
That was on Edam.
Got some Gorgonzola.
Bit scared to try...

Ian Dalziel

Fri, 23 Aug 2013 09:33:44 +1200

dairy heirs...
...maybe I should stop eating cheese before bedtime
No, no, I recognise your nocturnal Rarebit Friends
and their lair out on the (Orange) Roughy Justice Rise...

...what happened next?

Thomas Beagle

Fri, 23 Aug 2013 09:19:13 +1200

I guess the first part of the article nicely disposes of ex-GCSB head Bruce Ferguson's claim that the GCSB only provided assistance to Police by seconding staff to them.

Amanda Wreckonwith

Fri, 23 Aug 2013 09:09:52 +1200

Or alternatively – maybe I should stop eating cheese before bedtime

Amanda Wreckonwith

Fri, 23 Aug 2013 09:08:45 +1200

August 24th 2019
The Opening of the Chatham Island State Prison.
President Collins steps forward to address the huge crowd.

"For many years, the enemies of our happy nation have been laughing at us with their devious practices of encryption. Subversives and paedophiles have been free to spread their filth…

Ian Dalziel

Fri, 23 Aug 2013 07:53:05 +1200

latchkey kids...
Key security is a biggy...
There is a certain irony in using a Key to circumvent the PM's scaremongering machinations....

Idiot Savant

Fri, 23 Aug 2013 02:03:44 +1200

Is there a preferred keyserver for NZ keys?

Brent Jackson

Fri, 23 Aug 2013 01:02:12 +1200

Hmm. I'm not sure that trusting Outlook or Gmail with Certificates and keys is any advantage – the NSA is already likely to have them in their pocket.

TracyMac

Thu, 22 Aug 2013 23:39:47 +1200

One thing I didn't highlight about the advantages of S/MIME (beyond not having to download and run key-generation and mail client add-ons) is that public certificate distribution is easy – just send someone a digitally signed email (you need to ensure the option to include the cert is selected).

On…

TonyWebb

Thu, 22 Aug 2013 23:32:07 +1200

Thunderbird Email with the Enigmail plugin (uses GPG) and is an easy to use, cross platform key management solution.

TonyWebb

Thu, 22 Aug 2013 23:28:05 +1200

Great post Keith.

It's worth remembering that encryption done badly can be worse than not using it all. I'd urge people who want to use encryption to read and understand as much as they can when using encryption as there are many pitfalls. Key security is a biggy – the…

Idiot Savant

Thu, 22 Aug 2013 23:12:42 +1200

GPG4USB: advantages: mobile, can be used to encrypt webmail and throwaways. Disadvantages: will teach you bad habits about encrypting only stuff which is worth the hassle, so it basicly signals people about content.

Still, better than nothing. And given my email useage patterns, probably a good match.

TracyMac

Thu, 22 Aug 2013 23:10:10 +1200

For more food for thought, these days I'd probably prefer to use S/MIME over PGP. Integration isn't a problem with most modern mail clients (http://email.about.com/od/smimesoftware/S_MIMEEnabled_Email_Software.htm) – it's built-in with no addons needed. It's a slight PITA having to get the cert installed and configured in the mail client, but it's…

TracyMac

Thu, 22 Aug 2013 22:36:59 +1200

There's a list of mail clients here that natively support PGP and many others you can get plugins/addons for: http://www.vanheusden.com/pgp.php

TracyMac

Thu, 22 Aug 2013 22:34:14 +1200

For your webmail services like Gmail and Outlook.com, there's Mailvelope: http://www.mailvelope.com/

Comes in a Chrome app only so far, although they do apparently have a Firefox plugin in development.

HamishFraser

Thu, 22 Aug 2013 22:33:46 +1200

There is a certain glee in posting in broad daylight for a single individual. I am intrigued/lazy to know with a key size of 2048 and the RSA algorithm, how much time that would take to crack based on Edward Snowdens suggestion to Laura:

"Assume that your adversary is capable of…

Ian Dalziel

Thu, 22 Aug 2013 22:15:57 +1200

—–BEGIN PGP MESSAGE—–
Version: GnuPG v1.4.12 (MingW32)
hQEMA4M1NX6Hba...EriyEalV/q5J7x2gn7S21UB2gYUqPgNu
=g6Fq
—–END PGP MESSAGE—–
Hello 'Not-So-Public Address'...

Adam Shand

Thu, 22 Aug 2013 22:09:21 +1200

I reached the same conclusions a week ago and decided to write up a tutorial on how to make encrypting email as easy as possible.

For those that might be interested, here is a (hopefully extremely easy to follow) tutorial on how to get email encryption working on a Mac…

Martin Lindberg

Thu, 22 Aug 2013 22:05:23 +1200

There was a pretty good how-to on Ars Technica a couple of months ago. See Encrypted e-mail: How much annoyance will you tolerate to keep the NSA away?.

Apart from showing the steps, it also talks about why the process is pretty annoying unless you have a group of friends…

Brent Jackson

Thu, 22 Aug 2013 21:50:32 +1200

Is this build into any email clients ? If not, why not ?

nzlemming

Thu, 22 Aug 2013 21:45:10 +1200

Thanks for connecting those dots. I downloaded the docs but haven't got round to reading them yet.

Sacha

Thu, 22 Aug 2013 21:41:27 +1200

zing

HamishFraser

Thu, 22 Aug 2013 21:20:19 +1200

Which is the answer to the question I was now asking myself, I wrote a link to my public key in my message and then must have sent an earlier attempt which I have no copy of. In other words – to much focus on the process, not enough on…

Keith Ng

Thu, 22 Aug 2013 21:12:36 +1200

Moz & Rich: Yes, will get to that in the next part...

Keith Ng

Thu, 22 Aug 2013 21:05:03 +1200

Huzzah! It worked. I'd reply in an encrypted message, but I don't have your public key.

HamishFraser

Thu, 22 Aug 2013 20:59:42 +1200

BEGIN PGP MESSAGE

Version: GnuPG v1.4.12 (MingW32)

hQEMA4M1NX6HbamyAQf8CFd6lN4au27J1PSYjlaLnHpQFyrrrhYyPyZcceiLZKWd
sehQX8+wNzNgqkJ13cS1ouMhmL7hFqLOgZUSGqe8kWNvAUf0JlNaFtQ91VPqraU7
uP2YQKwicg/Q7BadcSwB6Cht39P+jX1uJOa5KZoprxSg3E/uM4nSuueFNNIuUCzq
vw/t1e9MCU0ohJ6Wh5vpteMAwnw5GiILZ/WU/AzCy1vPAdRcPXAV//V8qWP8kW6N
tYRERiGFtRYaemvAgu3s/90zvK3sUr84Kd47U1TGihC1NJr/i4bpkzbZ01/IIPw7
ViePKjeIB1DRp56eOv3NaJ6x80BxJGdkuniCtl8Y/tKdAcXYWF68AI909N6rswZR
xAHByw2Qu0PFyTWHQoQra0558sqpvQytVQMAKiz0AUQJmeowvaIQTtWWpUm4gqrl
XP90ZrrTv2fBjw/rOraC5N/PgQ9Hj5lHYodfuRFe+KH1GiuxzJnUWNStRspxdJpy
cvQe8IzxgFXyAYa0uwzcjKXmEV81adv0fZvyHDXOwqkyG8CY9340EYeX0ZOqSw==
=vpAb

END PGP MESSAGE

Jeremy Andrew

Thu, 22 Aug 2013 20:32:30 +1200

Cypherpunk, surely?

Moz

Thu, 22 Aug 2013 20:15:24 +1200

it should be possible to build an infrastructure that’s strong enough and tamper-evident enough to make systematic monitoring very difficult.

The standard way is to use an outside channel. The simple(ish) way is just to put the hash of your public key in visible places – an image on your…

Nicola Rowe

Thu, 22 Aug 2013 20:14:15 +1200

Thank you! I've been looking for this.

Amanda Wreckonwith

Thu, 22 Aug 2013 19:59:19 +1200

Good work.
People like us need people like you.
Sod the others – will you stand for Labour Party leader?

Rich of Observationz

Thu, 22 Aug 2013 18:56:55 +1200

Key distribution, that's the hard part. Ensuring that you have the public keys of everyone you want to contact and that these haven't been tampered with.

It's a hard problem, partly because of the risk of the man-in-the-middle attack (where somebody intercepts your traffic, substitutes the key and encrypts/recrypts your…

Jon J.

Thu, 22 Aug 2013 17:59:56 +1200

Spectacular. :-)

Public Address

Thu, 22 Aug 2013 17:59:56 +1200

Discussion from blog post.