Hacker News new | ask | show | jobs
by lmgftp 4725 days ago
Scary bit is it's not server on HTTPS, which is probably a must-have for sites that publish public-key information. Much easier to MITM attack the site and claim to be posting "his" public key and email address while really publishing your own info, etc.

A great tutorial, however. Very accessible in my opinion and considering it's purpose my previous paragraph is more of an aside.
2 comments
jarrett 4725 days ago
That's the purpose of key signing. The author--like almost all PGP users--has gotten his key signed by third parties. This means that its integrity can be verified. E.g., if a man in the middle were to intercept the HTTP response and change the contents of the key, it would lack the signatures.

Still, I suppose it's possible for an adversary to work around this as well. If you can find enough people who are 1) willing to falsely sign a key, and 2) trusted by others, you can have these people sign a spoofed key. But then these people would be putting their reputations on the line, and the probability of being exposed is high. Thus the cost of the attack is high.

The lesson being: If you're emailing info that is valuable enough to warrant such a costly attack, verify the key through some other means. Meet the message recipient in person, for example. And consider a thorough security audit of everything in your digital and physical life. You're obviously operating in a far more dangerous world than I do. There are probably many vulnerabilities available to attackers that have nothing to do with your email.

link
lmgftp 4725 days ago
Of course, you're entirely correct in that :)

My warning was truly an aside, and given the nature of a large group of visitors, of course a handful might not follow best practices and verify the signatures, etc.

link
jarrett 4725 days ago
Ah, good point. I see what you mean--if someone is just learning about PGP the first time, they might not know about issues surrounding key integrity, and the need for trusted 3rd-party signatures.
link
asdliajd 4724 days ago
Install gpg-curl, use hkps (TLS key exchange)

https://we.riseup.net/riseuplabs+paow/openpgp-best-practices...

Edit: nevermind, i see you meant the site with the tutorial, not key exchange

link