[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kdepim-users
Subject:    Re: [kdepim-users] Boyan Tabakov turned Green ! (PGP KGpg topic)
From:       Boyan Tabakov <blade.alslayer () gmail ! com>
Date:       2007-01-19 8:46:38
Message-ID: 20070119084607.GA5144 () rainbow
[Download RAW message or body]

[Attachment #2 (multipart/signed)]


Below is the original message from Jean-Philippe, as well as my answer. The message \
was encrypted for me, but seems as a post to everyone...

On Fri, Jan 19, 2007 at 09:30:53AM +0700, Jean-Philippe Monteiro wrote:
> Hi Community
> 
> In the course of self-learning, and following a very old thread where Boyan 
> "Blade" Tabakov proved very helpful, I was able to create my own key, encrypt 
> some TAR files with it, and was able to sign (when I can remember of)
> outgoing messages. Thanks Blade!

You are welcome!

> Now this leaves me with two questions: 
> -How do I automatically sign outgoing messages from my gmail account (the 
> others do not have a key)?

That's easy: Settings -> Configure KMail -> Security -> Composing
 - Automatically sign messages

> -How do I encrypt a message to someone I downloaded the key from?
> 

In the composer window you should have two buttons Sign and Encrypt (available as \
well from the Options menu). If you selected the 'Automatically sign messages' \
option, Sign should already be selected for you. The message will be signed with the \
recepients key if available (a dialog box will appear confirm the key selected). A \
nice option is to check the the 'Always encrypt to self' option (located in the same \
place as the one mentioned above). That way all mail that is sent encrypted will be \
encrypted with your public key too, making it possible for you to read it. Otherwise \
you won't be able to read the mail you've sent encryped.

> --All this is more self-learning than paranoia, apart from the legitimate will 
> to ensure people around that, when I send a file, it hasn't been messed up 
> with--
> 
> for testing purposes, I have signed/acknowledged Anne Wilson, Boyan Tabakov & 
> Ingo Klocker - out of intuition these people should be what they are, and not 
> as recommended through some Accurate Verification Process - Hence, Anne & 
> Ingo "turned Green" on my screen as well!
> 

Thanks for the trust, but that is not a good practice. Maybe you've read some of my \
older posts on how this is supposed to work, but I'll sum up here:

The idea is to sign keys of people you know directly and who's public keys you can \
obtain in a secure way - e.g. the other person himself gave you the fingerprint on a \
sheet of paper. That way you are 100% sure that the key belogs to him alone. If you \
choose to trust my key for example, how do you know that I am really someone called \
'Boyan Tabakov'? I could have created a key stating that I am 'Ritchie Blackmore'. \
(Last time I mentioned Bill Gates here, but thought it would be too much for the \
guy:) ). If you do think you can trust my key, a good idea is to mark this with a \
local signature (one that cannot be exported). See gpg's manual on how to create \
local signatures.

> The killall question: what's the use for me to have a key, if I am not part of 
> a "web of trust"?

Not much use, if any at all. Find someone, a friend, colegue, etc, who's using PGP \
and ask him/her to sign your key. Then everything starts working: the friend of my \
friend is my friend...

The only use I can think of is to give your public key to some friends so that they \
can be assured what you send is intact. If you do so, though, why don't you ask them \
to sign your key, if they have one themselves?

Remember that the web of trust, as a kind of web has a week spot: Let's say you have \
a key and you sign'ed your frined's key. Now if this frined X does not care much \
about security of his key, the key might get compromised. And if X doesn't understand \
that has happened, the key won't be revoked. Now the attacker has a key, that is \
signed by you and eventually trusted by all other people that trust you.

> Cheers
> Jean-Philippe
> 
> [This message is both Signed & Encrypted, as a test, so sorry for the mess 
> that can occur: don't flame the humble self-trainer here]

Note that this way, the only one that could read the message is the one who's public \
key you used for encryption, and definitely not all the mailing list users.

Please feel free to ask anything, you may be interested in, both in private mails and \
on the mailing list.

> -- 
> 
> SuSE93 Linux Kernell 2.6.11.4-21.14 KDE 3.4.0 Kontact 1.1 Kmail 1.8
> PHNOM PENH - CAMBODIA



-- 
Blade hails you...

For nature hates virginity
I wish to be touched
Not by the hands of where's and why's
But by the Oceans' minds
                          --Nightwish


[Attachment #5 (application/pgp-signature)]

_______________________________________________
KDE PIM users mailing list
kdepim-users@kde.org
https://mail.kde.org/mailman/listinfo/kdepim-users


[prev in list] [next in list] [prev in thread] [next in thread]