class="share-logo" alt="[Hacker News]">
</a>
</li>
+ <li class="spacer">V4.0</li>
</ul>
<!-- ~~~~~~~~~ FSF Introduction ~~~~~~~~~ -->
<dl>
<dt>Strong Passphrases with Diceware</dt>
<dd>Human-made passwords tend to either be very easy to guess, or difficult to memorise and easy to forget. Fortunately, if your privacy is more important to you than an extra 10 to 15 minutes of your time, you can use dice to come up with a password which is both strong and memorable using the 'diceware' method.</dd>
-
+
<dd>To use the diceware method, you will need dice (preferably 5, but 1 will do) and <a href="http://world.std.com/~reinhold/diceware.wordlist.asc">this list of words</a>. Do not substitute computer dice for physical dice. Notice that each word on the word list corresponds to a unique five-digit number. Role one dice five times, or five dice once to select the first word. Don't rearrange or discard words, because doing so makes the process much less secure. Repeat this process until you have at least six words, and there's your password.</dd>
<dt>Command line key generation</dt>
- <dd>If you prefer using the command line for a higher degree of control, you can follow the documentation from the <a href="http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto-3.html#ss3.1">GnuPG Mini Howto</a> or <a href="https://www.gnupg.org/gph/en/manual/c14.html#AEN25">The GNU Privacy Handbook</a>. Make sure you stick with "RSA and RSA" (the default), because it's newer and more secure than algorithms recommended in the old previously mentioned documentation.</dd>
+ <dd>If you prefer using the command line for a higher degree of control, you can follow the documentation from the <a href="http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto-3.html#ss3.1">GnuPG Mini Howto</a> or <a href="https://www.gnupg.org/gph/en/manual/c14.html#AEN25">The GNU Privacy Handbook</a>. Make sure you stick with "RSA and RSA" (the default), because it's newer and more secure than algorithms recommended in the old previously mentioned documentation.</dd>
<dt>Advanced key pairs</dt>
<dd>When GnuPG creates a new keypair, it compartmentalizes the encryption function from the signing function through <a href="https://wiki.debian.org/Subkeys">subkeys</a>. If you use subkeys carefully, you can keep your GnuPG identity much more secure and recover from a compromised key much more quickly. <a href="https://alexcabal.com/creating-the-perfect-gpg-keypair/">Alex Cabal</a> and <a href="http://keyring.debian.org/creating-key.html">the Debian wiki</a> provide good guides for setting up a secure subkey configuration.</dd>
<h2><em>#4</em> Learn the Web of Trust</h2>
<p>Email encryption is a powerful technology, but it has a weakness; it requires a way to verify that a person's public key is actually theirs. Otherwise, there would be no way to stop an attacker from making an email address with your friend's name, creating keys to go with it and impersonating your friend. That's why the free software programmers that developed email encryption created keysigning and the Web of Trust.</p>
-<p>When you sign someone's key, you are publicly saying that you trust that it belongs to them and not an impostor. People who use your public key can see who has signed it. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, forming a giant network. The more signatures of people you trust a key has, the more trustworthy that key is.</p>
-
-<p>People's public keys are usually identified by their key fingerprint, which is a string of digits like F357AA1A5B1FA42CFD9FE52A9FF2194CC09A61E8 (for Edward's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to Enigmail → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint wherever you share your email address, so that people can double-check that they have the correct public key when they download yours from a keyserver.</p>
+<p>When you sign someone's key, you are publicly saying that you trust that it belongs to them and not an impostor. Signing keys and messages is the same type mathematical operation, but they carry very different implications. It's a good practice to generally sign your email, but if you casually sign people's keys, you may accidently end up vouching for the identity of an imposter. People who use your public key can see who has signed it. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, forming a giant network. The more signatures of people you trust a key has, the more trustworthy that key is.</p>
-<p class="notes">You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like C09A61E8 for Edward. The key ID is visible directly from the Key Management window. This key ID is like a person's first name (it is a useful shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion. If you only have the key ID, you can still look up the key (as well as its fingerprint), like you did in Step 3, but if multiple options appear, you'll need the fingerprint of the person to whom are trying to communicate to verify which one to use.</p>
</div><!-- End .section-intro -->
<p><strong>To:</strong> <input type="text" placeholder="50BD01x4" name="TO"></p>
<p class="buttons"><input type="submit" value="trust paths" name="PATHS"> <input type="reset" value="reset" name=".reset"></p>
</form>
- </div><!-- End #pgp-pathfinder -->
+ </div>End #pgp-pathfinder -->
</div><!-- End .main -->
- </div><!-- End #step-4a .step --> -->
+ </div><!-- End #step-4a .step -->
<!-- ~~~~~~~~~ a div for each step ~~~~~~~~~ -->
<div id="step-sign_real_keys" class="step">
<div class="main">
- <h3><em>Important:</em> check people's identification before signing their keys</h3>
- <p>Before signing a real person's key, always make sure it actually belongs to them, and that they are who they say they are. Ask them to show you their ID (unless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
+ <h3>Identifying keys: Fingerprints and IDs</h3>
+ <p>People's public keys are usually identified by their key fingerprint, which is a string of digits like F357AA1A5B1FA42CFD9FE52A9FF2194CC09A61E8 (for Edward's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to Enigmail → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint wherever you share your email address, so that people can double-check that they have the correct public key when they download yours from a keyserver.</p>
+
+<p>You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like C09A61E8 for Edward. The key ID is visible directly from the Key Management window. This key ID is like a person's first name (it is a useful shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion. If you only have the key ID, you can still look up the key (as well as its fingerprint), like you did in Step 3, but if multiple options appear, you'll need the fingerprint of the person to whom you are trying to communicate to verify which one to use.</p>
+
</div><!-- End .main -->
</div><!-- End #step-sign_real_keys .step-->
+ <!-- ~~~~~~~~~ a div for each step ~~~~~~~~~ -->
+ <div id="step-sign_real_keys" class="step">
+ <div class="main">
+ <h3><em>Important:</em> check people's identification before signing their keys</h3>
+ <p>Before signing a real person's key, always make sure it actually belongs to them, and that they are who they say they are. Ask them to show you their ID (unless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
+ </div><!-- End .main -->
+ </div><!-- End #step-sign_real_keys .step-->
</div>
<p><img src="//static.fsf.org/nosvn/enc-dev0/img/en/screenshots/section5-02-use-it-well.png" alt="Section 5: Use it Well" /></p>
</div><!-- /.sidebar -->
<div class="main">
- <h3><em>Important:</em> Be wary of invalid keys</h3>
+ <h3>Be wary of invalid keys</h3>
<p>GnuPG makes email safer, but it's still important to watch out for invalid keys, which might have fallen into the wrong hands. Email encrypted with invalid keys might be readable by surveillance programs.</p>
<p>In your email program, go back to the second email that Edward sent you. Because Edward encrypted it with your public key, it will have a message from Enigmail at the top, which most likely says "Enigmail: Part of this message encrypted."</p>
<p><b>When using GnuPG, make a habit of glancing at that bar. The program will warn you there if you get an email encrypted with a key that can't be trusted.</b></p>
<div id="copyright">
<h4><a href="https://u.fsf.org/ys"><img alt="Free Software Foundation" src="//static.fsf.org/nosvn/enc-dev0/img/fsf-logo.png" /></a></h4>
<p>Copyright © 2014 <a href="https://u.fsf.org/ys">Free Software Foundation</a>, Inc. <a href="https://my.fsf.org/donate/privacypolicy.html">Privacy Policy</a>. <a href="https://u.fsf.org/yr">Join.</a></p>
- <p><em>
Version 3.0. <a href="http://agpl.fsf.org/emailselfdefense.fsf.org/edward/CURRENT/edward.tar.gz">Source code of Edward reply bot by Josh Drake <zamnedix@gnu.org> available under the GNU General Public License.</a></em></p>
+ <p><em><a href="http://agpl.fsf.org/emailselfdefense.fsf.org/edward/CURRENT/edward.tar.gz">Source code of Edward reply bot by Josh Drake <zamnedix@gnu.org> available under the GNU General Public License.</a></em></p>
<p>The images on this page are under a <a href="https://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 license (or later version)</a>, and the rest of it is under a <a href="https://creativecommons.org/licenses/by-sa/4.0">Creative Commons Attribution-ShareAlike 4.0 license (or later version)</a>. — <a href="http://www.gnu.org/licenses/license-list.html#OtherLicenses">Why these licenses?</a></p>
<p>Download the source package for <a href="emailselfdefense_source.zip">this guide</a>. Fonts used in the guide & infographic: <a href="https://www.google.com/fonts/specimen/Dosis">Dosis</a> by Pablo Impallari, <a href="http://www.google.com/fonts/specimen/Signika">Signika</a> by Anna Giedryś, <a href="http://www.google.com/fonts/specimen/Archivo+Narrow">Archivo Narrow</a> by Omnibus-Type, <a href="http://www.thegopherarchive.com/gopher-files-hacks-pxl2000-119351.htm">PXL-2000</a> by Florian Cramer.</p>
<p>
projects / enc-live.git / blobdiff