class="share-logo" alt="[Hacker News]">
</a>
</li>
+ <li class="spacer">V4.0</li>
</ul>
<!-- ~~~~~~~~~ FSF Introduction ~~~~~~~~~ -->
<dl>
<dt>Strong Passphrases with Diceware</dt>
<dd>Human-made passwords tend to either be very easy to guess, or difficult to memorise and easy to forget. Fortunately, if your privacy is more important to you than an extra 10 to 15 minutes of your time, you can use dice to come up with a password which is both strong and memorable using the 'diceware' method.</dd>
-
+
<dd>To use the diceware method, you will need dice (preferably 5, but 1 will do) and <a href="http://world.std.com/~reinhold/diceware.wordlist.asc">this list of words</a>. Do not substitute computer dice for physical dice. Notice that each word on the word list corresponds to a unique five-digit number. Role one dice five times, or five dice once to select the first word. Don't rearrange or discard words, because doing so makes the process much less secure. Repeat this process until you have at least six words, and there's your password.</dd>
<dt>Command line key generation</dt>
- <dd>If you prefer using the command line for a higher degree of control, you can follow the documentation from the <a href="http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto-3.html#ss3.1">GnuPG Mini Howto</a> or <a href="https://www.gnupg.org/gph/en/manual/c14.html#AEN25">The GNU Privacy Handbook</a>. Make sure you stick with "RSA and RSA" (the default), because it's newer and more secure than algorithms recommended in the old previously mentioned documentation.</dd>
+ <dd>If you prefer using the command line for a higher degree of control, you can follow the documentation from the <a href="http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto-3.html#ss3.1">GnuPG Mini Howto</a> or <a href="https://www.gnupg.org/gph/en/manual/c14.html#AEN25">The GNU Privacy Handbook</a>. Make sure you stick with "RSA and RSA" (the default), because it's newer and more secure than the algorithms recommended in the old previously mentioned documentation.</dd>
<dt>Advanced key pairs</dt>
<dd>When GnuPG creates a new keypair, it compartmentalizes the encryption function from the signing function through <a href="https://wiki.debian.org/Subkeys">subkeys</a>. If you use subkeys carefully, you can keep your GnuPG identity much more secure and recover from a compromised key much more quickly. <a href="https://alexcabal.com/creating-the-perfect-gpg-keypair/">Alex Cabal</a> and <a href="http://keyring.debian.org/creating-key.html">the Debian wiki</a> provide good guides for setting up a secure subkey configuration.</dd>
<h2><em>#3</em> Try it out!</h2>
<p>Now you'll try a test correspondence with a computer program named Edward, which knows how to use encryption. Except where noted, these are the same steps you'd follow when corresponding with a real, live person.</p>
- <p>NOTE: Edward is currently having some technical difficulties, so he may take a long time to respond, or not respond at all. We're sorry about this and we're working hard to fix it. Your key will still work even without testing with Edward.</p>
+ <!-- <p>NOTE: Edward is currently having some technical difficulties, so he may take a long time to respond, or not respond at all. We're sorry about this and we're working hard to fix it. Your key will still work even without testing with Edward.</p> -->
</div><!-- End .section-intro -->
<!-- ~~~~~~~~~ a div for each step ~~~~~~~~~ -->
<h4>Advanced</h4>
<dl>
<dt>Encrypt messages from the command line</dt>
- <dd>You can also encrypt and decrypt messages and files form the <a href="https://www.gnupg.org/gph/en/manual/x110.html">command line</a>, if that's your preference.</dd>
+ <dd>You can also encrypt and decrypt messages and files form the <a href="https://www.gnupg.org/gph/en/manual/x110.html">command line</a>, if that's your preference. The option --armor makes the encrypted output appear in the regular character set.</dd>
</dl>
</div><!-- /.troubleshooting -->
<h2><em>#4</em> Learn the Web of Trust</h2>
<p>Email encryption is a powerful technology, but it has a weakness; it requires a way to verify that a person's public key is actually theirs. Otherwise, there would be no way to stop an attacker from making an email address with your friend's name, creating keys to go with it and impersonating your friend. That's why the free software programmers that developed email encryption created keysigning and the Web of Trust.</p>
-<p>When you sign someone's key, you are publicly saying that you trust that it belongs to them and not an impostor. People who use your public key can see who has signed it. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, forming a giant network. The more signatures of people you trust a key has, the more trustworthy that key is.</p>
+<p>When you sign someone's key, you are publicly saying that you trust that it belongs to them and not an impostor. Signing keys and messages is the same type mathematical operation, but they carry very different implications. It's a good practice to generally sign your email, but if you casually sign people's keys, you may accidently end up vouching for the identity of an imposter. People who use your public key can see who has signed it. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is a constellation of GnuPG users, connected to each other by chains of trust expressed through signatures. The more signatures of people you trust a key has, the more trustworthy that key is.</p>
</div>End #pgp-pathfinder -->
</div><!-- End .main -->
- </div><!-- End #step-4a .step -->
+ </div><!-- End #step-4a .step -->
<!-- ~~~~~~~~~ a div for each step ~~~~~~~~~ -->
<div id="step-sign_real_keys" class="step">
<div class="main">
- <h3><em>Important:</em> check people's identification before signing their keys</h3>
+ <h3>Identifying keys: Fingerprints and IDs</h3>
<p>People's public keys are usually identified by their key fingerprint, which is a string of digits like F357AA1A5B1FA42CFD9FE52A9FF2194CC09A61E8 (for Edward's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to Enigmail → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint wherever you share your email address, so that people can double-check that they have the correct public key when they download yours from a keyserver.</p>
<p class="notes">You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like C09A61E8 for Edward. The key ID is visible directly from the Key Management window. This key ID is like a person's first name (it is a useful shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion. If you only have the key ID, you can still look up the key (as well as its fingerprint), like you did in Step 3, but if multiple options appear, you'll need the fingerprint of the person to whom you are trying to communicate to verify which one to use.</p>
<div class="main">
<h3><em>Important:</em> check people's identification before signing their keys</h3>
<p>Before signing a real person's key, always make sure it actually belongs to them, and that they are who they say they are. Ask them to show you their ID (unless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
+
+ <!-- ~~~~~~~~~ Troubleshooting ~~~~~~~~~ -->
+ <div class="troubleshooting">
+ <h4>Advanced</h4>
+ <dl>
+ <dt>Master the Web of Trust</dt>
+ <dd>Unfortunately, trust does not spread between users the way <a href="http://fennetic.net/irc/finney.org/~hal/web_of_trust.html">many people think</a>. One of best ways to strengthen the GnuPG community is to properly <a href="https://www.gnupg.org/gph/en/manual/x334.html">understand</a> the web of trust and to carefully sign as many people's keys as <a href="http://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html">circumstances</a> permit.</dd>
+ </dl>
+ </div><!-- /.troubleshooting -->
</div><!-- End .main -->
+
</div><!-- End #step-sign_real_keys .step-->
<p><img src="//static.fsf.org/nosvn/enc-dev0/img/en/screenshots/section5-02-use-it-well.png" alt="Section 5: Use it Well" /></p>
</div><!-- /.sidebar -->
<div class="main">
- <h3><em>Important:</em> Be wary of invalid keys</h3>
+ <h3>Be wary of invalid keys</h3>
<p>GnuPG makes email safer, but it's still important to watch out for invalid keys, which might have fallen into the wrong hands. Email encrypted with invalid keys might be readable by surveillance programs.</p>
<p>In your email program, go back to the second email that Edward sent you. Because Edward encrypted it with your public key, it will have a message from Enigmail at the top, which most likely says "Enigmail: Part of this message encrypted."</p>
<p><b>When using GnuPG, make a habit of glancing at that bar. The program will warn you there if you get an email encrypted with a key that can't be trusted.</b></p>
</div><!-- End .main -->
</div><!-- End #step-lost_key .step-->
+ <!-- ~~~~~~~~~ a div for each step ~~~~~~~~~ -->
+ <div id="step-lost_key" class="step">
+ <div class="main">
+ <h3>Webmail and GnuPG</h3>
+ <p>When you use a web browser to access your email, you're using webmail, an email program stored on a distant website. Unlike webmail, your desktop email program runs on your own computer. Although webmail can't decrypt encrypted email, it will still display it in its encrypted form. If you primarily use webmail, you'll know to open your email client when you receive a scrambled email.</p>
+ </div><!-- End .main -->
+ </div><!-- End #step-lost_key .step-->
+
+ <!-- ~~~~~~~~~ a div for each step ~~~~~~~~~ -->
+ <div id="step-lost_key" class="step">
+ <div class="main">
+ <h3>Optional: Protect Your Privacy with Tor</h3>
+ <p><a href=https://www.torproject.org/about/overview.html.en>The Onion Router (Tor) network</a> wraps Internet communication in multiple layers of encryption and bounces it around the world several times. When used properly, Tor confuses surveillance field agents and the global surveillance apparatus alike. To have your email program send and receive email over Tor, install the <a href="https://addons.mozilla.org/en-us/thunderbird/addon/torbirdy/">Torbirdy plugin</a> the same way you installed Enigmail, by searching for it through Add-ons.</p>
+
+ <p>Before beginning to check your email over Tor, make sure you understand <a href="https://www.torproject.org/docs/faq.html.en#WhatProtectionsDoesTorProvide">the security tradeoffs involved</a>. This <a href=https://www.eff.org/pages/tor-and-https">infographic</a> demonstrates how Tor keeps you secure.
+ </div><!-- End .main -->
+ </div><!-- End #step-lost_key .step-->
+
+
<!-- ~~~~~~~~~ a div for each step ~~~~~~~~~
<div id="step-5d" class="step">
<div class="main">
<div>
<div id="copyright">
<h4><a href="https://u.fsf.org/ys"><img alt="Free Software Foundation" src="//static.fsf.org/nosvn/enc-dev0/img/fsf-logo.png" /></a></h4>
- <p>Copyright © 2014 <a href="https://u.fsf.org/ys">Free Software Foundation</a>, Inc. <a href="https://my.fsf.org/donate/privacypolicy.html">Privacy Policy</a>. <a href="https://u.fsf.org/yr">Join.</a></p>
- <p><em>
Version 3.0. <a href="http://agpl.fsf.org/emailselfdefense.fsf.org/edward/CURRENT/edward.tar.gz">Source code of Edward reply bot by Josh Drake <zamnedix@gnu.org> available under the GNU General Public License.</a></em></p>
+ <p>Copyright © 2014
-2015 <a href="https://u.fsf.org/ys">Free Software Foundation</a>, Inc. <a href="https://my.fsf.org/donate/privacypolicy.html">Privacy Policy</a>. <a href="https://u.fsf.org/yr">Join.</a></p>
+ <p><em><a href="http://agpl.fsf.org/emailselfdefense.fsf.org/edward/CURRENT/edward.tar.gz">Source code of Edward reply bot by Josh Drake <zamnedix@gnu.org> available under the GNU General Public License.</a></em></p>
<p>The images on this page are under a <a href="https://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 license (or later version)</a>, and the rest of it is under a <a href="https://creativecommons.org/licenses/by-sa/4.0">Creative Commons Attribution-ShareAlike 4.0 license (or later version)</a>. — <a href="http://www.gnu.org/licenses/license-list.html#OtherLicenses">Why these licenses?</a></p>
<p>Download the source package for <a href="emailselfdefense_source.zip">this guide</a>. Fonts used in the guide & infographic: <a href="https://www.google.com/fonts/specimen/Dosis">Dosis</a> by Pablo Impallari, <a href="http://www.google.com/fonts/specimen/Signika">Signika</a> by Anna Giedryś, <a href="http://www.google.com/fonts/specimen/Archivo+Narrow">Archivo Narrow</a> by Omnibus-Type, <a href="http://www.thegopherarchive.com/gopher-files-hacks-pxl2000-119351.htm">PXL-2000</a> by Florian Cramer.</p>
<p>
projects / enc.git / blobdiff