<li class="share"><a href="https://fsf.org/share?u=https://u.fsf.org/zb&t=Email encryption for everyone via %40fsf">#EmailSelfDefense</a></li>
</ul>
- <!-- ~~~~~~~~~ FSF Introduction ~~~~~~~~~ -->
<!-- ~~~~~~~~~ FSF Introduction ~~~~~~~~~ -->
<div id="fsf-intro">
<h3><a href="http://u.fsf.org/ys"><img alt="Free Software Foundation" src="//static.fsf.org/nosvn/enc-dev0/img/fsf-logo.png"></a></h3>
<div class="intro">
<p>
<a id="infographic" href="infographic.html"><img src="//static.fsf.org/nosvn/enc-dev0/img/infographic-button.png" alt="View & share our infographic →" /></a>
- Bulk surveillance violates our fundamental rights and makes free speech risky. This guide will teach you a basic surveillance self-defense skill: email encryption. Once you've finished, you'll be able to send and receive emails that are coded to make sure that a surveillance agent or thief that intercepts your email can't read it.</p>
+ Bulk surveillance violates our fundamental rights and makes free speech risky. This guide will teach you a basic surveillance self-defense skill: email encryption. Once you've finished, you'll be able to send and receive emails that are coded to make sure that a surveillance agent or thief that intercepts your email can't read it. All you need is a computer with an Internet connection, an email account and about half an hour.</p>
<p>Even if you have nothing to hide, using encryption helps protect the privacy of people you communicate with, and makes life difficult for bulk surveillance systems. If you do have something important to hide, you're in good company; these are the same tools that Edward Snowden used to share his famous secrets about the NSA.</p>
- <!--<p>You'll also be able to sign emails to show reliably that they are from you. Though the need for signing may be less obvious, you'll actually do it more often.</p>-->
-
- <p class="notes">This guide relies on software which is freely licensed; it's completely transparent and anyone can copy it or make their own version. This makes it safer from surveillance than proprietary software (like Mac OS). To be as safe as possible from surveillance, we recommend you switch to a free software operating system like GNU/Linux. Learn more about free software at <a href="https://u.fsf.org/ys">fsf.org</a>.</p>
-
-<p>Let's get started!</p>
+<p>In addition to using encryption, standing up to surveillance requires fighting politically for a <a href="http://gnu.org/philosophy/surveillance-vs-democracy.html">reduction in the amount of data collected on us</a>, but the essential first step is to protect yourself and make surveillance of your communication as difficult as possible. Let's get started!</p>
</div>
<!-- ~~~~~~~~~ section introduction: interspersed text ~~~~~~~~~ -->
<div class="section-intro">
<h2><em>#1</em> Get the pieces</h2>
- <p>All you need to start is a computer with an Internet connection, an email account and about half an hour. You can use your existing email account for this without affecting it.</p>
+ <p class="notes">This guide relies on software which is freely licensed; it's completely transparent and anyone can copy it or make their own version. This makes it safer from surveillance than proprietary software (like Windows). Learn more about free software at <a href="https://u.fsf.org/ys">fsf.org</a>.</p>
<p>To get started, you'll need a desktop email program installed on your computer. This guide works with free software versions of the Thunderbird email program, and with Thunderbird itself. Email programs are another way to access the same email accounts you can access in a browser (like GMail), but provide extra features.</p>
<p>If you are already have one of these, you can skip to <a href="#step-1b">Step 1.b</a>.</p>
</div><!-- End .section-intro -->
<p>When you sign someone's key, you are publicly saying that you trust that it does belong to them and not an impostor. People who use your public key can see the number of signatures it has. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, into a giant Web. The more signatures a key has, and the more signatures its signers' keys have, the more trustworthy that key is.</p>
-<p>People's public keys are usually identified by their key ID, which is a short string of 8 digits like 92AB3FF7 (for Adele's key). You can see your key ID on the right in OpenPGP → Key Management in your email program's menu.</p>
-<p>It's good practice to share your key ID, so that so that people can double-check that they have the correct public key when they download yours from a keyserver. You may also see public keys referred to by their key fingerprint, which is a longer string of digits, like DD878C06E8C2BEDDD4A440D3E573346992AB3FF7. The key ID is just the last 8 digits of the fingerprint.</p>
+<p>People's public keys are usually identified by their key fingerprint, which is a string of digits lik DD878C06E8C2BEDDD4A440D3E573346992AB3FF7 (for Adele's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to OpenPGP → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint, so that so that people can double-check that they have the correct public key when they download yours from a keyserver.</p>
+
+<p>You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like 92AB3FF7 for Adele. The key ID is visible directly from the Key Management Window. This key ID is like a person's first name (it is a good shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion.</p>
+
</div><!-- End .section-intro -->
<div id="step-sign_real_keys" class="step">
<div class="main">
<h3><em>Important:</em> check people's identification before signing their keys</h3>
- <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
+ <p>Before signing a real person's key, always make sure it actually belongs to them, and they are who they say they are. Ask them to show you their ID (nunless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".</p>
</div><!-- End .main -->
</div><!-- End #step-sign_real_keys .step-->
projects / enc.git / blobdiff