From: Zak Rogoff Date: Thu, 21 Jan 2016 20:10:17 +0000 (-0500) Subject: Tweaks. X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=d083698e63e1fabdf5f3727002e7fdb9fd52a7ae;p=enc-live.git Tweaks. --- diff --git a/en/index.html b/en/index.html index 3bd8e07..f4cef57 100644 --- a/en/index.html +++ b/en/index.html @@ -22,20 +22,21 @@ @@ -79,7 +79,7 @@

- We want to translate this guide into more languages, and make a version for encryption on mobile devices. Please donate, and help people around the world take the first step towards protecting their privacy with free software. + Please donate to support Email Self-Defense. We need to keep improving it and making other materials like, for the benefit of people around the world taking the first step towards protecting their privacy.

@@ -95,7 +95,7 @@

Even if you have nothing to hide, using encryption helps protect the privacy of people you communicate with, and makes life difficult for bulk surveillance systems. If you do have something important to hide, you're in good company; these are the same tools that whistleblowers use to protect their identities while shining light on human rights abuses, corruption and other crimes.

-

In addition to using encryption, standing up to surveillance requires fighting politically for a reduction in the amount of data collected on us, but the essential first step is to protect yourself and make surveillance of your communication as difficult as possible. This guide helps you do that. It is designed for beginners, but if you already know the basics of GnuPG or are an experienced free software user, you'll enjoy the advanced tips.

+

In addition to using encryption, standing up to surveillance requires fighting politically for a reduction in the amount of data collected on us, but the essential first step is to protect yourself and make surveillance of your communication as difficult as possible. This guide helps you do that. It is designed for beginners, but if you already know the basics of GnuPG or are an experienced free software user, you'll enjoy the advanced tips and the guide to teaching your friends.

@@ -326,7 +326,7 @@ default). Once encryption is off, hit Send.

It may take two or three minutes for Edward to respond. In the meantime, you might want to skip ahead and check out the Use it Well section of this guide. Once he's responded, head to the next step. From here on, you'll be doing just the same thing as when corresponding with a real person.

-

When you open Edward's reply, Enigmail may prompt you for your password before using your private key to decrypt it.

+

When you open Edward's reply, GnuPG may prompt you for your password before using your private key to decrypt it.

@@ -397,15 +397,28 @@ default). Once encryption is off, hit Send.

-

Step 3.d Send a test signed email to a friend

+

Step 3.d Send a test signed email

GnuPG includes a way for you to sign messages and files, verifying that they came from you and that they weren't tampered with along the way. These signatures are stronger than their pen-and-paper cousins -- they're impossible to forge, because they're impossible to create without your private key (another reason to keep your private key safe).

You can sign messages to anyone, so it's a great way to make people aware that you use GnuPG and that they can communicate with you securely. If they don't have GnuPG, they will be able to read your message and see your signature. If they do have GnuPG, they'll also be able to verify that your signature is authentic.

-

To sign an email to a friend, click the pencil icon next to the lock icon so that it turns gold. If you sign a message, Enigmail will ask you for your password before it sends the message, because it needs to unlock your private key for signing.

-

When the pencil is gold but the lock is grey, the email will be signed but not encrypted. When the pencil is grey and the lock is gold, the email will be encrypted but not signed. When they're both gold, the email will be signed and encrypted.

+

To sign an email to Edward, compose any message to him and click the pencil icon next to the lock icon so that it turns gold. If you sign a message, GnuPG may ask you for your password before it sends the message, because it needs to unlock your private key for signing.

+ +

With the lock and pencil icons, you can choose whether each message will be encrypted, signed, both, or neither.

+ + +
+
+

Step 3.e Receive a response

+

When Edward receives your email, he will use your public key (which you sent him in Step 3.A) to verify that your signature is authentic and the message you sent has not been tampered with.

+ +

It may take two or three minutes for Edward to respond. In the meantime, you might want to skip ahead and check out the Use it Well section of this guide.

+ +

Edward's reply will arrive encrypted, because he prefers to use encryption whenever possible. If everything goes according to plan, it should say "Your signature was verified." If your test signed email was also encrypted, he will mention that first.

+
+
@@ -415,14 +428,14 @@ default). Once encryption is off, hit Send.

-

#4 Learn the Web of Trust

-

Email encryption is a powerful technology, but it has a weakness; it requires a way to verify that a person's public key is actually theirs. Otherwise, there would be no way to stop an attacker from making an email address with your friend's name, creating keys to go with it and impersonating your friend. That's why the free software programmers that developed email encryption created keysigning and the Web of Trust.

+

#4 Learn the Web of Trust

+

Email encryption is a powerful technology, but it has a weakness; it requires a way to verify that a person's public key is actually theirs. Otherwise, there would be no way to stop an attacker from making an email address with your friend's name, creating keys to go with it and impersonating your friend. That's why the free software programmers that developed email encryption created keysigning and the Web of Trust.

-

When you sign someone's key, you are publicly saying that you've verified that it belongs to them and not an impostor. Signing keys and messages is the same type mathematical operation, but they carry very different implications. It's a good practice to generally sign your email, but if you casually sign people's keys, you may accidently end up vouching for the identity of an imposter!

- -

People who use your public key can see who has signed it. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is a constellation of GnuPG users, connected to each other by chains of trust expressed through signatures. The more signatures of people you trust a key has, the more trustworthy that key is.

+

When you sign someone's key, you are publicly saying that you've verified that it belongs to them and not someone else.

+

Signing keys and signing messages use the same type of mathematical operation, but they carry very different implications. It's a good practice to generally sign your email, but if you casually sign people's keys, you may accidently end up vouching for the identity of an imposter.

+

People who use your public key can see who has signed it. Once you've used GnuPG for a long time, your key may have hundreds of signatures. You can consider a key to be more trustworthy if it has many signatures from people that you trust. The Web of Trust is a constellation of GnuPG users, connected to each other by chains of trust expressed through signatures.

@@ -473,9 +486,9 @@ default). Once encryption is off, hit Send.

Advanced

Master the Web of Trust
-
Unfortunately, trust does not spread between users the way many people think. One of best ways to strengthen the GnuPG community is to properly understand the web of trust and to carefully sign as many people's keys as circumstances permit.
+
Unfortunately, trust does not spread between users the way many people think. One of best ways to strengthen the GnuPG community is to deeply understand the Web of Trust and to carefully sign as many people's keys as circumstances permit.
Set ownertrust
-
If you trust someone enough to validate other people's keys, you can assign them an ownertrust level through Enigmails's key management window. Right click on the other person's key, go to the "Select Owner Trust" menu option, select the trustlevel and click OK. Only do this once you've read and understand "Master the Web of Trust" above.
+
If you trust someone enough to validate other people's keys, you can assign them an ownertrust level through Enigmails's key management window. Right click on the other person's key, go to the "Select Owner Trust" menu option, select the trustlevel and click OK. Only do this once you feel you have a deep understanding of the Web of Trust.
@@ -501,11 +514,10 @@ default). Once encryption is off, hit Send.

Section 5: Use it Well

-

When should I encrypt?

- -

The more you can encrypt your messages, the better. If you only encrypt emails occasionally, each encrypted message could raise a red flag for surveillance systems. If all or most of your email is encrypted, people doing surveillance won't know where to start.

+

When should I encrypt? When should I sign?

-

That's not to say that only encrypting some of your email isn't helpful -- it's a great start and it makes bulk surveillance more difficult.

+

The more you can encrypt your messages, the better. If you only encrypt emails occasionally, each encrypted message could raise a red flag for surveillance systems. If all or most of your email is encrypted, people doing surveillance won't know where to start. That's not to say that only encrypting some of your email isn't helpful -- it's a great start and it makes bulk surveillance more difficult.

+

Unless you don't want to reveal your own identity (which requires other protective measures), there's no reason not to sign every message, whether or not you are encrypting. In addition to allowing those with GnuPG to verify that the message came from you, signing is a non-intrusive way to remind everyone that you use GnuPG and show support for secure communication. If you often send signed messages to people that aren't familiar with GnuPG, it's nice to also include a link to this guide in your standard email signature (we're not referring here to your cryptographic signature, but rather the one that your email program can create by default, which normally includes your name).

@@ -518,7 +530,7 @@ default). Once encryption is off, hit Send.

Be wary of invalid keys

GnuPG makes email safer, but it's still important to watch out for invalid keys, which might have fallen into the wrong hands. Email encrypted with invalid keys might be readable by surveillance programs.

-

In your email program, go back to the second email that Edward sent you. Because Edward encrypted it with your public key, it will have a message from Enigmail at the top, which most likely says "Enigmail: Part of this message encrypted."

+

In your email program, go back to the first encrypted email that Edward sent you. Because Edward encrypted it with your public key, it will have a message from Enigmail at the top, which most likely says "Enigmail: Part of this message encrypted."

When using GnuPG, make a habit of glancing at that bar. The program will warn you there if you get an email encrypted with a key that can't be trusted.

@@ -527,7 +539,7 @@ default). Once encryption is off, hit Send.

Copy your revocation certificate to somewhere safe

-

Remember when you created your keys and saved the revocation certificate that GnuPG made? It's time to copy that certificate onto the safest digital storage that you have -- the ideal thing is a flash drive, disk, or hard drive stored in a safe place in your home.

+

Remember when you created your keys and saved the revocation certificate that GnuPG made? It's time to copy that certificate onto the safest digital storage that you have -- the ideal thing is a flash drive, disk, or hard drive stored in a safe place in your home, not on a device you carry with you regularly.

If your private key ever gets lost or stolen, you'll need this certificate file to let people know that you are no longer using that keypair.

@@ -536,7 +548,7 @@ default). Once encryption is off, hit Send.

Important: act swiftly if someone gets your private key

-

If you lose your private key or someone else gets ahold of it (say, by stealing or cracking your computer), it's important to revoke it immediately before someone else uses it to read your encrypted email or forge your signature. This guide doesn't cover how to revoke a key, but you can follow the instructions on the GnuPG site. After you're done revoking, send an email to everyone with whom you usually use your key to make sure they know.

+

If you lose your private key or someone else gets ahold of it (say, by stealing or cracking your computer), it's important to revoke it immediately before someone else uses it to read your encrypted email or forge your signature. This guide doesn't cover how to revoke a key, but you can follow these instructions. After you're done revoking, make a new key and send an email to everyone with whom you usually use your key to make sure they know, including a copy of your new key.

diff --git a/en/next_steps.html b/en/next_steps.html index dfcd8d2..c41b65b 100644 --- a/en/next_steps.html +++ b/en/next_steps.html @@ -33,7 +33,7 @@

#6 Next steps

-

You've now completed the basics of email encryption with GnuPG, taking action against bulk surveillance. A pat on the back to you! These next steps will help make the most of the work you did today.

+

You've now completed the basics of email encryption with GnuPG, taking action against bulk surveillance. These next steps will help make the most of the work you've done.

@@ -98,7 +98,7 @@

Before you close this guide, use our sharing page to compose a message to a few friends and ask them to join you in using encrypted email. Remember to include your GnuPG public key ID so they can easily download your key.

-

It's also great to add your public key fingerprint to your email signature so that people you are corresponding with know you accept encrypted email. We recommend you even go a step further and add it to your social media profiles, blog, Website, or business card. (At the Free Software Foundation, we put ours on our staff page.) We need to get our culture to the point that we feel like something is missing when we see an email address without a public key fingerprint.

+

It's also great to add your public key fingerprint to your email signature so that people you are corresponding with know that you accept encrypted email (we're not referring here to your cryptographic signature, but rather the one that your email program can create by default, which normally includes your name). We recommend you even go a step further and add it to your social media profiles, blog, Website, or business card. At the Free Software Foundation, we put ours on our staff page. We need to get our culture to the point that we feel like something is missing when we see an email address without a public key fingerprint.

@@ -126,7 +126,7 @@

The Onion Router (Tor) network wraps Internet communication in multiple layers of encryption and bounces it around the world several times. When used properly, Tor confuses surveillance field agents and the global surveillance apparatus alike. Using it simultaneously with GnuPG's encryption will give you the best results.

To have your email program send and receive email over Tor, install the Torbirdy plugin the same way you installed Enigmail, by searching for it through Add-ons.

-

Before beginning to check your email over Tor, make sure you understand the security tradeoffs involved. This infographic demonstrates how Tor keeps you secure. +

Before beginning to check your email over Tor, make sure you understand the security tradeoffs involved. This infographic from our friends at the Electronic Frontier Foundation demonstrates how Tor keeps you secure. diff --git a/en/workshops.html b/en/workshops.html index e3a9c14..7479e39 100644 --- a/en/workshops.html +++ b/en/workshops.html @@ -88,7 +88,7 @@

#1 Get your friends or community interested

If you hear friends grumbling about their lack of privacy, ask them if they're interested in attending a workshop on Email Self-Defense. If your friends don't grumble about privacy, they may need some convincing. You might even hear the classic "if you've got nothing to hide, you've got nothing to fear" argument against using encryption.

-

Here are some arguments you can use to help explain why it's worth it to learn GnuPG. Mix and match whichever you think will make sense to your community:

+

Here are some talking points you can use to help explain why it's worth it to learn GnuPG. Mix and match whichever you think will make sense to your community:

@@ -102,12 +102,12 @@

Strength in numbers

-

Each person who chooses to resist mass surveillance with encryption makes it easier for others to resist as well. People normalizing the use of strong encryption has multiple powerful effects: it means those that truly need privacy, like potential whistle-blowers and activists, are more likely to learn about encryption. More people using encryption for more things also makes it harder for surveillance systems to single out those that can't afford to be found, and shows solidarity with those people.

+

Each person who chooses to resist mass surveillance with encryption makes it easier for others to resist as well. People normalizing the use of strong encryption has multiple powerful effects: it means those who need privacy the most, like potential whistle-blowers and activists, are more likely to learn about encryption. More people using encryption for more things also makes it harder for surveillance systems to single out those that can't afford to be found, and shows solidarity with those people.

People you respect may already be using encryption

-

Many journalists, whistleblowers, activists, and researchers use GnuPG, so your friends might unknowingly have heard of a few people who use it already. You can search for "BEGIN PUBLIC KEY BLOCK" + keyword to help make a list of people and organizations who use GnuPG which your community will likely recognize.

+

Many journalists, whistleblowers, activists, and researchers use GnuPG, so your friends might unknowingly have heard of a few people who use it already. You can search for "BEGIN PUBLIC KEY BLOCK" + keyword to help make a list of people and organizations who use GnuPG who your community will likely recognize.

@@ -121,6 +121,11 @@

In the physical realm, we take window blinds, envelopes, and closed doors for granted as ways of protecting our privacy. Why should the digital realm be any different?

+
+

We shouldn't have to trust our email providers with our privacy

+

Some email providers are very trustworthy, but many have incentives not to protect your privacy and security. To be empowered digital citizens, we need to build our own security from the bottom up.

+
+ @@ -135,7 +140,7 @@

#2 Plan The Workshop

Once you've got at least one interested friend, pick a date and start planning out the workshop. Tell participants to bring their computer and ID (for signing each other's keys). Also tell the participants to bring dice (for making passwords), but also bring as many as you can, in case they don't. Make sure the location you select has an easily accessible Internet connection, and make backup plans in case the connection stops working on the day of the workshop. Libraries, coffee shops, and community centers make great locations. Try to get all the participants to set up an Enigmail-compatible email client before the event. Direct them to their email provider's IT department or help page if they run into errors.

Estimate that the workshop will take forty minutes plus ten minutes for each participant, at a minimum. Plan extra time for questions and technical glitches.

-

The success of the workshop requires understanding and catering to the unique backgrounds and needs of each group of participants. Workshops should stay small, so that each participant receives more individualized instruction. If more than a handful of people want to participate, keep the facilitator to participant ratio low by recruiting more facilitators, or by facilitating multiple workshops. Small workshops among friends work great!

+

The success of the workshop requires understanding and catering to the unique backgrounds and needs of each group of participants. Workshops should stay small, so that each participant receives more individualized instruction. If more than a handful of people want to participate, keep the facilitator to participant ratio high by recruiting more facilitators, or by facilitating multiple workshops. Small workshops among friends work great!

@@ -151,7 +156,7 @@

#3 Follow the guide as a group

Work through the Email Self-Defense guide a step at time as a group. Talk about the steps in detail, but make sure not to overload the participants with minutia. Pitch the bulk of your instructions to the least tech-savvy participants. Make sure all the participants complete each step before the group moves on to the next one. Consider facilitating secondary workshops afterwards for people that had trouble grasping the concepts, or those that grasped them quickly and want to learn more.

Even powerful surveillance systems can't break private keys when they're protected by lengthy Diceware passphrases. Make sure participants use the Diceware method, if dice are available. Stress the importance of eventually destroying the piece of paper the Diceware password is written on, and make sure all the participants back up their revocation certificates.

-

In Section 2 of the guide, make sure the participants upload their keys to the same keyserver so that they can immediately download each other's keys later (sometimes there is a delay in synchronization between keyservers). During Section 3, give the participants the option to send encrypted messages to each other instead of or as well as Edward. Similarly, in Section 4, encourage the participants to sign each other's keys.

+

In Section 2 of the guide, make sure the participants upload their keys to the same keyserver so that they can immediately download each other's keys later (sometimes there is a delay in synchronization between keyservers). During Section 3, give the participants the option to send test messages to each other instead of or as well as Edward. Similarly, in Section 4, encourage the participants to sign each other's keys.

@@ -164,8 +169,8 @@

#4 Explain the pitfalls

-

Remind participants that encryption works only when it's explicitly used; they won't be able to send an encrypted email to someone who hasn't already set up encryption. Also remind participants to double-check the encryption icon before hitting send, and that subjects and timestamps are never encrypted. See the guide's Security Tips subsection for more information.

-

Advocate for free software, because without it, we can't meaningfully resist invasions of our digital privacy and autonomy. Explain the dangers of running a proprietary system, and why GnuPG can't begin to mitigate them.

+

Remind participants that encryption works only when it's explicitly used; they won't be able to send an encrypted email to someone who hasn't already set up encryption. Also remind participants to double-check the encryption icon before hitting send, and that subjects and timestamps are never encrypted.

+

Explain the dangers of running a proprietary system and advocate for free software, because without it, we can't meaningfully resist invasions of our digital privacy and autonomy.

@@ -196,7 +201,7 @@

#6 Follow up

-

Encourage the participants to continue to gain GnuPG experience by emailing each other, and considering offering to correspond with them in encrypted form. If you don't hear from them for a couple of weeks after the event, reach out and see if they would like additional assistance.

+

Encourage the participants to continue to gain GnuPG experience by emailing each other, and offer to correspond with them in encrypted form. If you don't hear from them for a couple of weeks after the event, reach out and see if they would like additional assistance.

If you have any suggestions for improving this workshop guide, please let us know at campaigns@fsf.org.