Leace

> Which is why most distributions and other projects has moved to WKDs for key discovery.

Yeah, WKD is a first-class citizen in GnuPG. Creating signatures with "--sender $EMAIL" embeds e-mail in the signature and then gpg --auto-key-retrieve --verify will fetch the key via WKD without the need to touch keyservers.

You may be interested in https://indieauth.com/pgp

On first sight this looks interesting but Keybase is years ahead in the UX polish. E.g. on Keybase it's easy to see and add new proofs without a CS degree.

Allow self-signed certs and build reputation as usual. This would still require effort from indie devs to build reputation but as soon as more people start using your app the dialogs disappear. You don't need domain name, anyone can generate self-signed certs.

One variation of this scheme is making Microsoft the CA that issues certs for free with some issuance limits.

For the record Google uses self-signed certs for Android apps.

Germany already experimented with a couple of hosted open services: https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-such...

The Conversations.im team also leaves in Germany so I wonder why won't they just utilize their own solutions? Or maybe that's being considered...

For the record there are quite a few new algos in GPG, most notably ed25519. While RSA 7680 offers 192 bits of security [0] ed25519 on the other hand is offering 128 bits of security. GnuPG 2.3 will have ed448/goldilocks available [2] and that should offer 224 bits of security [3] so in theory it should be better than RSA 7680.

I don't mind putting my encrypted passwords in a private GitHub repo but I understand the concern.

[0]: https://crypto.stackexchange.com/q/8687

[1]: https://en.wikipedia.org/wiki/Curve25519

[2]: https://lists.gnupg.org/pipermail/gnupg-users/2020-March/063...

[3]: https://en.wikipedia.org/wiki/Curve448

> In general I'm not sure how the YubiKey stores keys and till now I had no idea you can backup YubiKey

Well, actually you can't. You can backup keys if you create them in software and then just copy then to YubiKeys instead of moving them there. If you do that in an offline computer there is no risk of any malware stealing your keys in mid-process: https://news.ycombinator.com/item?id=21701488

Setting up Yubikey and OpenPGP took me some time reading all resources on the net but once done this is just working without any hiccups.

> I'm not sure about storing the master keychein file in Git, but the workflow sounds interesting (I didn't fully understand the paragraph though).

If it's encrypted there is no much harm to be done here. The only leaking info is that by default pass uses filenames based on domain names so if you have credentials for news.ycombinator.com they'd be in "news.ycombinator.com.gpg" file. For me a private repo for this use case is OK.

Oh, there is a browser extension too: https://github.com/browserpass/browserpass-extension#browser...

> This is next level and not of immediate interest to me. I was looking at something simpler like: https://cryptomator.org/

Yep, I do store external disk passwords in pass too. Udiskie can use a decryption command so when I put something like this in the config: `password_prompt: ["pass", "devices/{id_uuid}"]` it will grab the password from password store. This has an added benefit that I won't forget the password (it's stored alongside all others) and it's always valid (it's checked on each boot by udiskie).

Err, nope, this is a work-in-progress.

What are you especially interested in? Then I can provide you with details.

Some random links I used:

- https://btrfs.wiki.kernel.org/index.php/Incremental_Backup

- https://blog.eleven-labs.com/en/openpgp-secret-keys-yubikey-...

- enable touch-to-use so even malicious software cannot access your passwords: https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...

- https://www.passwordstore.org/

- https://play.google.com/store/apps/details?id=dev.msfjarvis....

- https://aur.archlinux.org/packages/mkinitcpio-gnupg/ (I'm thinking on replacing this with PKCS#11, more keys to manage but PKCS#11 is supported natively with systemd so one less dependency).

Hmm... maybe I should really document that...

> Maybe write down my master password and put it in a safe?

Isn't this just moving the goalpost because what if you forget safe combination?

> Without compromising your security - I'd love to know how others approach their personal IT security challenges?

Most of my security is based on OpenPGP keys stored on a Yubikey. In case the first one is broken/lost I've got another one. If both are lost there is a master copy on an offline computer that can be used to provision more Yubikeys.

The key unlocks access to passwords stored in pass. Because pass is based on git and gpg can be used to access SSH then the same yubikey is used to pull/push changes to pass and read encrypted passwords. On both the laptop and the phone (Password Store).

Data on the computer is LUKS-encrypted, unlocked by the Yubikey. Full backup of my laptop's SSD is done via btrfs send/receive to a raid1 array of 3 disks (raid1c3) on a regular intervals. A small subset if very important data (documents) is also backed up via restic to S3 and Backblaze.

I try to "backup" as much of my work as possible by releasing it as open-source (where it's preserved by the Github etc.) or publishing it on a web-site (where it's preserved by archive.org).

> In a similar vein: what happens to my data after I die? How would my (non-technical) family be able to access my pictures and writings? A digital inheritance would be prevented in my security set if I don't prepare.

I've been thinking about this lately and maybe it's not a popular opinion but... would people really need your data when you die? I get access to photos (my SO has the PIN code) but everything else? Maybe this is just digital junk? Who would enjoy browsing terabytes of my data looking for... what exactly?

There is no separation of "us" vs "them" and if for your own benefit everyone should be satisfied. See also "Think win-win" from 7 habits: https://en.wikipedia.org/wiki/The_7_Habits_of_Highly_Effecti...

It's still a thing for people that started using it when it was the latest Google chat product. It may be surprising but people just want stable chat experience not chasing whatever next product Google releases or kills next year.

(I did migrate my family and friends to self hosted XMPP server as Hangouts doesn't have E2EE)

> We do not allow anonymous users (i.e., without a Google Account) to join meetings created by individual accounts.

This quote from the linked post would suggest otherwise.

Yeah... I guess a little bit it does. Keybase offers an alternative to Web of Trust that kernel.org itself uses (https://www.kernel.org/doc/wot/). Keybase solution is having multiple social-proofs instead of the Web of Trust. Sadly this is unnecessarily centralized but I've seen approaches to implement Keybase-like social proofs systems in pure OpenPGP: https://github.com/wiktor-k/openpgp-proofs#openpgp-proofs

> It was a fun little giveaway experiment funded by someone else, in the spirit of the company's focus on cryptography.

It was not "someone else". Keybase is directly funded by Stellar (source: https://keybase.io/blog/keybase-stellar) and the crypto offering was just a PR/marketing move to increase adoption for crypto of Stellar not something "in the spirit of the company's focus on cryptography".

To be honest even PGP signing has some issues: it's not clear what does it mean to sign a commit and there is plenty of misuse of that (see [0], `git push --signed` solves some of these issues).

Git patch workflow doesn't support signed commits and some kernel devs explore alternative ways of signing [1].

[0]: https://mikegerwitz.com/2012/05/a-git-horror-story-repositor...

[1]: https://people.kernel.org/monsieuricon/introducing-b4-and-pa...

By "keybase providing alternative" do you mean that they have hosted, encrypted git repos?

> Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp.

Why keybase? Reading their crypto page (https://keybase.io/blog/crypto) leaves the impression that they took PGP and embrace-extend-extinguished it...

Interesting pattern, first time I saw this:

        switch (true) {
            case cellA > cellB: return 1;
            case cellA < cellB: return -1;
            case cellA === cellB: return 0;
        }

Source: https://htmldom.dev/sort-a-table-by-clicking-its-headers

> I still use RSA mainly because Yubikey doesn't support them yet with OpenPGP keys.. I felt the increase in security usage was a worthy compromise to using RSA with a key length that's not yet broken.

It does, but you need a more recent Yubikey with firmware 5.2.3 or later: https://support.yubico.com/support/solutions/articles/150000...

This is nice if you don't have a GitHub account. Otherwise you can watch the repository with "releases only" option and it will send you e-mail notifications.

What jurgemaister said. If you don't have another trust mechanism (like Web of Trust) to validate if this is a correct key then HTTPS gives at least some assurance that no intermediaries between you and avast changed the key material.

Very nice writeup!

It contains a link to Avast's Coordinated Vuln Disclosure site: https://www.avast.com/coordinated-vulnerability-disclosure and this has a link to Avast PGP key that's served via unencrypted HTTP: http://virfile.avast.com/viruslab/avast-bugs-pgp-key.txt Not only that, the key is a weak 1024 bit DSA key :(

I'm using Dino daily and it works well and looks modern. It still has minor issues here and there but it's finally a desktop client I can recommend to my non-technical friends.

One question though: is Windows version planned?

IMO this is a limited view on what students need to learn to be valuable on the market. Delphi teaches you the value of experimentation through small feedback loops. For novices that just start programming this is critically important.

Totally agreed. I was fortunate enough to start real programming with Delphi 5 (and then 7). Nowadays I know dozens of languages and frameworks but nothing comes close to the experience of quickly prototyping apps that at the end looked good, didn't need any dependencies and were super-small.

Another benefit was that it was possible to interoperate with low-level Win32 API and the enormous component library provided by third-party authors.

Not only that but Delphi has tremendous educational potential due to fast feedback loops. There was a blog post once on HN where one of Delphi authors discussed how they designed IDE and the language to be friendly for newcomers.

One could ask why not invest in https://www.lazarus-ide.org/ instead of commercial Delphi though?

> I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it.

The same way physical keys protect your home even when you lose them - you have spare keys for that event.

From your linked source:

> To me this is almost equally offensive as a swastika

Sigh.

format=flowed is a reasonable middle-ground: https://joeclark.org/ffaq.html

Subscribe to this issue: https://github.com/mozilla-mobile/fenix/issues/5630