vx17h
Joined 10 years ago
Karma
29
Submissions
15
Member since
Oct 29
Recent submissions
Comment · 10 years ago
Here you have an overview: https://pep.foundation/pep-software/index.html
Comment · 10 years ago
Well, first of all: does it work now with Enigmail v1.9.5? That would be good sign already. We will have to try ...
Comment · 10 years ago
Messages from or to a contact can also show red, I forgot to mention, if the user decides that the key pair used by that contact is not trustworthy. That can make sense if you see from the contents of a message (and subsequently perhaps by a phone call, adding evidence to that) that someone's in between or the key pair in place is not really belonging to the contact, but made up.
Comment · 10 years ago
That should be possible, because IMHO Postbox (as a fork) also works with Enigmail.
Comment · 10 years ago
In p≡p there's both, automatic key management and a KeySync protocol (yet being tested, not activated already) to sync private key material across the devices you want to read the same messages on.
See the source code on that:
- https://letsencrypt.pep.foundation/trac/browser/asn.1
- https://letsencrypt.pep.foundation/trac/browser/sync
As you say correctly, of course you've to take care: as a common denominator an id is used, in case of e-mail a certain mail address, whose e-mail channel for communicaion functions as the key exchange channel, too (meaning the devices send themselves messages ("beacons"), which are considered as technical messages by the p≡p engine and thus never shown to the user as such).
=> If you fear to have a cell phone hacked or lost, it's better to not put that in a device group. Also you can seperate business from private accounts or have different accounts and on top of that aliases for whatever purposes, referencing the same id (mail address). In short: you can have (like mostly today) no device group at all or just different device groups meeting your needs and "paranoia levels" (based on the trust you put in your devices).
The devices agree on a device group key pair, being the master key pair, still they sync all devices' private keys for that specific id, such that you can read all of your messages received on all of your devices (even if there were changing pubkeys in between used for encryption, because of your different devices, which were not yet synced in the past).
If a device is lost or stolen, that has to be manually signalized by one of the other devices in the device group and then the devices have to agree on an new device group key pair to encrypt their future communications (we're talking of PGP encryption here, so no forwad secrecy).
Comment · 10 years ago
Yes, there's a Privacy Status in p≡p, there being four different states: no color (mostly today: insufficient crypto, weak crypto, unknown), yellow/orange for accepted, transparent and well implemented crypto, green for crypto avoiding the MITM (Man-In-The-Middle) possibility (after the involved peers checked their Trustwords and accepted them to be trustworthy) and red if the p≡p engine detects an attack.
Cf. the documentation for screenshots how this looks (nowadays): https://prettyeasyprivacy.com/docs
Comment · 10 years ago
Yes, the public key is just attached to the outgoing messages and automatically imported by p≡p-capable software.
That's kind of a TOFU (Trust On First Use) approach, but you can verify trust by comparing the fingerprints, in p≡p by default represented as dictionary words in your natural language (somewhat similar to Signal). That's suitable for comparison by phone (=> quickly done).
Comment · 10 years ago
Keep a close eye at the pretty Easy Privacy (p≡p) project.
It provides an engine (written in C99) and adapters for the most important environments, in order to automatize key management and message transport.
It'll be the default way to automatically encrypt e-mails in Enigmail, where most OpenPGP traffic emerges from, anyways: https://twitter.com/pEpCouncil/status/791948659378106368
But that's just a start, as p≡p wants to transfer all text-based communications anyhow into the censorship-resistant, peer-to-peer GNUnet (using OTR or Axolotl crypto).
Cf. White Paper of p≡p: https://pep.foundation/docs/pEp-whitepaper.pdf
(Wikipedia article on p≡p showing its broad approach: https://en.wikipedia.org/wiki/Pretty_Easy_privacy)