FireGPG Forum - About gpgAuth

Re: About gpgAuth

dummy@example.com (the_glu) — Mon, 16 Mar 2009 16:17:02 +0000

The way I see it: I will remove a feature and receive 10 mails from angry users

> Why not talk to each other and share notes at least ?

I'm already too busy to develop firegpg, I won't begin to communicate with another person to develop some feature in common as I can't develop firegpg himself

Re: About gpgAuth

dummy@example.com (dkg) — Mon, 16 Mar 2009 05:26:40 +0000

> Why?

The way i see it: if a protocol has no active upstream support, no advocate, no formal specification, no development community, and no way of responding to reasonable concerns, then implementations of that protocol probably do not belong in a piece of user-facing security-critical software. At least not without big shiny red warning flags all around any and all UI related to where it might actually be used (and even that should only be possible after ticking a checkbox that can only be found in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard')

> No.

It seems like Enigform and FireGPG do some similar (though certainly not identical) tasks. They both do some incredible work behind the scenes to help Firefox talk to GnuPG, both potentially deal with Web of Trust issues, both ask the user for their GPG passphrase, and both deal with potential signing of sensitive data. Why not talk to each other and share notes at least?

Re: About gpgAuth

dummy@example.com (the_glu) — Mon, 16 Mar 2009 05:09:38 +0000

> perhaps support for gpgAuth should be dropped from FireGPG ?

Why ? Maybe he could be usefull

> Are you guys in discussion with buanzo (the author of enigform) ?

No.

Re: About gpgAuth

dummy@example.com (dkg) — Mon, 16 Mar 2009 02:48:47 +0000

I found a discussion on enigform's forum that suggests that Kyle Huff (the original gpgAuth author) is proposing abandoning gpgAuth entirely in favor of enigform and apache's associated mod_auth_openpgp. another post suggests that he has in fact joined the enigform team As such, i plan on moving my cryptographic review to that suite of tools, and suggest that people avoid using gpgAuth entirely unless more information is forthcoming.

If you don't know how to reach the gpgAuth author, and he seems to have abandoned his own project, perhaps support for gpgAuth should be dropped from FireGPG ? Are you guys in discussion with buanzo (the author of enigform) about the ways your respective tools could work together?

Re: About gpgAuth

dummy@example.com (dkg) — Sun, 15 Mar 2009 22:32:40 +0000

Thanks for your quick followup, the_glu. If i find anything out that's relevant to firegpg, i'll post it here.

Re: About gpgAuth

dummy@example.com (the_glu) — Sun, 15 Mar 2009 21:28:46 +0000

> do you have another way i should contact him or her?

> can you explain more about why that wouldn't be a risk for users of firegpg?

They have to confirm any gpgauth action

Re: About gpgAuth

dummy@example.com (dkg) — Sun, 15 Mar 2009 21:05:14 +0000

I've tried to contact the author by posting on the forum, but didn . do you have another way i should contact him or her? whois suggests that he's named "kyle huff", but the main kyle huffs i found online was someone who went on shooting rampage in seattle a few years ago

And i'm concerned not just that gpgauth is spoofable (i wouldn't trust it anyway), but that gpgauth support in firegpg could potentially allow for abuse of the user's keyring by a remote server which prompts for gpgauth activity.

can you explain more about why that wouldn't be a risk for users of firegpg?

Re: About gpgAuth

dummy@example.com (the_glu) — Fri, 13 Mar 2009 21:34:13 +0000

Hi,

I'm not the auther of gpgauth, and if there is any security problem with gpgauth, it's wont affect the rest of firegpg

I sugest you to contact the author of gpgAuth

Re: About gpgAuth

dummy@example.com (dkg) — Fri, 13 Mar 2009 21:11:47 +0000

I recently raised significant problems and concerns with the gpgauth protocol on the gpgauth forums, and only got a response from someone who does not appear to be an author of the site.

Is fireGPG's gpgauth support vulnerable to the concerns i raised there?

Re: About gpgAuth

dummy@example.com (the_glu) — Sat, 29 Nov 2008 06:36:31 +0000

Hi,

I don't know

Regards,

Re: About gpgAuth

dummy@example.com (Eva) — Sat, 29 Nov 2008 03:22:22 +0000

Hello,

Tried to follow the links to both the GPGauth write-up and the gpgauth.com site, but both links appear broken.

What is the current status with GPGauth and where can I find the latest GPGauth-related code and docs?

Thanks in advance,

Eva

Re: About gpgAuth

dummy@example.com (Faramir.cl) — Sun, 11 May 2008 20:07:08 +0000

sbkolluru wrote:

How to add the plug in firegpg.xpi to firefox bowser?

Just drag it into a firefox window....

Re: About gpgAuth

dummy@example.com (the_glu) — Tue, 05 Feb 2008 16:01:20 +0000

Did't understand.

Re: About gpgAuth

dummy@example.com (sbkolluru) — Tue, 05 Feb 2008 13:46:39 +0000

How to add the plug in firegpg.xpi to firefox bowser?

About gpgAuth

dummy@example.com (the_glu) — Sun, 24 Jun 2007 19:07:01 +0000

We have posted a write-up that talks about what gpgAuth is and how it works. You can visit it here: http://www.gpgauth.com/#what_how
We are working on getting a writeup that explains how to implement it. It should be available sometime Monday, June 25th, 2007.
The forums are open now as well, so feel free to ask some questions.
The gpgAuth Team - www.gpgauth.com