Le forum était en panne (vendredi 31 août 2012 : 12h50)
Vous pouvez poster ici, en attendant…
En direct du Forum
- @sebman sebman
Ca n’a pas l’air mal.
Y a t’il un client graphique ? C’est mieux que les tunnels SSH ?
- @addikt1ve vincent
Il existe des tas de solutions de synchronisation pour tenir un répertoire commun entre plusieurs postes. Un problème récurrent est celui du partage de fichiers à sens unique.
Je découvre aujourd’hui une solution excessivement efficace : magic-wormhole.
Après avoir installé le paquet, on initie l’envoi d’un fichier ou d’un répertoire de la manière suivante :
wormhole send fichier_à_envoyerOn obtient en échange une sorte de mot de passe à usage unique, compris dans la commande à taper sur l’ordinateur cible :
wormhole receive 3-quantity-deckhandÀ noter qu’il n’y a aucune configuration préalable requise au niveau de votre pare-feu : Debian fournit un serveur relai qui s’en occupe à votre place (magic-wormhole-transit.debian.net).
La sécurité a l’air d’être plutôt carrée :
The wormhole tool uses PAKE “Password-Authenticated Key Exchange”, a family of cryptographic algorithms that uses a short low-entropy password to establish a strong high-entropy shared key. This key can then be used to encrypt data. wormhole uses the SPAKE2 algorithm, due to Abdalla and Pointch1.
PAKE effectively trades off interaction against offline attacks. The only way for a network attacker to learn the shared key is to perform a man-in-the-middle attack during the initial connection attempt, and to correctly guess the code being used by both sides. Their chance of doing this is inversely proportional to the entropy of the wormhole code. The default is to use a 16-bit code (use –code-length= to change this), so for each use of the tool, an attacker gets a 1-in-65536 chance of success. As such, users can expect to see many error messages before the attacker has a reasonable chance of success.
Bons transferts !
- @addikt1ve vincent
Au-delà des problèmes des serveurs de clefs, un article revient sur les défauts historiques de PGP en tant que standard, et de GnuPG en tant qu’implémentation.
Quelques extraits :
You can have backwards compatibility with the 1990s or you can have sound cryptography; you can’t have both .
There are, as you’re about to see, lots of problems with PGP. Fortunately, if you’re not morbidly curious, there’s a simple meta-problem with it: it was designed in the 1990s, before serious modern cryptography. No competent crypto engineer would design a system that looked like PGP today, nor tolerate most of its defects in any other design. Serious cryptographers have largely given up on PGP and don’t spend much time publishing on it anymore (with a notable exception). Well-understood problems in PGP have gone unaddressed for over a decade because of this.
Encrypting EmailDon’t.
Email is insecure. Even with PGP, it’s default-plaintext, which means that even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). PGP email is forward-insecure. Email metadata, including the subject (which is literally message content), are always plaintext.
PGP begs users to keep a practically-forever root key tied to their identity. It does this by making keys annoying to generate and exchange, by encouraging “key signing parties”, and by creating a “web of trust” where keys depend on other keys.
Long term keys are almost never what you want. If you keep using a key, it eventually gets exposed. You want the blast radius of a compromise to be as small as possible, and, just as importantly, you don’t want users to hesitate even for a moment at the thought of rolling a new key if there’s any concern at all about the safety of their current key.
- @lobahi bacquias laurence
Merci. Je vais faire la semaine prochaine après le départ des petits enfants…sinon j irais au centre des abeilles.
Archives
Tags
acta
arcade
atelier
Blender
bouffe
Brasparts
Brest
Briec
censure
colère
Concarneau
conf
CSdesAbeilles
CybercoPaysGlazik
CyberPlogo
DZ
démo
econet
finix
GameCompo
Geocyclab
Gouesnac'h
hackerspace
initiation
installparty
jfl2010
LAN
Landrévarzec
La Quadrature du Net
lastlundi
LibreàQuimperlé
micromaniac
MPT-Kerfeunteun
OrdislibresdelArrée
plogonnec
projet
Présentation
quimper
Quimperlé
redistribution
rosny.me
Saint-Cadou
Sizun
stand
Ulamir
Sapristis !
Le forum est revenu.