michael/swift-mhoush.com
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Ports all existing articles and images.

Browse Source
This commit is contained in:
Michael Housh
2025-02-20 12:14:09 -05:00
parent e0fb6129ad
commit 67dc3540d6
151 changed files with 10413 additions and 1631 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
deploy/articles/2024/pgp-encryption-introduction/index.html
View File

@@ -68,67 +68,67 @@ cryptographic privacy and authentication and is..." name="og:description"/>
<img alt="banner" src="http://localhost:3000/articles/images/2024-04-04-pgp-encryption-introduction.gif"/>
<p>In this article I introduce PGP and show a use case for me, which perhaps you can use as well.</p>
<h2>What is PGP</h2>
<p>PGP stands for <strong>Pretty Good Privacy</strong>, it was first developed in 1991 by Phil Zimmermann. PGP uses<br />
<p>PGP stands for <strong>Pretty Good Privacy</strong>, it was first developed in 1991 by Phil Zimmermann. PGP uses
cryptographic privacy and authentication and is generally used in data communication.</p>
<p>According to <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy">Wikipedia</a> it’s name was inspired<br />
by a grocery store named, “Ralph’s Pretty Goody Grocery” featured in radio host’s Garrison Keillor’s<br />
<p>According to <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy">Wikipedia</a> it’s name was inspired
by a grocery store named, “Ralph’s Pretty Goody Grocery” featured in radio host’s Garrison Keillor’s
fictional town of Lake Wobegon.</p>
<p>PGP is commonly used in software development to “sign” software commits or files to help ensure both<br />
<p>PGP is commonly used in software development to “sign” software commits or files to help ensure both
who the commits were from as well as make sure they were not modified from the original versions.</p>
<p>It should also be noted that when people say PGP they are often referring to OpenPGP or GnuPGP which<br />
<p>It should also be noted that when people say PGP they are often referring to OpenPGP or GnuPGP which
are implementations of the PGP standard protocol.</p>
<h2>What it does</h2>
<blockquote>
<p>Note: I am in no way a cyber-security expert, I am a layman and only describing things in terms<br />
<p>Note: I am in no way a cyber-security expert, I am a layman and only describing things in terms
that I understand / make sense to me. Do what I do at your own risk!</p>
</blockquote>
<p>PGP offers both symmetrical encryption (uses a session key and password) or asymmetrical encryption<br />
(uses a session key and a private key). Asymmetrical encryption is more secure but is more resource<br />
<p>PGP offers both symmetrical encryption (uses a session key and password) or asymmetrical encryption
(uses a session key and a private key). Asymmetrical encryption is more secure but is more resource
intensive (which is generally not a problem with computers of today).</p>
<p>Generally speaking PGP uses what are known as public and private key pairs. The public portion of<br />
the key par is meant to be shared with others freely, while the private portion needs to be secured<br />
/ not shared with anyone <strong>EVER</strong>. It is best practice to generate your keys on a computer that is<br />
“air gapped”, meaning it is not connected to any network / internet, and does not save a history of<br />
<p>Generally speaking PGP uses what are known as public and private key pairs. The public portion of
the key par is meant to be shared with others freely, while the private portion needs to be secured
/ not shared with anyone <strong>EVER</strong>. It is best practice to generate your keys on a computer that is
“air gapped”, meaning it is not connected to any network / internet, and does not save a history of
commands performed on it.</p>
<p>PGP encrypts data (files, messages, etc.) for one or more recipients, using the recipients public<br />
<p>PGP encrypts data (files, messages, etc.) for one or more recipients, using the recipients public
key. The recipients private key is required to decrypt the data once it’s been encrypted.</p>
<p>Your key pair is tied to your identity / person, generally by your name and email(s). The key can<br />
also have multiple “subkeys”, meaning that if you have more than one public email, alias, etc. it<br />
can be tied to your same private key. This is useful for example for work vs. activism vs. software<br />
<p>Your key pair is tied to your identity / person, generally by your name and email(s). The key can
also have multiple “subkeys”, meaning that if you have more than one public email, alias, etc. it
can be tied to your same private key. This is useful for example for work vs. activism vs. software
development.</p>
<p>Once your key is generated and your private key secured, you can share your public portion of the<br />
<p>Once your key is generated and your private key secured, you can share your public portion of the
key to a “keyserver” where other people can download it and verify messages were sent by you.</p>
<h2>Web of Trust</h2>
<p>PGP also uses what is called the <strong>“Web of Trust”</strong>, which is used to validate that messages are<br />
encrypted by a trusted source. There are different levels of trust depending on where a key is<br />
retrieved from. For example, if somebody gave you their public key in person and you were able to<br />
inspect that the identity matches their government id, then you can give it a higher trust level<br />
<p>PGP also uses what is called the <strong>“Web of Trust”</strong>, which is used to validate that messages are
encrypted by a trusted source. There are different levels of trust depending on where a key is
retrieved from. For example, if somebody gave you their public key in person and you were able to
inspect that the identity matches their government id, then you can give it a higher trust level
than one that is sent / retrieved from a keyserver.</p>
<p>My understanding of this portion is that over time your key is signed by other’s with their level of<br />
<p>My understanding of this portion is that over time your key is signed by other’s with their level of
certainty about you / your key, which over time increases the overall trust in your key.</p>
<h2>Out of the weeds</h2>
<p>Now that we’ve got an understanding of some of the technical aspects, lets talk about some real use<br />
<p>Now that we’ve got an understanding of some of the technical aspects, lets talk about some real use
cases of PGP encryption.</p>
<p>PGP encryption is used by some email clients / applications, such as<br />
<a href="https://canarymail.io/">Canary</a>,<br />
<a href="https://www.thunderbird.net/en-US/thunderbird/115.0/holidayeoy/">Thunderbird</a>, or<br />
<p>PGP encryption is used by some email clients / applications, such as
<a href="https://canarymail.io/">Canary</a>,
<a href="https://www.thunderbird.net/en-US/thunderbird/115.0/holidayeoy/">Thunderbird</a>, or
<a href="https://gpgtools.tenderapp.com/">GPGSuite</a>.</p>
<p>In my understanding, it is also what is used in devices such as a<br />
<p>In my understanding, it is also what is used in devices such as a
<a href="https://www.yubico.com/">YubiKey</a>.</p>
<p>Many of the mentioned applications allow for an easier interface / adoption, as one of the reasons<br />
<p>Many of the mentioned applications allow for an easier interface / adoption, as one of the reasons
it is not very popular is that it can be hard to use PGP for the average person.</p>
<p>Aside from using my PGP key for signing software commits, my major use case is for encrypting files<br />
that I store in a “cloud” provider. Know that when someone says the “cloud”, it is really just a<br />
computer (in reality a gang of computers in a data center). You are solely reliant that these cloud<br />
<p>Aside from using my PGP key for signing software commits, my major use case is for encrypting files
that I store in a “cloud” provider. Know that when someone says the “cloud”, it is really just a
computer (in reality a gang of computers in a data center). You are solely reliant that these cloud
providers are not snooping on, inspecting, or even selling your data.</p>
<p>Of course, some data may not be that sensitive, so maybe you don’t care. However with a little bit<br />
of effort on your part you can at least make it very hard for anyone to know what is inside your<br />
documents. You can be in control of the way your items are encrypted and have confidence that nobody<br />
<p>Of course, some data may not be that sensitive, so maybe you don’t care. However with a little bit
of effort on your part you can at least make it very hard for anyone to know what is inside your
documents. You can be in control of the way your items are encrypted and have confidence that nobody
but you can access what is inside your documents.</p>
<p>Heck, I even encrypt documents that are stored on my own network / computer so that if something<br />
<p>Heck, I even encrypt documents that are stored on my own network / computer so that if something
get’s stolen or someone breach’s my network they will not be able to easily get to sensitive data.</p>
<h2>Conclusion</h2>
<p>This article is just meant as an overview of PGP encryption. In future articles I will show you how<br />
<p>This article is just meant as an overview of PGP encryption. In future articles I will show you how
to use it to encrypt your data and be in control of your privacy.</p>
<h3>Resources</h3>
<ul>
@@ -171,7 +171,6 @@ Programming, Home-Performance, and Building Science
</div>
<p>
<a href="/articles/2025/vapor-htmx-todo-app/"><div>
<img alt="banner" src="http://localhost:3000/articles/images/2025-01-05-vapor-htmx-todo-app.png"/>
Build an example application using Vapor and HTMX.
</div></a>
</p>
@@ -185,7 +184,6 @@ Programming, Home-Performance, and Building Science
</div>
<p>
<a href="/articles/2024/free-as-in-freedom/"><div>
<img alt="banner" src="http://localhost:3000/articles/images/2024-04-09-free-as-in-freedom.png"/>
Salute to open-source software engineers
</div></a>
</p>
@@ -216,6 +214,12 @@ Programming, Home-Performance, and Building Science
|
<a href="mailto:michael@mhoush.com" rel="nofollow">Email</a>
</p>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-core.min.js">
</script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/keep-markup/prism-keep-markup.min.js">
</script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/autoloader/prism-autoloader.min.js">
</script>
</div>
</body>
</html>