Erik L. Arneson — Writer and Software Developer

New PGP Key for 2018

2018-05-24T21:10:43+00:00

I’ve upgraded to a 4096-bit RSA OpenPGP key. The new key fingerprint is FB05 D043 5BA4 6C32 66AE 2F74 17D0 60A6 16EC 3D6E and you can download it by clicking on that link.

The key is also available on your favorite PGP keyserver, or through my Keybase account.

OpenPGP for WordPress Now Supports Contact Form 7

2016-01-20T16:54:43+00:00

OpenPGP Form Encryption for WordPress now supports Contact Form 7. You can download version 1.4.0 at the WordPress plugin site and start using a safer contact form on your website today!

Send Secure Email with Entrypt.to Service

2015-06-08T15:48:03+00:00

While my OpenPGP plugin for WordPress might be very helpful, the Encrypt.to service allows you to quickly send encrypted email with just one click. It looks powerful.

You can click here to send me encrypted email or visit the source code.

Security Link Rodeo

2015-05-22T20:57:00+00:00

My four-week History of Cryptography class at Portland Underground Grad School is almost over. While I’ve had plenty of experience with speaking to audiences about difficult subjects, this has been my first time with an ongoing class. I think I’m learning as much as my students! Because this class has helped rekindle my passion for cryptography and computer security, this link rodeo is going to focus on those subjects.

Crypto superstar Bruce Schneier has written a good overview of the new Logjam attack against the Diffie-Hellman key exchange protocol. If you want to test your browser and various websites against the bug, check this website. The CloudFlare blog also has a good explanation of the Logjam attack.

https://twitter.com/NSA_PR/status/601163480499093505

GNU Privacy Guard (GnuPG) version 2.1.4 was released earlier this month. Read the announcement here. The exciting thing about the 2.1 releases is that they support elliptic curve cryptography (ECC), and allow you to create ECC public keys. I still find ECC difficult to understand, but here’s a pretty good introduction written by Nick Sullivan.

Finally, back in February, Moxie Marlinspike wrote about how he hopes OpenPGP will die someday. I, on the other hand, still use it regularly and enjoy it! In fact, I’m going to encourage you to check out the FSF Email Self Defense website so you can get started with encrypting your email today. When you’re ready, drop me a line using my OpenPGP key.

The featured image for this post is courtesy of Flickr user Jaymis Loveday.

New Release of OpenPGP for WordPress

2015-05-13T18:16:07+00:00

Version 1.3.0 of the OpenPGP Form Encryption for WordPress plugin is now available. It’s important to upgrade. It includes the following changes.

Updates OpenPGP.js to version 1.0.1
Tests the plugin against WordPress 4.2.2
Ensures that the browser can support OpenPGP.js

There are a few new features planned for this plugin. Expect a major version release in the next few months.

Check out the plugin page on the WordPress Plugin Repository.

Should WordPress Encrypt All Email?

2015-04-13T15:13:43+00:00

WordPress sends out email sometimes, and it doesn’t encrypt any of them by default. Integration of WordPress and OpenPGP for a better security is a case study by Paweł Bulwan that examines the security implications of all of these emails. Are they leaking important information? Should WordPress site owners worry about them?

Only Limited Security Threats

Mr. Bulwan only found five potential security threats, which is pretty good news. None of them are show-stoppers. However, I believe he missed something important, which is that any information that is leaked about login credentials can cause issues. Leaked information can be used to limit an attacker’s problem space, reducing the complexity of an attack.

Mr. Bulwan’s idea of providing OpenPGP encryption for any emails that WordPress sends is a great one. In fact, if WordPress provided an OpenPGP API, it would spell the obsolescence of my OpenPGP Form Encryption for WordPress plugin.

That would be really cool.