PGP

airtight privacy

Created: | 450 words | 3 minutes

A bunch of pseudo-random symbols that you see on the homepage is my PGP1 public key fingerprint.

PGP
f42fb7d5027d2a7a47df1cf0c6220b8e9c56218e

That means I possess a corresponding private key that I use to decrypt messages sent to the public one. The idea is that anyone can download my public key and use it to send me something securely2.

Asymmetric cryptography y’know...

I’ve explained the basics of it in this blog post . Long story short, it’s used everywhere:

  1. in banking (smartcards, SWIFT)
  2. internet security (TLS/SSL, HTTPS), email (PGP/S-MIME), VPNs
  3. cryptocurrencies (ECDSA/EdDSA curves)
  4. some e2ee3 messaging apps (Signal, Telegram secret chats)
  5. software distribution (OS update verifications, IOS/Android APK signing), DRM4 modules and military applications...

Without a doubt, cryptography is deeply integrated in our lives and it’s very easy to take control over, to utilise it in an own, non-custodial way. I encourage everyone to dive into it and use whenever possible.

On Linux

Import the key to your local keyring:

sh
curl https://yuri.ag/pubkey.asc | gpg --import

To encrypt a message (once you have the recepient’s pubkey in your keyring) use

sh
gpg -r recepient@theirdomain.com -ae yourfile.txt

To decrypt a file someone has sent you (assumed that you have a personal key pair configured)

sh
gpg -d yourfile.txt.asc

That’s some basic functionality of GPG, but you can dive deep and configure a lot of usefull stuff like SSH login support, hardware keys, etc.

On Android

  1. Download the key
  2. Install Open Keychain . Interface there is very intuitive.
  3. Import key from the file you’ve downloaded, confirm that fingerprints match2
  4. Encrypt any message/file and send the result back to me via any public channel.

On IOS

  1. Install PGPony (with a decent four 5-star rates). I had briefly tried it on someone else’s IPhone and it worked pretty well tbh, but the trustworthiness I cannot confirm
  2. Generate a key on the landing page
  3. Import my key
  4. Encrypt anything with me in recepients, optionally sign, share the encrypted result via any public channel.

  1. PGP (Pretty Good Privacy) is a commonly used standard for public key encryption of all kinds. In simple terms, PGP provides us a way to communicate with people on the other side of the internet and be sure that our messages hadn’t been intercepted, nor tampered. ↩︎

  2. However, for 100% certainty, better confirm the fingerprint in person (it has to be made just once, since my master key doesn’t have expiration date and subkeys can be reissued later without a need to update the public key). ↩︎ ↩︎

  3. end to end encryption ↩︎

  4. Digital Rights Management modules - hardware that’s preinstalled in every modern PC/smartphone that lets corporations feed your device some Netflix film without a trivial way to capture the content (intended against piracy). ↩︎