Slashdot Mirror
Ask Slashdot: How Do I Request Someone To Send Me a Public Key?
First time accepted submitter extraqwert writes "An organization wants me to send them my personal data by email. I certainly do trust them. However, I would like to politely ask them to send me their public key for encryption. The secretary probably does not know what it is. But they do have a pretty good IT department, so they can figure out. My question is, what is the proper wording for such a request? What is the right terminology to use? Should I say ``please send me your RSA key''? ``Public key''? ``PGP key''? Is there a standard and reasonable wording for such a request? (On my end, I am using GNU PGP: http://www.gnupg.org/ ) Any suggestions on how to be polite in this case?"
Simple and expected processes like this need to be made truly dead simple and nearly automatic. Instead, there are a ton of different formats for keys depending on which the usage and you need to understand a significant amount about what's going on under the covers to do even these kinds of simple actions.
Incidentally, here's the answer to the question. It's anything but clear, but likely to be clearer than any answer you get here.
The recipient will decrypt you data and lose it or possibly misuse it. That is the risk. But by all means ask for a secure way to get the data to them.
http://michaelsmith.id.au
If the secretary can find somebody to decrypt your info, she will handle it improperly. Probably scan it directly to their compromised CMS. This is not a company you want to work for.
Help stamp out iliturcy.
Attend or organize a key signing party.
Questions raise, answers kill. Raise questions to stay alive.
If they need the information they should have a secure way to receive it. I just refinanced, the broker had a secure site (SSL password protected file vault type interface hosted on their own servers) with a web interface that I could upload documents to.
If they don't have such a system in place already and routinely request and access peoples personal information your trust is severely misplaced.
How Do I Request Someone To Send Me a Public Key?
I prefer signal fires myself.
PGP is beyond the grasp of the average secretary or other end user. Unless you know for a fact that the person disseminating the data is familiar with PGP; you should probably not be asking them for their public key.
I strongly recommend an encrypted PDF, Word Document (.DOCX), or Excel file (.XLSX); make sure to choose a strong password.
I like the Office 2010 strong encryption and use of key stretching to make brute force password attacks hard --- but there is a free of charge reader available for PDF documents, and you should pick a strong password for encrypted documents anyways.
Technically, you could implement DRM rights management services on your end, so the user has to contact your organization's RMS server over HTTPS for a license every time the document is opened, but it requires a trust relationship between orgs, or you having an account for the user.
But the simple password protection is a very nice way to protect it. You can include a note in the e-mail message that you will be calling them to give them the password, so they can see the document.
Then there is no confusion about what a 'PGP key is'. If you _regularly_ exchange a lot of documents with them, then you might ask to discuss using PGP
I ran into this situation very recently, im in the process of buying a house. It was a bit of a shock to me how much personal information they wanted. And most through email. And how my data is being passed along from business to business without good security.
I use good practices on my side like two factor authentication, and ssl on everything, even a bit of pgp. But the other side who knows.
You are better off just asking for "A secure means to submit your information" and list a few you are happy to use, Maybe they will send you a public key for secure email, maybe a secure web site or maybe they will just say if you are concerned you can get it couriered to them. If they are confused then chances are they have no system in place for dealing with the request and hence not even secure email is any good as that only protects the data in transit which they will certainly load into some HR system somewhere after it gets there anyway.
If you don't have the social skills to phrase a polite question, Slashdot is perhaps not the ideal place to go looking for advice...
Technical issues with giving anyone your private key aside (I can't think of any reason to give it out to someone no matter how much you trust them) just explaining things clearly should work for any reasonable person:
"I have no problem with you having my personal key, but I am concerned about the integrity of the data while in transit. I would appreciate it if you can supply me with a public key for your organization, then I will be able to encode my key so that only you can decode it. This will ensure that our mutual privacy won't be at risk due to using an insecure communication system such as Email. Thanks very much!" etc
Perfectly Normal Industries
If the data is important enough to encrypt then the public key is important enough to get properly. Asking the person who answers the phones to send you the key is not properly. Even asking the IT department to send it probably isn't good enough as they are in the perfect position to give you their fake key, intercept the email, decrypt it, then re-send it with the real key to the real recipient.
If you are just worried about casual snooping of your "personal data", then just use something like 7zip and provide them with the password out-of-band.
So now a random guy in the IT department has the data, as well as the intended recipient, who then forwards it on in plain text to the PA of the guy who wants it.
I'm sorry to say, but the simple fact of the matter is that PGP/GPG isn't used anywhere in corporate life. Not even in banking-related companies.
For one, people don't perceive email as something that can easily be snooped, and if they do they'll think it's something like a chance encounter as if it's a regular piece of mail where you have to be at a certain point at a certain time to be able to snatch the mail, plus have to have a reasonable idea what you're looking for as a mail thief.
Secondly, and I cannot stress this enough, it's a f'ing drag to use. It's not easy to install. It's not easy to set up, and it's far from user friendly on a day to day basis.
Besides the fact that email encryption isn't commonplace, as long as you aren't sending you pin number or medical data on a regular basis (daily), why bother to be honest. You'll get a stamp as "that weird guy" if you start about PGP etc, and that'll last. If you want to send it securely, just wrap it in an encrypted container, like a ZIP or RAR file and phone them the password.
Manuals are your last resort only
"An organization wants me to send them my personal data by email."
"But they do have a pretty good IT department"
No. They don't. Or their IT department is seriously underpowered in terms of getting through to their staff. Don't send personal data by email. If they don't have a system to let you do this (e.g. secured web form, etc.) then their IT department is already a bit of a failure. If they do, their staff would use it and tell you about it.
If you want to ask, just ask. "I'm not going to send personal data by unencrypted email - what is your procedure for encrypted email?"
Chances are, they won't have one and will just ask you to send the details unencrypted or by another method entirely.
This.
Ideally, Public keys should be exchanged in person, or be obtained by a third party that you trust.
Failing that, a public key for some company or person with whom you wish to send encrypted email can often be found on their website. And if its been there for a while, and can be verified by a key server, then it is probably good enough to send them encrypted mail with, but you still don't know for sure who they are.
But at least you know that what you send won't be seen by every prying eye along the route.
But the sad part is that 98 percent of the companies you might deal with haven't a single clue what a public key is.
In my day job we've had our public key published on our Web site for 10 or more years, and get maybe one or two emails a year, usually paying by credit card, from cluefull people.
Once set up, all the major email packages can handle pgp. Shame on them for making it an add-on, but its still available, even for gmail and Hotmail, etc. Just stay away from their web interface and set up a decent email software. You can find these even for Android.
Sig Battery depleted. Reverting to safe mode.
We need some developers to setup-in and develop in-browser Firefox/Chrome extensions (or userscript, or whatever) that seamlessly integrate encryption into popular webmails.
You see plain text on the screen, but what actually goes into the "textarea" of the form is encrypted.
There are already javascript "Rich Text Editors" which do similar jobs (you see a nicely formated text on the screen, but its HTML/BBCode/WikiCode going into the textarea). We simply need something similar, but for encryption and packed into the browser itself through extension mechanisms.
(Note: Proper security comes from *end to end* encryption. It's therefor mandatory that the encryption/decryption layer is something that the end users install on their browser, and not something provided by the webmail site, even if it's client-side script code. Though it would help if webmail sites provided a few hooks or micro format to simplify the plugin of the encryption layer).
Bonus point if someone else manage to do the same with OTR and webchats.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
this is really important. people who don't know what ssh keys are will typically send you the id_rsa (private) key file.
IT IS VERY IMPORTANT that you say to them EXPLICITLY and VERY CLEARLY, "please send me the public key file *only*. DO NOT send me the PRIVATE key. you can identify the private key because it is named xyz. i ONLY want you to send me the PUBLIC key, it is named xyz.pub. if you send me the private key, you will have to destroy it and we will have to start again, so ONLY send me the PUBLIC key, ok?"
and get them to acknowledge what you've said. do not be afraid to "piss them off" by having to be so absolutely specific. make sure you end the sentence with what you *want* them to do, *not* what you *don't* want them to do. depending on the person they could potentially remove the "negative" by their subconscious and do exactly what you ask... with the words "no", "not", "don't" etc. removed.
also if you want to be paranoid then use the signature-thing (fingerprint). get them to read it out to you over the phone (not by email).
Just imagine if we had some system were you could cryptographically secure DNS values, and some defined TXT record were you could expect to get an organizations public key.
This would work nicely because the client could safely and automatically fetch the key, encrypt the message, or just sign it. It would then be ciphered at least as far as the last hop publicly exposed mail server, safe from prying eyes at your ISP, their mail rescue service, etc.
Sure it only works for org level keys, but it would be an easy step in the right direction
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I use www.djigzo.com. It's open source, it uses S/MIME, it's server based, and it's easy to use.
no, I don't have a sig
I'm not sure if you're being sarcastic, but I searched and found this: http://tools.ietf.org/html/rfc4398 "Storing Certificates in the Domain Name System (DNS)"
GPG supports it! http://www.gushi.org/make-dns-cert/HOWTO.html
It works for emails -- alice.example.org is for alice@example.org.
Type the reply on a Royal typewriter and take it to your local post office. Use Certified or Registered mail if you feel squeamish about sending personal information. The NSA can't open a properly mailed letter.