https://www.readthenburn.com seems like a relatively ok option if you're dealing with someone that won't be bothered to learn how to use PGP.
And who prevents the page from storing the message forever? Promise not to do so? I call it a trap! Set up such page, then wait for all sorts of secret and confidential information + IP addresses come in such as passwords and login data, links to child porn and so on. 
Topic: Sending REALLY sensitive information - page 2. (Read 3491 times)
This generating private/public keypairs is useless, IF YOU ARE NOT GIVING IT IN PERSON.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
Um, no, it's not. Learn some crypto before you talk about it.
C intercepts request
C gives A a PGP key aliased as B
A sends message encrypted with C's PGP key
C now reads message. B has no idea a request was even made.
That can only be done if
a) You don't verify messages over a different line of communication
OR
b) Your attacker has complete control over EVERY line of communication you have
https://www.readthenburn.com seems like a relatively ok option if you're dealing with someone that won't be bothered to learn how to use PGP.
Nice, interesting solution there.This generating private/public keypairs is useless, IF YOU ARE NOT GIVING IT IN PERSON.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
Um, no, it's not. Learn some crypto before you talk about it.
C intercepts request
C gives A a PGP key aliased as B
A sends message encrypted with C's PGP key
C now reads message. B has no idea a request was even made.
That can only be done if
a) You don't verify messages over a different line of communication
OR
b) Your attacker has complete control over EVERY line of communication you have
https://www.readthenburn.com seems like a relatively ok option if you're dealing with someone that won't be bothered to learn how to use PGP.
Invent your own language.
Not safe at all. Languages all have common traits that distinguish them from random garbage. I don't remember exactly but something to do with statistics and occurrence of words. If adversary can crack PGP then also it can guess the private key spelled by HEX in invented language. 
Invent your own language.
Quote
Would there be a way for someone to MITM communications in such a way that the receiver of the information still gets it and doesn't know that it is compromised?
The both parties engaged in encrypted communication must compare the fingerprints of public keys using some other channel. Such as phone call or in-person meeting. If the messages goes trough but the key fingerprints does not match, there is women in middle attack (threesome) happening.The one time pad and picture of cat is problem because of non-randomness of random data and the random material can be easily intercepted. It is cumbersome to practical use and that's why key exchange protocols are used to establish connection.
This generating private/public keypairs is useless, IF YOU ARE NOT GIVING IT IN PERSON.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
Um, no, it's not. Learn some crypto before you talk about it.
C intercepts request
C gives A a PGP key aliased as B
A sends message encrypted with C's PGP key
C now reads message. B has no idea a request was even made.
This generating private/public keypairs is useless, IF YOU ARE NOT GIVING IT IN PERSON.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
Hmmm, good point. Would there be a way for someone to MITM communications in such a way that the receiver of the information still gets it and doesn't know that it is compromised?http://en.wikipedia.org/wiki/Man-in-the-middle_attack
Obviously, the key is getting the correct Bitmessage address for a particular person, but I've heard that Bitmessage addresses can be generated from Bitcoin addresses? That might be one way to prove ownership of a particular address.
This generating private/public keypairs is useless, IF YOU ARE NOT GIVING IT IN PERSON.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
if you're familiar with the voice of the person, I think it's pretty safe to transmit the public key via phone after having a conversation about the weather.
Send the person a picture of a cat to use as a one time pad. 
Mail them a CD with the picture of the cat that you take yourself. Email the OTP encrypted file.
I'm being a little silly this is probably overkill.
LOL.Mail them a CD with the picture of the cat that you take yourself. Email the OTP encrypted file.
I'm being a little silly this is probably overkill.
What about just mailing a password (plaintext), and then emailing a .rar encrypted file? I don't know what OTP is or how a cat picture could be used as a pad, and yes, that might be overkill for my purposes anyway.
TorChat is out-of-box solution that cannot be compromised unless Tor asymmetric encryption is totally broken or one of boxes are compromised.
Send the person a picture of a cat to use as a one time pad.
Mail them a CD with the picture of the cat that you take yourself. Email the OTP encrypted file.
I'm being a little silly this is probably overkill.
Mail them a CD with the picture of the cat that you take yourself. Email the OTP encrypted file.
I'm being a little silly this is probably overkill.
This generating private/public keypairs is useless, IF YOU ARE NOT GIVING IT IN PERSON.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
if you're familiar with the voice of the person, I think it's pretty safe to transmit the public key via phone after having a conversation about the weather.
This generating private/public keypairs is useless, IF YOU ARE NOT GIVING IT IN PERSON.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
Screw GPG, it doesn't allow long enough keys for paranoid people. Have your friend generate a 16,384 bit RSA keypair with openssl, encrypt it with the public key, and send it off.
I like it. 
Screw GPG, it doesn't allow long enough keys for paranoid people. Have your friend generate a 16,384 bit RSA keypair with openssl, encrypt it with the public key, and send it off.
Just send them a letter with a seal.
You should also make sure they burn it after they read it otherwise someone might pick it up in the bin.
Assume they live across the globe and it is not possible.
PGP encrypted mail
OTR encrypted IM chat
TorChat
The list can go on.
Let's keep it to options where we don't have to be online at the same time... but thanks for the suggestions! OTR encrypted IM chat
TorChat
The list can go on.
Jump to: