grass presentation

grass · November 4, 2022, 5:59pm

I am grass.

This message was signed with the code subkey.

The master key is certify only and each subkey has a designated purpose:

Code will be signed using the signing only subkey 0x9600F4102964D725.
Mail will be signed and encrypted using the subkey 0xA52A3178DD0A27C1.

The subkeys are stored separetely, if one subkey is compromised, does not
mean all subkeys are compromised. If the master key is compromised, distrust
the identity entirely.

Readers, do not accept unsgined code or code that is signed under a
different subkey than the one mentioned above.
Readers, do not accept usigned mail or mail that is signed under a different
subkey than the one mentioned above.
Prefer mail encryption when possible.

My public key is purposefully not uploaded to keyservers, do not trust
keyservers.
Instead, I am relying on this key being available on multiple locations to
be verified crossing different sources:

https://forums.whonix.org/t/grass-presentation
https://github.com/the-grass/the-grass/README.md

My public key:

grass · November 4, 2022, 6:03pm

I am open to contribute.
My github account is flagged because of creation over Tor, so public view not yet available.

Other accounts created by grass:

Whonix wiki
Kicksecure Forum
Kicksecure Wiki

Patrick · November 5, 2022, 2:20pm

Encrypted to whom? How to decrypt that message? Did you intent to write a signed message instead?

Would

be a good first task to get started?

grass · November 5, 2022, 7:34pm

Just copy the PGP MESSAGE BLOCK and the PGP PUBLIC KEY BLOCK, import the public key and verify and run gpg -d file.

GPG names are confusing but that is a signature made with --sign and --armor. If it was made with --clear-sign, it would show what you normally expect PGP SIGNED MESSAGE. Because of pgp formatting, I couldn’t include the public key and make a clear sign because pgp itself changes the header - --- for PGP delimiters, making the message be verified but the public key not being able to import.
If on the other hand, I didn’t sign the public key, which was not necessary because the message is signed by it, then --clear-sign would be possible.

Yeah, doable for me. Thanks.

h3xagonal · November 8, 2022, 3:50am

GitHub might flag accounts it suspects are precursors to malicious usage.

Good news. As long as the email used to create account is accessible it should be possible to contact GitHub support and get flag removed.

Thank you

Patrick · November 8, 2022, 11:10am

grass · November 8, 2022, 2:43pm

Good news. As long as the email used to create account is accessible it should be possible to contact GitHub support and get flag removed.

That is true, I 'd just like to avoid having to hop mail server every
time some third-party is unhappy with privacy. Thanks for the reply.

h3xagonal · November 12, 2022, 3:44am

Is contact by PM on Whonix forum ok? Just want to discuss some things.

Thank you

Patrick · November 12, 2022, 5:43am

h3xagonal · November 13, 2022, 9:03am

Reasonable conclusion. In hindsight even if PMs were enabled I would only suggest utilising them to facilitate a more private means of communication.

Having said that @grass - what would be the idea means of contact in private?

Thank you

grass · November 13, 2022, 11:41am

If you really think it is necessary, import my public key from the first post and you will see the contact address.

grass · November 13, 2022, 7:13pm

Also what Patrick mentioned above (link format):

Please avoid private communications whenever possible. Whonix ™ is a Freedom Software project. Free as in Price as well as in Freedom. (Why?) Therefore as many communications as possible should happen in public for transparency. Post in Whonix ™ forums whenever appropriate and possible.