Differences

This shows you the differences between two versions of the page.

--- blug-canary-1 [2019/10/30 16:29]
BLUG Admin
+++ blug-canary-1 [2020/05/26 13:47]
BLUG Admin
@@ Line 15: / Line 15: @@
 ====================================
-Issued for October 2019.
+Issued for May 2020.
 Don't just trust the contents of this file blindly! Verify the
@@ Line 23: / Line 23: @@
 ~~~~~~~~~~~~~
-* biergaizi: 0xFAD3EB05E88E8D6D
+* biergaizi: 0x255211B2395A5A3E0E48A0F1FAD3EB05E88E8D6D
-* persmule : 0x2987A25DAC8454A5
+* persmule : 0xEDFFE248ECFACDE3C805906804A40D21DBB89B60
-* wnereiz  : 0xFDFF2E13AA25BE72
+* vimacs   : 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403
 THREE DOCUMENTS IN TOTAL.
@@ Line 62: / Line 62: @@
 . Our personal safety and security is not threatened.
-. To avoid security breaches and emphasize the clarity of the warrent canary
+. To avoid security breaches and emphasize the clarity of the warrant canary
 documents, if a signer is temporarily unavailable, only existing signers in the
 "Signer" list SHALL sign a special placeholder notice (this notice itself SHOULD
 NOT be considered a valid canary document) until the signer becomes available
-again and signs the missed documents. A new signer SHOULD NOT sign a warrent
+again and signs the missed documents. A new signer SHOULD NOT sign a warrant
 canary document only due to the temporary unavailability of a existing signer.
 . We plan to publish the next of these canary statements in the first three
-weeks of December 2019. Special note should be taken if no new canary is published
+weeks of June 2020. Special note should be taken if no new canary is published
 by that time or if the list of statements changes without plausible explanation.
@@ Line 76: / Line 76: @@
 ~~~~~~~~~~~~~~~~~~~~~~~~
-None.
+. Due to personal reasons, wnereiz (0xFDFF2E13AA25BE72) voluntarily decided
+to quit from the warrant canary team and he is no longer a signer of the
+warrant canary documents since April 15th, 2020. All statements from the
+warrant canary documents before this date are still valid. This is an official
+decision that can be verified by checking the warrant canary document in April,
+signed by wneriez.
+. In the previously mentioned document designed by wneriez in April 2020,
+the date in its statements was mistakenly written as "April 15th, 2019",
+which was a typo, but cannot be changed due to the nature of digital signature.
+We declare that it's hereby corrected to "April 15th, 2020".
+. A new member, vimacs (0xEA2DB82FE04A9403) has became a new signer since this
+month. You can validate the new keys by cross-checking the other two copies of
+this document, signed by biergaizi and persmule.
+. Due to the ongoing security issues of OpenPGP keyservers, it makes signature
+verification an issue and somewhat a challenge. For completeness, complete
+procedures for canary verification has been added.
+Canary Verification Procedures
+~~~~~~~~~~~~~~~~~~~~~~~~
+. To verify biergaizi's signature...
+    a. Obtain the public key from any traditional OpenPGP Keyserver, such as
+    https://keyserver.ubuntu.com, and import the public key. The fingerprint
+    is 0x255211B2395A5A3E0E48A0F1FAD3EB05E88E8D6D.
+    b. Use the latest GnuPG in any operating system.
+. To verify persmule's signature...
+    a. Unfortunately, it's not possible yet. Recent attacks on OpenPGP key-
+    servers have raised great security concerns within the community, as a
+    countermeasure, persmule's new public key has been published to the
+    https://keys.openpgp.org/ keyserver, but without a User-ID. Currently,
+    it's impossible to import a OpenPGP public key without User-ID for a
+rd-party to verify the canary document signed by persmule.
+    b. We are looking for a solution. But for now, you should check the
+    canary documents signed by biergaizi and vimacs to decide the validity
+    of the canary documents. This effectively reduced the number of signers
+    to two people. It reduces the level of confidence, but currently there is
+    no alternative option yet.
+    c. Once the technical problem of using a public key without User-ID is
+    resolved, you can check the previous signatures retroactively, and this
+    would effectively restore the level of confidence. You can archive the
+    documents to your own machine as soon as it's published to ensure no data
+    tampering has occurred.
+. To verify vimacs' signature...
+    a. Due to the recent attacks on OpenPGP keyservers, vimacs has published
+    the OpenPGP public key to https://keys.openpgp.org, again, without a User-
+    ID. But it's possible for a 3rd-party to verify the signatures by following
+    these steps.
+    b. Use Debian GNU/Linux operating system and install GnuPG. Other operating
+    systems may lack the necessary out-of-tree GnuPG patches required, Debian
+    must be used.
+    c. Fetch vimacs' old public key from a traditional OpenPGP Keyserver, such
+    as https://keyserver.ubuntu.com, and import the public key. The fingerprint
+    is 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403. You should see an expired
+    public key.
+    d. Fetch vimacs' new public key from https://keys.openpgp.org, using the same
+    fingerprint, and import the public key. You should see that the public
+    key has been updated.
+    e. Please note that the key is still shown as "expired" because the new key
+    has no UID associated. But you should be able to see a new, valid (not
+    expired) subkey by...
+        $ gpg --list-options show-unusable-subkeys      --list-keys 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403
+    f. Now, it's possible to verify the signature by following the standard
+    procedures. Ignore the "key expired" warning (because the latest UID is
+    not published, only the expired UIDs are available).
 Proof of Freshness
@@ Line 82: / Line 162: @@
 $ rsstail -1 -n5 -N -u https://www.telegraph.co.uk/news/rss.xml
- Grenfell Tower: Dany Cotton refuses to resign after damning report demands 'urgent action' against London Fire Brigade
+ Britain in coronavirus lockdown, in pictures
- Halloween 2019: How Celtic trick-or-treating and Gaelic turnip-carving led to the American celebration
+ Travel restriction updates: Greece could block British arrivals unless UK infection rate falls
- Clutha helicopter crash caused by pilot taking 'a chance' low fuel warnings were wrong, inquiry finds
+ What are the quarantine rules in Spain, France and other countries?
- Grenfell Tower report: Fire union chief hits back at 'back-to-front' criticism saying ministers are 'evading scrutiny'
+ Watch: How to make a no-sew, government-approved cloth face mask
- Grenfell Tower report section by section: the 1,000 pages of damning criticism on failures that compounded tragedy
+ Contact tracing: how will the UK's test, track and trace plan help ease lockdown
 $ rsstail -1 -n5 -N -u https://rss.nytimes.com/services/xml/rss/nyt/World.xml
- Vietnamese Migrants Sought a Brighter Future in Britain. Now, Their Families Mourn Them
+ Coronavirus Live News: Global Updates
- Grenfell Tower Inquiry Criticized for Faulting Fire Brigade
+ Heres How Wuhan Tested 6.5 Million for Coronavirus in Days
- Militants Kill 5 Laborers in Kashmir, Expanding Threat to Civilians
+ How the Taliban Outlasted a Superpower: Tenacity and Carnage
- An H.I.V. Outbreak Puts Spotlight on Pakistans Health Care System
+ Chinas Military Vows to Defend the Countrys Interests in Hong Kong
- Britain to Hold Election in December, Opening New Phase in Brexit Odyssey
+ On a Scottish Isle, Nursing Home Deaths Expose a Covid-19 Scandal
 $ date -R -u
-Wed, 30 Oct 2019 16:28:27 +0000
+Tue, 26 May 2020 13:45:10 +0000
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2
-iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAl25ulEACgkQ+tPrBeiO
+iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAl7NHa8ACgkQ+tPrBeiO
-jW3mVw/9F1LMoODRWmEIQeD5VPIWJwwp33Rt53WuYIBCA2yK1dtLKWj+fO8tBkq8
+jW2Fkw//f8osAGVE0JRiWjPsUjBpB9lg+CJjpM2KlfY/143Jblg8m8k9CRfWpKhG
-rLAwBcL4JFgAcdqJT6SpB/GC8XukKgXFiIJjvHfRhXt6ZefMvAbaJDJ44dRKQx5k
+R409J0PiVPmuyGuRhGtPIiZRPeWAiOc+S7DdEhHoF79AI8Pp0w/kfBs4cAOZLi20
-eokxlbsLhvBqksa3BP0EF+1wRwMZghe09YXY64wm+ebEb+SjWkFblYEhk4KvVBoO
+HsMhZeEG0BeayfQy3xW6aZrDh0xbQFxG/WW3OBhT4FMkH0nwTn+G6K/KVUS5VWfN
-cNDdK7rsGLoh1B4qt2N2W4WES9NJaFqHqy+iafYRbZya9pa/zHBFSK+cRDxioZsi
+ty/jXriSzf22AxGj2r81F0cv9u8JGiTqaHkcfmhT2T5eanRHb87O1+D7Uxj/7IKt
-X51U60Ntt50rq+nEtoH4qqIQYcSZ1PMPkmkkF7M/VQ3lhzQownv6fYRhq/jeyz0a
+Sz7YSJaht/diPT2T0xTSm2OWorQ4rt0gJ9syqeMduTEXaND5RjnFQdFub7sKIwv2
-fW7Bmfl9SaJTeTcegPjrh/v+yUL5PC7ZjjsXIEVNS0L3SaNatVnxuVC0HvcXziZa
+LOqhWu8AVIlB6HaVmcxl2l+rPIBjEZOv+jvFtAaddrDCRUHWqgx+u55P9fXz0KFu
-BPsWjv6qBbQBCVjSkv0yU6zfXlNAzGRhJLXXTSulraEs0hUoeIsdC8IbQ2KkvXSt
+uSfiaUmeUbVNXIt9ZIHzo4Er/TvRcbX4FMGYGbntno+A6L0eY2TNIoGj7r40BIyk
-cySvJw85UZSyCJCJ+AQdJ8Hbg+4OvhRB2trT1skmRUZeKL9aM0XEB3ByXIBmBf+q
+N6GyLJufnFYFQwKCwo/IIWnDFrycxhb7AxqWxEXbQ+CHeewnsuZZCqnKUIIhtLFd
-+zsDLTylDwSLRIaoGHFTXJRKUzV1AAr6KWfq0WitX5aAILKEBm/0vAlVlc6pnhh8
+byS16qopDsFmTwgrn9EzrNdigRygMlyRA1Tt3nz59O28uqfGSlgBl+eGTA1fAkB2
-B4SmUM4Ame6CdVDcOjjPD8FZkRxvTzcsFB7jGEMMrQMVQJCdJr/o6oJ3keTeu9L
+o3oY87bVmH11XqkFu8NCdbwfvj9DZ1AU+Anq9i1O64nXGI9vc1FN77rrME5PUGUl
-abIthywfFa3mIWL2GDcc8inYFPOGFUbaiaPUBrjuqTYPdpV1H8=
+yNxgEdwZSXXSfDaVcDtiAOykIYQoEy2n4Pf1PeFMNNWwL/0KqAk=
-=RMwa
+=uqbn
 -----END PGP SIGNATURE-----
 </code>

BLUG Wiki

User Tools

Site Tools

Differences

Page Tools