explain xkcd - User contributions [en]

1181: PGP

2013-03-04T16:36:10Z

BenBE: /* Explanation */

{{comic
| number = 1181
| date = March 4, 2013
| title = PGP
| image = pgp.png
| titletext = If you want to be extra safe, check that there's a big block of jumbled characters at the bottom.
}}

==Explanation==
{{w|Pretty Good Privacy|PGP}} (or {{w|GNU_Privacy_Guard|GnuPG}} for the free, open source version) is a program which can be used to encrypt and sign data, including messages sent as emails. Encrypting the message would prevent anybody from reading it if they didn't have the key to decrypt. Signing the message would mean that the message can be verified as unaltered, if the reader was to check the message against the signature. People who use such a program typically only use the feature to sign the message, since encrypting it (which would give you the privacy) requires that the recipient already be a PGP user. Hence the irony here is that nobody actually verifies the "signature" either, but feel secure that the message appears to be signed.

PGP or {{w|Pretty Good Privacy}}, uses {{w|Public-key cryptography}}, which is defined in [https://tools.ietf.org/html/rfc4880 RFC4880]. The blob which makes the signature is a binary (clear sign) signature which is encoded into ASCII using {{w|ASCII armor}}.

The use of signing software for email is so rare that most people have never seen a signed message. The joke here lies within the approach of ignoring actual privacy guarantees PGP provides, therefore giving a false sense of security.

This irresponsible approach to security is unfortunately quite common with users and even more so for computer security related topics. When confronted with something strange (like the blob at the bottom) most people simply believe it: If it says it's secure it really has to be - even if it actually isn't.

BTW: You can annoy pretty good any security geek out there with such ignoring behaviour.

==Transcript==
:How to use PGP to verify that an email is authentic:
:Look for this text at the top
:[In mail header, light grey.] Reply
:-----BEGIN PGP ENCRYPTED MESSAGE-----
:[in mail message, light grey]
:HASH: SHA256
:Hey,
:First of all, thanks for taking care of
:If it's there, the email is probably fine

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]

1181: PGP

2013-03-04T16:33:15Z

BenBE: /* Explanation */ About the users ;-)

{{comic
| number = 1181
| date = March 4, 2013
| title = PGP
| image = pgp.png
| titletext = If you want to be extra safe, check that there's a big block of jumbled characters at the bottom.
}}

==Explanation==
{{w|Pretty Good Privacy|PGP}} (or {{w|GNU_Privacy_Guard|GnuPG}} for the free, open source version) is a program which can be used to encrypt and sign data, including messages sent as emails. Encrypting the message would prevent anybody from reading it if they didn't have the key to decrypt. Signing the message would mean that the message can be verified as unaltered, if the reader was to check the message against the signature. People who use such a program typically only use the feature to sign the message, since encrypting it (which would give you the privacy) requires that the recipient already be a PGP user. Hence the irony here is that nobody actually verifies the "signature" either, but feel secure that the message appears to be signed.

PGP or {{w|Pretty Good Privacy}}, uses {{w|Public-key cryptography}}, which is defined in RFC-4880 [https://tools.ietf.org/html/rfc4880#page-60 RFC4880]. The blob which makes the signature is a binary (clear sign) signature which is encoded into ASCII using {{w|ASCII armor}}.

The use of signing software for email is so rare that most people have never seen a signed message. The joke here lies within the approach of ignoring actual privacy guarantees PGP provides, therefore giving a false sense of security.

This irresponsible approach to security is unfortunately quite common with security and even more so for computer security related topics. When confronted with something strange (like the BLOB at the bottom) most people simply believe it: If it says it is secure it really has to be - even if it actually isn't.

BTW: You can annoy pretty good any security geek out there with such ignoring behaviour.

==Transcript==
:How to use PGP to verify that an email is authentic:
:Look for this text at the top
:[In mail header, light grey.] Reply
:-----BEGIN PGP ENCRYPTED MESSAGE-----
:[in mail message, light grey]
:HASH: SHA256
:Hey,
:First of all, thanks for taking care of
:If it's there, the email is probably fine

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]

1181: PGP

2013-03-04T08:14:28Z

BenBE: /* Explanation */

{{comic
| number = 1181
| date = March 4, 2013
| title = PGP
| image = pgp.png
| titletext = If you want to be extra safe, check that there's a big block of jumbled characters at the bottom.
}}

==Explanation==
This comic is a play on words with PGP, or {{w|Pretty Good Privacy}}, a method of encrypting emails. While PGP relies on, in part {{w|Public-key cryptography}}, Randall suggests that if you just look for "Begin PGP Signed Message" in the message, the assumption that the message is encrypted is "Pretty Good." This holds true as one of the [https://tools.ietf.org/html/rfc4880 RFC4880]-devised plaintext headers for [https://en.wikipedia.org/w/index.php?title=ASCII_armor ASCII-armored] messages is exactly this text. The title-text carries this further, suggesting that if something looking like a signature is located at the end of the message, the email was encrypted.

The joke here lies within the approach of ignoring actual privacy guarantees PGP provides as if you can distinguish the plaintext part from the signature you are using it without encryption and thus there's pretty good certainty about no privacy added through PGP.

Also humans hardly ever can verify signatures just doing math in their head.

==Transcript==
:

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]

1181: PGP

2013-03-04T08:11:42Z

BenBE: /* Explanation */ Some corrections fixing some major mistakes and providing some additional detail

{{comic
| number = 1181
| date = March 4, 2013
| title = PGP
| image = pgp.png
| titletext = If you want to be extra safe, check that there's a big block of jumbled characters at the bottom.
}}

==Explanation==
This comic is a play on words with PGP, or {{w|Pretty Good Privacy}}, a method of encrypting emails. While PGP relies on, in part {{w|Public-key cryptography}}, Randall suggests that if you just look for "Begin PGP Signed Message" in the message, the assumption that the message is encrypted is "Pretty Good." This holds true as one of the [https://tools.ietf.org/html/rfc4880 RFC4880]-devised plaintext headers for ASCII-armored messages is exactly this text. The title-text carries this further, suggesting that if something looking like a signature is located at the end of the message, the email was encrypted.

The joke here lies within the approach of ignoring actual privacy guarantees PGP provides as if you can distinguish the plaintext part from the signature you are using it without encryption and thus there's pretty good certainty about no privacy added through PGP.

==Transcript==
:

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]

559: No Pun Intended

2013-01-08T20:52:59Z

BenBE: Categories

{{comic
| number = 559
| date = March 23, 2009
| title = No Pun Intended
| image = no_pun_intended.png
| titletext = Like spelling 'dammit' correctly -- with two m's -- it's a troll that works best on the most literate.
}}

==Explanation==
Pretty self-explainatory - no pun intended.

==Transcript==
My Hobby: Appending "no pun intended" to lines with no pun in them.
[[Random guy is talking to a guy with a beret]]
Random guy: I think he's internalized his girlfriend's attitudes - no pun intended - and so...
{{Three hours later:}}
[[Beret guy is thinking]]
Beret guy: "Internalized?" Lied? Analyzed? Or is it "attitudes"? Dammit.
{{alt: Like spelling 'dammit' correctly -- with two m's -- it's a troll that works best on the most literate.}

{{comic discussion}}

[[Category:My Hobby]]
[[Category:Comics featuring Cueball]]
[[Category:Comics featuring Beret Guy]]

559: No Pun Intended

2013-01-08T20:50:35Z

BenBE: Categories

{{comic
| number = 559
| date = March 23, 2009
| title = No Pun Intended
| image = no_pun_intended.png
| titletext = Like spelling 'dammit' correctly -- with two m's -- it's a troll that works best on the most literate.
}}

==Explanation==
Pretty self-explainatory - no pun intended.

==Transcript==
My Hobby: Appending "no pun intended" to lines with no pun in them.
[[Random guy is talking to a guy with a beret]]
Random guy: I think he's internalized his girlfriend's attitudes - no pun intended - and so...
{{Three hours later:}}
[[Beret guy is thinking]]
Beret guy: "Internalized?" Lied? Analyzed? Or is it "attitudes"? Dammit.
{{alt: Like spelling 'dammit' correctly -- with two m's -- it's a troll that works best on the most literate.}

{{comic discussion}}

{{Category:My Hobby}}
[[Category:Comics featuring Cueball]]
[[Category:Comics featuring Beret]]

559: No Pun Intended

2013-01-08T20:42:26Z

BenBE: No Pun Intended