secluded/content/posts/removing-your-site-from-the-wayback-machine-gpg.md

---
title: Removing your site from the Wayback Machine (GPG)
subtitle: A quick-ish and easy-ish guide
author: Amolith
description: Quick-ish and easy-ish guide on removing and excluding your domain from Archive.org's Wayback Machine using GPG keys
cover: /assets/pngs/archive.png
date: 2019-06-04T21:57:00-04:00
draft: false
categories:
  - Technology
tags:
  - Archive.org
  - Privacy
  - Sysadmin
toc: true
---

## Preface
If you simply want to remove your website and nothing else, read through
the setup and verifying identities sections then continue from the [For
domains you
own](/removing-your-site-from-the-wayback-machine-keybase/#for-domains-you-own)
section of the previous post. If you're wanting to address
accounts/profiles on websites you don't own, read on.

In addition to dealing with the Wayback Machine, this article is also
supposed to help you get started using GPG in every-day life for general
security and privacy.

## Getting set up
### Installation & Generating Keys
First of all, you'll want to install GPG. The package on most
distributions should be just be `gnupg`.
- Debian: `sudo apt install gnupg`
- Arch: `sudo pacman -S gnupg`
- Fedora: `sudo dnf install gnupg`

The next step is generating your key. While it will take a bit longer to
generate, a stronger key will be more secure. Also make sure you read
this excerpt from the `man` page as it contains a useful warning.

>**WARNINGS**
>
>Use a *good* password for your user account and a *good* passphrase to
>protect your secret key. This passphrase is the weakest part of the
>whole system. Programs to do dictionary attacks on your secret keyring
>are very easy to write and so you should protect your `~/.gnupg/`
>directory very well.

With that said, use `gpg --full-gen-key` to get started. Keep in mind
that you don't actually have to use your real name or personal email
address. If you *want* a personal key, go ahead and create one but you
can also use a pseudonym and fake address if you'd like.

1. I would use the default (1) of "RSA and RSA".
2. Again, you can use default but I would recommend 4096 bits because
   it's much more secure. This does mean, however, that it will take
   longer to generate the key.
3. An expiry date is recommended but you don't necessarily have to set
   one.
4. You *don't* have to use your real name. You can use a pseudonym if
   you wish.
5. You *don't* have to use your personal email. You can use a
   pseudonymous one if you wish.
6. You don't need a comment
7. Confirm
8. Come up with a ***secure*** password or, even better, a pass*phrase*.
9. Move your mouse around a bit, type, something like that while it's
   generating the key.

### Email
I use [Thunderbird](https://www.thunderbird.net/) for email and there is
a great addon for it called [Enigmail](https://enigmail.net/). It's
quite easy to set up and use but there is a really annoying bug that
you'll experience when replying in threaded mode. If you want to encrypt
a reply, simply open the editor in a new window.

## Verifying Identities
In general, all you'll have to do is type something along the lines of:

> I am \<your-name-here\> and I own the following accounts:
> - Account 1 - \<link\>
> - Account 2 - \<link\>
> - Etc.

You'll save that in a text file, run `gpg --clearsign file.txt`, copy
the output, then paste it wherever it needs to go, whether that's a
blog, a GitHub gist, etc. With Twitter/Mastodon and their character
limit, this won't quite work. The best solution there is probably to
post a link to a gpg-signed message on your website that links back to
the post.

Really, all you have to do is tie all of your accounts together in as
close-knit a web as you can and sign with your GPG key wherever
possible. Linking everything to everything else would definitely work
but it should also be enough to link everything to a single document on
your website (or a gist in GitHub etc.) that links back to all of those.

I'm probably not explaining very well so here's a diagram showing it.

![a diagram illustrating the text
below](/assets/pngs/archive-diagram.png)

Note that the email links to everything else but nothing links back to
the email. It's the main document that's at the centre of it all. Make
sure both it and the email are signed. If you toot, link to the toot in
the main document. If you make a gist, link to the gist in the main
document.

## Sending the email
Once you have all the groundwork laid out, you'll be ready to send the
email; the address is [info@archive.org.](mailto:info@archive.org)
Explain what you would like done and link to the document requesting
your domain exclusion first as that's the easiest to verify. In the next
paragraph, I would explain a little bit about what you've set up with
signing messages and creating the "Web of Verification" (lol). Under
that, I would link to the posts asking for the accounts to be removed.
Make sure those posts also link back to the main document. Be polite,
say thank you, then send the email!