Modern Alternatives to PGP

#1

Post by tptacek » Fri, Feb 15, 2019, 6:22 PM UTC

Modern Alternatives to PGP
blog.gtank.cc

Re: Modern Alternatives to PGP

#2

Post by tptacek » Fri, Feb 15, 2019, 6:40 PM UTC

The context for this is this Go project proposal:

https://github.com/golang/go/issues/30141

Filippo proposes to deprecate (but not remove) Blowfish, archaic curves, CAST, MD4, RIPEMD160, TEA, Twofish, XTS, and OpenPGP from the Golang x/ libraries (which are "officially supported" but not part of the standard library.

It's really heartening to see a project get serious about shedding legacy crypto.

Re: Modern Alternatives to PGP

#3

Post by rwilson4 » Fri, Feb 15, 2019, 6:59 PM UTC

Short, to-the-point, and I wasn't familiar with any of these options! Love it!

Re: Modern Alternatives to PGP

#4

Post by kenforthewin » Fri, Feb 15, 2019, 7:28 PM UTC

Thanks for this. The format of original need to modern alternative is particularly useful.

Re: Modern Alternatives to PGP

#5

Post by davidcollantes » Fri, Feb 15, 2019, 7:28 PM UTC

rwilson4 wrote: post #3

Short, to-the-point, and I wasn't familiar with any of these options! Love it!

For the userland, there was only two tools on the post that allows signing. How will handle file encryption?

Re: Modern Alternatives to PGP

#6

Post by bertman » Fri, Feb 15, 2019, 7:30 PM UTC

> No one was sending you encrypted emails anyway,...

Ouch, the unfortunate truth.

Re: Modern Alternatives to PGP

#7

Post by zokier » Fri, Feb 15, 2019, 7:35 PM UTC

davidcollantes wrote: post #5

rwilson4 wrote: post #3

Short, to-the-point, and I wasn't familiar with any of these options! Love it!

For the userland, there was only two tools on the post that allows signing. How will handle file encryption?

The article does mention saltpack, discussion about it here: https://news.ycombinator.com/item?id=14067003

Re: Modern Alternatives to PGP

#8

Post by jandrese » Fri, Feb 15, 2019, 7:37 PM UTC

bertman wrote: post #6

> No one was sending you encrypted emails anyway,... Ouch, the unfortunate truth.

The only encrypted mail I get is from Facebook. It drives me crazy that nobody else bothers to put a "enter your public key here" field. It seems like it should be super easy to implement, but Facebook is literally the only company that I've ever seen do it.

Re: Modern Alternatives to PGP

#9

Post by davidcollantes » Fri, Feb 15, 2019, 7:40 PM UTC

jandrese wrote: post #8

bertman wrote: post #6

> No one was sending you encrypted emails anyway,... Ouch, the unfortunate truth.

The only encrypted mail I get is from Facebook. It drives me crazy that nobody else bothers to put a "enter your public key here" field. It seems like it should be super easy to implement, but Facebook is literally the only company that I've ever seen do it.

Could you elaborate? I don't use Facebook.

Re: Modern Alternatives to PGP

#10

Post by pera » Fri, Feb 15, 2019, 7:42 PM UTC

As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this.

> No one was sending you encrypted emails anyway

I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)