Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Modern Alternatives to PGP

blog.gtank.cc

Post reply on HN
Print view View original

31–40 of 261 posts

Re: Modern Alternatives to PGP

#31

Post by ohithereyou »

heavenlyblue wrote: post #15
jandrese wrote: post #8

Earlier quoted context omitted.

The only encrypted mail I get is from Facebook. It drives me crazy that nobody else bothers to put a "enter your public key here" field. It seems like it should be super easy to implement, but Facebook is literally the only company that I've ever seen do it.

How many people in the industry you know (besides Tech), who use an e-mail client that is neither OS X's Mail or a web mail client?

OS X's mail handles PGP just fine with the GPG Mail plugin from the GPG Suite.

Re: Modern Alternatives to PGP

#33

Post by Quekid5 »

tptacek wrote: post #2

The context for this is this Go project proposal: https://github.com/golang/go/issues/30141 Filippo proposes to deprecate (but not remove) Blowfish, archaic curves, CAST, MD4, RIPEMD160, TEA, Twofish, XTS, and OpenPGP from the Golang x/ libraries (which are "officially supported" but not part of the standard library. It's really heartening to see a project get serious about shedding legacy crypto.

Is OpenPGP considered 'legacy'? If so, why?

I was under the impression that it's mostly that it's really hart to reliably support e.g. calling 'gnupg' (cmdline), gpgme (library), etc.?

ISTR there was a company that's re-implementing the OpenPGP standard from scratch in a library-oriented-fashion, but for the life of me I can't remember their name...

I don't disagree with the 'drop legacy' stance, btw, I'm just interested in what exactly the issue is.

Re: Modern Alternatives to PGP

#34

Post by diafygi »

NelsonMinar wrote: post #19
pera wrote: post #10

As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)

Keybase is one version of a modern take on Web of Trust. https://keybase.io/

Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one).

https://sks-keyservers.net/status/

Re: Modern Alternatives to PGP

#35

Post by red_admiral »

minisign I can support - I use it myself.

For encrypting small data blobs, nacl/[secret]box is fine but as the description says it's for small blobs. If you want to store a large encrypted blob on a USB key as a backup, less so.

I personally use enchive (https://github.com/skeeto/enchive) for that, it's like the encryption counterpart to minisign and in my opinion it really should be on the list.

Re: Modern Alternatives to PGP

#36

Post by ChrisSD »

NelsonMinar wrote: post #19
pera wrote: post #10

As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)

Keybase is one version of a modern take on Web of Trust. https://keybase.io/

Wow the mobile website really doesn't want me to know what keybase is.

Re: Modern Alternatives to PGP

#37

Post by athenot »

There's also S/MIME for sending emails, which is supported by many email clients.

Of course this assumes you are fine with the chain of trust that ends with Certificate Authorites, but this is no different that HTTPS.

Re: Modern Alternatives to PGP

#38

Post by fanf2 »

I need a command-line tool that does public key encryption of a few KB of data with an ASCII-armored file format. For convenient auditing, it needs to be non-repudiable, and easy to find out which keys can decrypt.

As far as I could see, the closest this article gets is saltpack, but that is an unstable alpha, and it does not appear to have a command line interface.

So no, this is not a modern alternative to PGP for my use case :-(

Re: Modern Alternatives to PGP

#39

Post by tptacek »

Quekid5 wrote: post #33
tptacek wrote: post #2

The context for this is this Go project proposal: https://github.com/golang/go/issues/30141 Filippo proposes to deprecate (but not remove) Blowfish, archaic curves, CAST, MD4, RIPEMD160, TEA, Twofish, XTS, and OpenPGP from the Golang x/ libraries (which are "officially supported" but not part of the standard library. It's really heartening to see a project get serious about shedding legacy crypto.

Is OpenPGP considered 'legacy'? If so, why? I was under the impression that it's mostly that it's really hart to reliably support e.g. calling 'gnupg' (cmdline), gpgme (library), etc.? ISTR there was a company that's re-implementing the OpenPGP standard from scratch in a library-oriented-fashion, but for the life of me I can't remember their name... I don't disagree with the 'drop legacy' stance, btw, I'm just intere…

Yes, as the article says, it's a 1990s-style ultra-configurable do-everything design which, in practice, almost always gets deployed in a lowest-common-denominator set of constructions that are themselves mired in 1990s crypto.

No modern cryptographic engineer looking at any problem PGP solves would design a system that looked like PGP.

PGP used to make some sense as a simple at-rest storage format, but in the era of Nacl and libsodium, even that use case is a poor fit.

Re: Modern Alternatives to PGP

#40

Post by [deleted] »

michaelmrose wrote: post #28
drenvuk wrote: post #18

Earlier quoted context omitted.

All of you are using pgp wrong, emails are a crap way to use it. It's not your fault, it was meant to be used that way. There's a better way to use it though.

I want a peer to peer communication not beholden to a particular provider where I can optionally host myself where I can communicate to most people in the US. It would be optimal if I could communicate with people privately but being able to communicate with them at all is the primary point. What should I use instead of email.

[deleted]
Post reply on HN