Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Modern Alternatives to PGP

blog.gtank.cc

Post reply on HN
Print view View original

131–140 of 261 posts

Re: Modern Alternatives to PGP

#131

Post by pera »

klodolph wrote: post #22
pera wrote: post #10

As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)

No web of trust? I would say that’s exactly the point. For tons of applications, you don’t need web of trust at all. Using PGP when you don’t want the web of trust features is an utter pain in the ass. I want to be able to encrypt/sign and have web of trust be a different issue.

I'm not sure I understand your comment, can you be more specific please? you don't have to use WoT if you don't want/need it.

Re: Modern Alternatives to PGP

#132

Post by int_19h »

eropple wrote: post #96
robotrout wrote: post #88

Earlier quoted context omitted.

Censorship seems to be coming from the left. I think it makes sense for everybody to maintain as much privacy from .gov as possible.

So...you are aware that "saying that makes you an asshole" and "you can't say that" are different things, yes?

In Germany, it's "you can't say that", which is I think what he's talking about. Germany is probably the most extreme in the Western world in that regard - they have e.g. a court that can ban political parties if their platform is "counter to the free democratic basic order". Not to mention minor censorship, like excising swastikas and mentions of Hitler (ironically, a recent example was with a game about how Nazis are bad and you should fight them).

https://en.wikipedia.org/wiki/Streitbare_Demokratie

Re: Modern Alternatives to PGP

#133

Post by AnaniasAnanas »

sdevlin wrote: post #104
AnaniasAnanas wrote: post #103

Earlier quoted context omitted.

Using "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in less than a year. I am seriously wondering under what definition this could be considered better than OpenPGP. XSalsa20 is indeed fine, but XChaCha20 is better in every way. The proof for XSalsa20 provided by Bernstein applies to XChaCha20 as…

> Using "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in less than a year. Magic Wormhole uses a PAKE to establish a secure channel from a low-entropy shared secret.

I admit that I missed that part. My mistake, I apologise.

Re: Modern Alternatives to PGP

#135

Post by throwaway415415 »

eropple wrote: post #100
jwr wrote: post #80

One starts looking at things differently as years pass. I've been working with computers for >25 years now, and I've learned that long-term thinking is important. Remember '.bz' files that were all the rage? Yeah. Bzip1, not '.bz2'. Good luck trying to read that. For my data, I will stick to things that have been around for a long time and that are likely to stay. Those fancy 'nacl/box' thingies? I'm willing to make…

Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". While it's drying up and disappearing, is it going to take with it things like rbnacl which both use it transitively, package it for their environments, and also have some…

Did Tink rely on NaCl or libsodium?

Re: Modern Alternatives to PGP

#136

Post by throwaway415415 »

pera wrote: post #10

As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)

This ^

People are quick to point to "modern" alternatives like Signal but they miss the web of trust which, correctly implemented would be a killer.

Re: Modern Alternatives to PGP

#137

Post by throwaway415415 »

klodolph wrote: post #22
pera wrote: post #10

As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)

No web of trust? I would say that’s exactly the point. For tons of applications, you don’t need web of trust at all. Using PGP when you don’t want the web of trust features is an utter pain in the ass. I want to be able to encrypt/sign and have web of trust be a different issue.

You can use pgp without the web of trust. I think you are missing GP's point.

Re: Modern Alternatives to PGP

#138

Post by throwaway415415 »

criddell wrote: post #124
pera wrote: post #10

As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)

For me the most interesting feature that PGP lacks is perfect forward secrecy. I use GPG for my email (Thunderbird + Enigma) but wish I had something more modern.

To have forward secrecy you need sessions for each correspondence. To have that, you need something more reliable than mail.

Re: Modern Alternatives to PGP

#139

Post by klodolph »

pera wrote: post #131
klodolph wrote: post #22

Earlier quoted context omitted.

No web of trust? I would say that’s exactly the point. For tons of applications, you don’t need web of trust at all. Using PGP when you don’t want the web of trust features is an utter pain in the ass. I want to be able to encrypt/sign and have web of trust be a different issue.

I'm not sure I understand your comment, can you be more specific please? you don't have to use WoT if you don't want/need it.

PGP is downright user-hostile once you're not using web of trust. So it's true, that you don't have to use web of trust. But PGP goes out of its way to make your life hell.

For example, let's say you have a key (as an ordinary file) and a signed message in hand. How do you check that this key has signed this message, using the gpg command-line tools?

The problem with PGP is that it combines web of trust and the mechanical actions of signature verification and cryptography into one tool. It forces you to use one program both to express "trust" and to do signature verification. God forbid you should ever want to sign or encrypt something without futzing about with your keychain.

Re: Modern Alternatives to PGP

#140

Post by klodolph »

throwaway415415 wrote: post #137
klodolph wrote: post #22

Earlier quoted context omitted.

No web of trust? I would say that’s exactly the point. For tons of applications, you don’t need web of trust at all. Using PGP when you don’t want the web of trust features is an utter pain in the ass. I want to be able to encrypt/sign and have web of trust be a different issue.

You can use pgp without the web of trust. I think you are missing GP's point.

I think you may have misread my comment, since I never claimed it was not possible to use PGP without web of trust. I claimed that it was a pain in the ass.
Post reply on HN