Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Modern Alternatives to PGP

blog.gtank.cc

Post reply on HN
Print view View original

141–150 of 261 posts

Re: Modern Alternatives to PGP

#141

Post by throwaway415415 »

tptacek wrote: post #120
kazinator wrote: post #91

> The "modern alternative" is to use a much more specific and much less configurable solution to your problem. The problem is you're replacing one configurable, flexible thing, with N different specific solutions involving multiple obscure little utilities. Oops! How can this blogger not see that this isn't better. How about a modern alternative to git? Instead of one hydra with so many heads, why not use scp for tra…

Because it is better. You don't get sound cryptosystems from configurable, flexible things; flexibility is the mortal enemy of cryptographic soundness. That's how "this blogger" "not see" that this isn't better. This isn't some fringe belief among hipster cryptography engineers (among which I'm sure George counts himself). You can read it straight out of _Cryptography Engineering_.

still, from a dev perspective it's not always clear what tool to use for the task. That's a lot of bike shedding for something that shouldn't be a problem in the first place: email or whatever communication system we will use in 20 years needs to have encryption baked in by default. Storing and sharing data safely need to be a first class feature of all OS and browsers.

Re: Modern Alternatives to PGP

#142

Post by throwaway415415 »

lixtra wrote: post #128
tptacek wrote: post #122

Earlier quoted context omitted.

It is indeed. Magic Wormhole implements a PAKE to individually encrypt and authenticate a secure channel without requiring any other root of trust. It's exceptionally easy to use and secure.

Magic Wormhole looks neat and I can imagine using it. But apparently it requires: - both parties to be online at the same time - have access to a secured channel to transfer the secret - Transfer a new autogenerated secret for each file transfer. PGP lets you: - verify the key once - re-use the key - the key be submitted through a public channel - the verification be done in a public (though tamper proof) channel or…

This. If you share a temporary password through another secure channel, you can probably just share a symmetric key and then you don't need PAKE anymore. In some cases though, you might want to send yourself something from one device to the other, or you are talking to someone who's not really technical on the phone.

About being online at the same time, I was under the impression that this wasn't a requirememt.

Re: Modern Alternatives to PGP

#143

Post by throwaway415415 »

heavenlyblue wrote: post #15
jandrese wrote: post #8

Earlier quoted context omitted.

The only encrypted mail I get is from Facebook. It drives me crazy that nobody else bothers to put a "enter your public key here" field. It seems like it should be super easy to implement, but Facebook is literally the only company that I've ever seen do it.

How many people in the industry you know (besides Tech), who use an e-mail client that is neither OS X's Mail or a web mail client?

The most popular email client is outlook. If you don't know that you are already pretty detached from reality.

Re: Modern Alternatives to PGP

#144

Post by throwaway415415 »

ohithereyou wrote: post #31
heavenlyblue wrote: post #15

Earlier quoted context omitted.

How many people in the industry you know (besides Tech), who use an e-mail client that is neither OS X's Mail or a web mail client?

OS X's mail handles PGP just fine with the GPG Mail plugin from the GPG Suite.

It's not free and is a third party tool developed from reverse engineering apple mail...

Re: Modern Alternatives to PGP

#145

Post by agumonkey »

eropple wrote: post #100
jwr wrote: post #80

One starts looking at things differently as years pass. I've been working with computers for >25 years now, and I've learned that long-term thinking is important. Remember '.bz' files that were all the rage? Yeah. Bzip1, not '.bz2'. Good luck trying to read that. For my data, I will stick to things that have been around for a long time and that are likely to stay. Those fancy 'nacl/box' thingies? I'm willing to make…

Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". While it's drying up and disappearing, is it going to take with it things like rbnacl which both use it transitively, package it for their environments, and also have some…

Google is not necessarily forever

Re: Modern Alternatives to PGP

#146

Post by klodolph »

taeric wrote: post #41
klodolph wrote: post #22

Earlier quoted context omitted.

No web of trust? I would say that’s exactly the point. For tons of applications, you don’t need web of trust at all. Using PGP when you don’t want the web of trust features is an utter pain in the ass. I want to be able to encrypt/sign and have web of trust be a different issue.

I feel like this is asking past the point. Without a web of trust, how are you securely signing? You can go with somewhat centralized trust, but that only gets you do far. Or, rather, that forces everyone to deal with that centralized source. Much like the web of trust.

> Without a web of trust, how are you securely signing?

I can only think you're making a bunch of hidden assumptions about how trust works or why you would want to sign or encrypt data. Maybe you're thinking specifically about things like email, where web of trust might make more sense.

Consider, for example, if I'm doing backups and I just want to encrypt them for my eyes only. How could a web of trust even possibly make sense in that scenario?

Re: Modern Alternatives to PGP

#147

Post by ggm »

The modern alternative to PGP is GPG. Or, PGP.

The implication that a tool like MH (or PGP) "needs" a modern alternative probably deserves to be questioned. There are nits, and there are problems, but GPGMail plugins for mail mostly work as well as anything else which is an accretion.

My corporate mail is using X.509 client certificates. LDAP (which is basically X.500-- so naturally fits X.509 information model) makes it work. We all grow a long tail of past certificates to make sure we can unpack our own p7m data.

I don't think we ever solved how untrusted people come into trust without some form of painful mediation. The dream of the Quipu X.500 global directory remains...

Re: Modern Alternatives to PGP

#148

Post by throwaway415415 »

justincormack wrote: post #57
g45y45 wrote: post #55

A problem I have run into with x25519 and ed25519 is that in Nacl, both use different public key 'formats'. While they are the same curve, you cannot use an x25519 for signing (ed25519 only) and you cannot use an ed25519 for encryption. PGP allows binding encryption and signing keys together in a profile. So far I have not been able to 'bind' an ed25519/x25519 key in a similar configuration.

It is not recommended to use any keys for more than one purpose any more, this can allow attacks. So this is by design.

It's not by design. There are stuff like decaf, ristretto and qDSA which "fix" this

Re: Modern Alternatives to PGP

#149

Post by throwaway415415 »

gtank wrote: post #105
jrochkind1 wrote: post #92

A side issue, but: > It generates those passwords for you, and they're short, one-time-use combinations of three English words If an attacker knows the tool does this, doesn't this reduce the keyspace to crack to (number of words in an English dictionary)*3? Is that enough? Am I missing something? A very complete dictionary has around 170K words, let's generously assume the password generator is willing to use all of…

It’s enough because of the underlying PAKE technique. The passwords do not directly become the key, and an unsuccessful bruteforce attempt breaks the session. PAKE isn’t really new, but it’s certainly underused for how much it changes the password game: https://blog.cryptographyengineering.com/2018/10/19/lets-tal...

The server can still bruteforce it though right?

Re: Modern Alternatives to PGP

#150

Post by throwaway415415 »

klodolph wrote: post #140
throwaway415415 wrote: post #137

Earlier quoted context omitted.

You can use pgp without the web of trust. I think you are missing GP's point.

I think you may have misread my comment, since I never claimed it was not possible to use PGP without web of trust. I claimed that it was a pain in the ass.

Its a pain in the ass because nobody has created a user friendly UI for that, but in itself it is a powerful technique to establish trust.
Post reply on HN