One problem I see is network effects. If you use some relatively obscure encryption scheme, then it is possible for an adversary to de-anonymize you by knowing that you are one of a small group of people who use that encryption scheme.
Modern Alternatives to PGP
201–210 of 261 posts
Re: Modern Alternatives to PGP
#202Earlier quoted context omitted.
I have PGP keys on the keyservers but don't actively look random people up and send encrypted mail on first contact (perhaps something that can be automated). I'm surprised how often the reply I receive when contacting some German (.de) open source person is PGP encrypted.
Please sign your outgoing mails if you have a key. Of the PGP mails I get, most are just encrypted to me. That is cryptographically not a sound idea, but it also means that I cannot encrypt back, because I don't know which key to encrypt to. The keyservers do not validate anything. They are just a storage medium. In fact, for my personal e-mail address, a prankster has uploaded a rogue key. There is no process by whi…
> Please sign your outgoing mails if you have a key.
It's interesting that even Edward Snowden made this mistake of sending only encrypted email.
For more elaboration about this subject K-9 resources are quite good:
https://k9mail.github.io/2017/01/30/OpenPGP-Considerations-P...
Re: Modern Alternatives to PGP
#203Earlier quoted context omitted.
>he couldn't see his story in the film ... Published comments, just last month. In German -- would any bilinguals care to summarize? https://www.sueddeutsche.de/kultur/donnersmarck-hein-das-leb...
He describes the movie as an overly dramatic dark fairy tale and says he doesn't recognize himself in the main character. As far as specific criticism goes, he says the way the main character has to write in secrecy and is suppressed by the Stasi is inaccurate. He says his room was bugged in the 60s but the 80s in the DDR were supposedly much more liberal than what the film shows.
I read only the automatic Google translation to English, so this might be a misreading, but he does seem to recognize that he was being a little too pedantic in expecting historical accuracy in a dramatic work.
Re: Modern Alternatives to PGP
#204Earlier quoted context omitted.
Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/
Keybase is a centralized service but AIUI you don't need to actually trust the centralized Keybase service because all the actual validation is performed client-side (i.e. verifying all the proofs that the people you follow have posted) and all of the changes people make to their profiles are publicly published as a chain that is then periodically embedded into the Bitcoin blockchain. As long as you're ok with relyin…
Proofs are still stored on Keybase servers so if Keybase goes bust tomorrow it's all gone.
For the record there is a way to encode Keybase-like proofs in plain OpenPGP: https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 for some reason Keybase decided to keep this validation centralized.
Re: Modern Alternatives to PGP
#205Earlier quoted context omitted.
Okay, so "gpg -c" is better than other commonly installed command line tools for encrypting a file with password?
PGP, which is something you have to explicitly install, is a badly flawed way to encrypt files; it has a poor password KDF and you should look at how it authenticates data. Install something better.
"PGP, which is something you have to explicitly install"
Gnupg is a default package for Ubuntu[1], so not always.
"Install something better"
That's a bit mysterious. Various Google searches don't suggest anything obvious.
[1] See http://releases.ubuntu.com/bionic/ubuntu-18.04.2-live-server... ctrl-f, search for gnupg
Re: Modern Alternatives to PGP
#206Earlier quoted context omitted.
> Without a web of trust, how are you securely signing? I can only think you're making a bunch of hidden assumptions about how trust works or why you would want to sign or encrypt data. Maybe you're thinking specifically about things like email, where web of trust might make more sense. Consider, for example, if I'm doing backups and I just want to encrypt them for my eyes only. How could a web of trust even possibly…
If you are just doing backups, why are you bothering signing something? I mean, yes. Pgp is a bad fit for that. So is tls.
Maybe to ensure that it was you that created the backup? It may be nice when restoring the backup.
Re: Modern Alternatives to PGP
#207Earlier quoted context omitted.
If you are just doing backups, why are you bothering signing something? I mean, yes. Pgp is a bad fit for that. So is tls.
Maybe to ensure that it was you that created the backup? It may be nice when restoring the backup.
But if you encrypted them, there is no reason to also sign them. Either you have the key to decrypt, thus you did it, or you don't, so you didn't.
Signing is for verification of identity over potentially compromisable channels. Not securing controlled items.
Re: Modern Alternatives to PGP
#208minisign I can support - I use it myself. For encrypting small data blobs, nacl/[secret]box is fine but as the description says it's for small blobs. If you want to store a large encrypted blob on a USB key as a backup, less so. I personally use enchive ( https://github.com/skeeto/enchive ) for that, it's like the encryption counterpart to minisign and in my opinion it really should be on the list.
Minisign's counterpart for encryption is encpipe (https://github.com/jedisct1/encpipe).
Re: Modern Alternatives to PGP
#209For securely sharing data online, you may also want to consider Piknik https://github.com/jedisct1/piknik
Re: Modern Alternatives to PGP
#210No mention of an agent. One of the nice features of GPG/PGP is gpg-agent which lets me use GPG without having to type in a passphrase every time.
It also replaces ssh-agent. I also use monkeysphere to store SSH keys in GPG. It's a far better solution than ssh keys lying around requiring management.
Interesting, can you what are the benefits of using gpg-agent over ssh-agent for managing ssh keys?