Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

21 years after the request OpenPGP support gets added to Thunderbird

bugzilla.mozilla.org

Post reply on HN
Print view View original

161–170 of 281 posts

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#161

Post by somedude11 »

tptacek wrote: post #134
ifmpx wrote: post #110

Earlier quoted context omitted.

People in this industry use OpenPGP because it's flexible and amendable to almost any usecase you can think of. "Better solutions" are usually indeed better but are also so specialized for their purpose to the point that they can't be easily used for any other purpose. OpenPGP is used to secure everything from simple messages and email to authenticating OS updates for most servers today. Should they use something mor…

It's telling that the most common example of a widespread use of PGP (modern messaging applications exchange more messages in a day than OpenPGP has ever exchanged) is software update schemes, because software update cryptography is both a solved problem (just use signify) and doesn't have network effects; it's a "trust anchor" application. At least with PGP email, you can make the argument that PGP sticks around bec…

Backup, archivization, password managers, the list is long. Duplicity has many users: http://duplicity.nongnu.org Pass is also pretty popular on HN: https://www.passwordstore.org Both use GPG.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#162

Post by highmastdon »

Longlius wrote: post #74
capableweb wrote: post #41

> For reasons associated with U.S. export restrictions, no cryptographic security of any kind is likely to be included in the original sources https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 Creepiest thing with seeing this ticket (again?) is noticing that the first comment is about that is used to be illegal to write anything with cryptographic security in the US and sell/give it to the outside world. https://…

Any signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US…

Side note: don’t call the countries in the European Union “states”. They’re sovereign countries that have committed themselves through treaties to the Union, not a US like government body

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#163

Post by somedude11 »

nikisweeting wrote: post #22
jtsiskin wrote: post #12

Earlier quoted context omitted.

What’s wrong with PGP? Or are you referring to email

There are many things wrong with both the UX and internal cryptographic design of PGP. Here are a few articles that go over those issues in more depth: https://blog.filippo.io/giving-up-on-long-term-pgp/ https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://blog.cryptographyengineering.com/2014/08/13/whats-ma... https://secushare.org/PGP https://www.techrepublic.com/article/why-pgp-is-fundamentall...

Yet it's the best we got right now.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#164

Post by btilly »

upofadown wrote: post #127
btilly wrote: post #98

Wonderful. What an amazing amount of work to implement a terrible idea. See https://latacora.micro.blog/2019/07/16/the-pgp-problem.html for why we shouldn't be using PGP in 2020.

Gee, this anti-PGP rant showed up 3 times so far in this thread. I think that justifies a link to my critique: * https://articles.59.ca/doku.php?id=pgpfan:tpp

Honestly, I have no idea who you are. I'm not surprised that someone out there thinks that it is a good idea.

However every cryptographer that I know to trust who has bothered to comment on PGP has said to not use it. For example see https://www.schneier.com/tag/pgp/, or https://secushare.org/PGP.

Therefore I won't be using PGP. No matter how much you like it.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#165

Post by apatters »

highmastdon wrote: post #162
Longlius wrote: post #74

Earlier quoted context omitted.

Any signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US…

Side note: don’t call the countries in the European Union “states”. They’re sovereign countries that have committed themselves through treaties to the Union, not a US like government body

I don't think it's incorrect to call them states. They're nation states. They are regularly referred to as member states.

https://en.wikipedia.org/wiki/Member_state_of_the_European_U...

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#166

Post by zoltar »

highmastdon wrote: post #162
Longlius wrote: post #74

Earlier quoted context omitted.

Any signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US…

Side note: don’t call the countries in the European Union “states”. They’re sovereign countries that have committed themselves through treaties to the Union, not a US like government body

The European Union (EU) consists of 27 member states.

https://en.wikipedia.org/wiki/Member_state_of_the_European_U...

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#167

Post by jl6 »

aerovistae wrote: post #15

Never seen a timestamp on the web that said "20 years ago". Wow. Reminds me of a tiny blog post I put up years ago about the future of archaeology. Forgive the silly site title. https://meaninglessdreams.wordpress.com/2014/09/26/156/

Dropbox respects the last-modified date on your files, so it shows things like “modified 29 years ago”, which is funny to see on an iOS app.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#168

Post by dec0dedab0de »

highmastdon wrote: post #162
Longlius wrote: post #74

Earlier quoted context omitted.

Any signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US…

Side note: don’t call the countries in the European Union “states”. They’re sovereign countries that have committed themselves through treaties to the Union, not a US like government body

I'm pretty sure state meant a sovereign government before the united states existed.

Remember, the original idea of the united states was that it was a bunch of separate governments that were federated. It still kind of is, but the federal government used to have much less control.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#169

Post by stormbrew »

somedude11 wrote: post #161
tptacek wrote: post #134

Earlier quoted context omitted.

It's telling that the most common example of a widespread use of PGP (modern messaging applications exchange more messages in a day than OpenPGP has ever exchanged) is software update schemes, because software update cryptography is both a solved problem (just use signify) and doesn't have network effects; it's a "trust anchor" application. At least with PGP email, you can make the argument that PGP sticks around bec…

Backup, archivization, password managers, the list is long. Duplicity has many users: http://duplicity.nongnu.org Pass is also pretty popular on HN: https://www.passwordstore.org Both use GPG.

I use pass and I would switch in a heartbeat to a fork of it that used ssh keys or something similar instead of gpg. For something so amazingly simple and useful, its dependence on the klunky mess that is gpg key management is an anchor that weighs it down.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#170

Post by globular-toast »

shp0ngle wrote: post #129

"How much do you trust the owner of this key to sign other keys properly? * I don't know * I do NOT trust * I trust marginally * I trust fully * I trust ultimately" This is a real pop-up I got the last time I tried to use PGP with Thunderbird. If people still get regular pop-ups like these, I don't think PGP will ever be popular. They might have switched to PEP (pretty easy privacy) that uses TOFU (trust-on-first-use…

Security has a big dirty secret: it's hard. If what you're doing is easy, it ain't security. Simple as that.

TOFU works if you actually do it properly. That means verifying the fingerprint of the key you just received out of band once time. Now you can trust that key. How many people do this? Even IT professionals just routinely say yes for new ssh keys without checking. That's not TOFU, that's just trusting that you are not under attack which is not security.

TOFU is actually just a degenerative form of web of trust anyway where you just automatically say "I do not trust" to the above so that each new trusted key needs to be established individually. But it does make it easier. Easier to not be doing security at all.

Post reply on HN