GPG-Tui, a Terminal User Interface for GnuPG • Hacker News Board

Re: GPG-Tui, a Terminal User Interface for GnuPG

#11

Post by georgyo » Sun, May 30, 2021, 2:39 AM UTC

doomrobo wrote: post #8

young_unixer wrote: post #5

Earlier quoted context omitted.

What do they use instead?

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

I'm still think that OpenPGP is the best solution for the first two. But the two tools at the top have the same problems as pgp.

How do you trust some key material. The WoT is a complete failure, but modern solutions like WKD are amazing and make PGP just plain work.

The one nice thing about age is the ability to encrypt to a GitHub users key. However, even that is possible with OpenPGP. Here is a tool that I made ~7 years ago that does something similar: https://github.com/georgyo/sshcrypt

Another thing minisign/age don't have is a method to say that a key is compromised.

I don't think the solution to the problems with OpenPGP is too just ignore the problems and switch to using bare keys like new tools are doing.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#12

Post by R0b0t1 » Sun, May 30, 2021, 2:48 AM UTC

tptacek wrote: post #9

R0b0t1 wrote: post #6

Earlier quoted context omitted.

If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

I am aware of these arguments. Still, GPG exists, and no one has really proposed good solutions, or at least the solutions that have been proposed are not taking off for some reason.

It is true that pointing out a problem does not need to be accompanied by a solution to be valid, but at this point, if you're going to complain please work towards solving the issue. It is too easy in this case to come off as someone who "knows things" while gesticulating at GPG in a derogatory manner while still accomplishing nothing.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#13

Post by lapinot » Sun, May 30, 2021, 2:55 AM UTC

tptacek wrote: post #9

R0b0t1 wrote: post #6

Earlier quoted context omitted.

If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

What's your opinion on recent sequoia implementation? I've heard your arguments numerous times and was quite convinced, but that project and their offsprings (openpgp-ca, hagrid, ..) and other stuff like wkd seem to drag the ecosystem to something nicer. I consider it promising.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#14

Post by [deleted] » Sun, May 30, 2021, 2:56 AM UTC

JasonFruit wrote: post #7

kingo55 wrote: post #2

The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.

I really don't get this attitude, though I think it must be valid, since I seem to be almost alone in disagreement. I use plain old GPG for a lot of purposes, and I don't find its command-line usage difficult at all. Key management, encryption, decryption, signing — all of these operations are pretty straightforward. What specific tasks have you found difficult?

[deleted]

Re: GPG-Tui, a Terminal User Interface for GnuPG

#15

Post by akerl_ » Sun, May 30, 2021, 2:57 AM UTC

R0b0t1 wrote: post #12

tptacek wrote: post #9

Earlier quoted context omitted.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

I am aware of these arguments. Still, GPG exists, and no one has really proposed good solutions, or at least the solutions that have been proposed are not taking off for some reason . It is true that pointing out a problem does not need to be accompanied by a solution to be valid, but at this point, if you're going to complain please work towards solving the issue. It is too easy in this case to come off as someone w…

Signal/WhatsApp/etc certainly seem to be taking off, and they seem to cover a broad swath of the use cases in messaging that people have historically tried to use GPG for.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#16

Post by ekianjo » Sun, May 30, 2021, 3:09 AM UTC

doomrobo wrote: post #8

young_unixer wrote: post #5

Earlier quoted context omitted.

What do they use instead?

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Signal is centralized and in no way can replace emails.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#17

Post by rodgerd » Sun, May 30, 2021, 3:25 AM UTC

tptacek wrote: post #9

R0b0t1 wrote: post #6

Earlier quoted context omitted.

If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

> The best-known problem with PGP is its poor usability, but that's not its biggest problem.

I don't know - if the design were more sounds from a crypto perspective, but it was still as easy to fuck up as the current interface, would it really be better?

Re: GPG-Tui, a Terminal User Interface for GnuPG

#18

Post by tptacek » Sun, May 30, 2021, 3:32 AM UTC

lapinot wrote: post #13

tptacek wrote: post #9

Earlier quoted context omitted.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

What's your opinion on recent sequoia implementation? I've heard your arguments numerous times and was quite convinced, but that project and their offsprings (openpgp-ca, hagrid, ..) and other stuff like wkd seem to drag the ecosystem to something nicer. I consider it promising.

I think things written in Rust are better than things written in C. I think modern AEAD cryptography is better than the 90s cryptography that GPG uses. I think the PGP installed base mires the whole ecosystem in C code that accidentally goes quadratic just trying to parse keys, no matter what happens with Sequoia. It's a good project --- this TUI is probably a good project too --- but in a doomed ecosystem.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#19

Post by tptacek » Sun, May 30, 2021, 3:33 AM UTC

AlexCoventry wrote: post #10

tptacek wrote: post #9

Earlier quoted context omitted.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

Is there a way to do forward security in a non-interactive protocol (which seems necessary, if you want to communicate over email?) I guess users could publish partial key exchanges out of band?

Don't use encrypted email. Encrypted email is deeply problematic, for many reasons having little to do with PGP.

https://latacora.micro.blog/2020/02/19/stop-using-encrypted....

Re: GPG-Tui, a Terminal User Interface for GnuPG

#20

Post by tptacek » Sun, May 30, 2021, 3:33 AM UTC

akerl_ wrote: post #15

R0b0t1 wrote: post #12

Earlier quoted context omitted.

I am aware of these arguments. Still, GPG exists, and no one has really proposed good solutions, or at least the solutions that have been proposed are not taking off for some reason . It is true that pointing out a problem does not need to be accompanied by a solution to be valid, but at this point, if you're going to complain please work towards solving the issue. It is too easy in this case to come off as someone w…

Signal/WhatsApp/etc certainly seem to be taking off, and they seem to cover a broad swath of the use cases in messaging that people have historically tried to use GPG for.

It's always funny to see people talk about how important it is that PGP has an installed base and then think about how many PGP users there are compared to Signal Protocol users.