Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG-Tui, a Terminal User Interface for GnuPG

orhun.dev

Post reply on HN
Print view View original

21–30 of 105 posts

Re: GPG-Tui, a Terminal User Interface for GnuPG

#21

Post by tptacek »

ekianjo wrote: post #16
doomrobo wrote: post #8

Earlier quoted context omitted.

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Signal is centralized and in no way can replace emails.

Email is default plaintext, can't force encryption on groups, leaks --- in fact, gleefully publishes --- the most important dragnet surveillance metadata (even when ostensibly encrypted), creates long term archives of secrets, is built on long term secrets, and, to boot, is in the real world itself effectively centralized. It's hard to even imagine a secure messaging system less safe than email. Recommending encrypted email is simply malpractice.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#22

Post by sneak »

JasonFruit wrote: post #7
kingo55 wrote: post #2

The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.

I really don't get this attitude, though I think it must be valid, since I seem to be almost alone in disagreement. I use plain old GPG for a lot of purposes, and I don't find its command-line usage difficult at all. Key management, encryption, decryption, signing — all of these operations are pretty straightforward. What specific tasks have you found difficult?

It's very hard to simply encrypt a file to a given pubkey (due to the key trust model) compared to, for example, something like age (where it's just `age -r $PUBKEY`). You also have to set GNUPGHOME somewhere and import the key first, you can't easily do it statelessly without tracking mud into the filesystem first.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#24

Post by klodolph »

R0b0t1 wrote: post #6
jitl wrote: post #4

While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of abandonment. All my friends in the security steer well clear of it.

If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.

It's scriptable, but scripting GPG is full of footguns. You generally want to do everything through status-fd to avoid most of the footguns, which is a pain to work with through ordinary shell scripts.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#25

Post by aborsy »

It’s straightforward to use GPG via command line. I don’t find its CLI more complex than, say, SSH’s.

I use it daily (with secret keys on a hardware key) for passwords, back up, file encryption, some email (admittedly most recipients don’t use encryption), software verification etc.

Newer tools are simpler, but GPG is also workable.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#26

Post by reifyx »

tptacek wrote: post #9
R0b0t1 wrote: post #6

Earlier quoted context omitted.

If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

I don't think people want forward secrecy for their email. If they get a new computer, they probably want all their mail on there, right? Isn't porting over their email efficiently at odds with forward secrecy? Also, is forward secrecy compatible with any kind of encrypted search (I know most encrypted search schemes leak too much these days, but if the alternative is not encrypting email at all...)?

Also, how would it work with multiple people in a thread that can be added/removed arbitrarily, or email addresses that resolve to multiple users? Messaging and email seem like different models to begin with.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#27

Post by ekianjo »

tptacek wrote: post #21
ekianjo wrote: post #16

Earlier quoted context omitted.

Signal is centralized and in no way can replace emails.

Email is default plaintext, can't force encryption on groups, leaks --- in fact, gleefully publishes --- the most important dragnet surveillance metadata (even when ostensibly encrypted), creates long term archives of secrets, is built on long term secrets, and, to boot, is in the real world itself effectively centralized. It's hard to even imagine a secure messaging system less safe than email. Recommending encrypte…

Recommending signal fails to realize that it can be compromised in many ways precisely because it is centralized. A false sense of security.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#28

Post by 0xCMP »

ekianjo wrote: post #27
tptacek wrote: post #21

Earlier quoted context omitted.

Email is default plaintext, can't force encryption on groups, leaks --- in fact, gleefully publishes --- the most important dragnet surveillance metadata (even when ostensibly encrypted), creates long term archives of secrets, is built on long term secrets, and, to boot, is in the real world itself effectively centralized. It's hard to even imagine a secure messaging system less safe than email. Recommending encrypte…

Recommending signal fails to realize that it can be compromised in many ways precisely because it is centralized. A false sense of security.

Email clients and server instances are just as centralized in practice. Yet email servers almost always know everything about you in contrast to Signal. And you can prove this by reading their code and by the fact that they respond to subpoenas with as little info as they do.

How would signal be compromised that email could not and which signal is not better prepared for?

Re: GPG-Tui, a Terminal User Interface for GnuPG

#29

Post by njt »

R0b0t1 wrote: post #12
tptacek wrote: post #9

Earlier quoted context omitted.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

I am aware of these arguments. Still, GPG exists, and no one has really proposed good solutions, or at least the solutions that have been proposed are not taking off for some reason . It is true that pointing out a problem does not need to be accompanied by a solution to be valid, but at this point, if you're going to complain please work towards solving the issue. It is too easy in this case to come off as someone w…

> GPG exists, and no one has really proposed good solutions

[...]

> if you're going to complain please work towards solving the issue

Perhaps because you are asking the wrong question: "PGP/GPG is old, broken, and insecure, what is an exact drop-in replacement that I can substitute for it?"

Instead, the question should be: "PGP/GPG is old, broken, and insecure, what is a replacement for [this specific thing I am trying to accomplish with it]?:

So what are you trying to do with GPG? Sign a package? Encrypt a file? Store a backup? Transfer a file? Send a message? There are plenty of modern, secure solutions for these.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#30

Post by aborsy »

doomrobo wrote: post #8
young_unixer wrote: post #5

Earlier quoted context omitted.

What do they use instead?

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

I wouldn’t hastily recommend unproven tools in the area security.

Here is an example of a cool tool with modern cryptography, forward secret etc, often recommended in HN as an alternative to Wormhole:

https://redrocket.club/posts/croc/

It turned out that plaintext could easily be recovered! One mistake and 100% broken.

There are benefits to an industry standard protocol.

Post reply on HN