Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG-Tui, a Terminal User Interface for GnuPG

orhun.dev

Post reply on HN
Print view View original

61–70 of 105 posts

Re: GPG-Tui, a Terminal User Interface for GnuPG

#61

Post by forgotpwd16 »

stingraycharles wrote: post #42
aborsy wrote: post #25

It’s straightforward to use GPG via command line. I don’t find its CLI more complex than, say, SSH’s. I use it daily (with secret keys on a hardware key) for passwords, back up, file encryption, some email (admittedly most recipients don’t use encryption), software verification etc. Newer tools are simpler, but GPG is also workable.

For me the problem is that I use ssh way more often, so it’s easier to remember all the commands. I need to encrypt/decrypt something with GPG only a few times a year, and every time I struggle remembering the commands to do so.

   gpg --help
provides an one line description of necessary commands. And ecrypt/decrypt is just `gpg --encrypt/decrypt`. You don't even have to specify an output file. Encrypt automatically creates a new file and decrypt outputs result in console so to put it new file a redirection is enough.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#62

Post by throwaway45209 »

aborsy wrote: post #30
doomrobo wrote: post #8

Earlier quoted context omitted.

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

I wouldn’t hastily recommend unproven tools in the area security. Here is an example of a cool tool with modern cryptography, forward secret etc, often recommended in HN as an alternative to Wormhole: https://redrocket.club/posts/croc/ It turned out that plaintext could easily be recovered! One mistake and 100% broken. There are benefits to an industry standard protocol.

croc wasn't recommended by people on HN who knew something about cryptography, and they actually warned against it.

They recommended Brian Warner's magic-wormhole, Signal, Tarsnap, age, Signify, Minisign, libsodium.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#63

Post by throwaway45209 »

upofadown wrote: post #53
doomrobo wrote: post #8

Earlier quoted context omitted.

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Signal is an instant messenger ... which is fine, but sometimes you really do need the extra security provided by an offline messaging solution like OpenPGP. The Cellebrite thing was a good example of this. Cellebrite doesn't get OpenPGP messages as they can and are usually protected by a passphrase. Cellebrite gets Signal messages.

Enabling 'disappearing messages' will help I think.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#64

Post by cpach »

upofadown wrote: post #53
doomrobo wrote: post #8

Earlier quoted context omitted.

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Signal is an instant messenger ... which is fine, but sometimes you really do need the extra security provided by an offline messaging solution like OpenPGP. The Cellebrite thing was a good example of this. Cellebrite doesn't get OpenPGP messages as they can and are usually protected by a passphrase. Cellebrite gets Signal messages.

In that case I would recommend Age. It’s a modern and sound replacement for GPG.

https://age-encryption.org/

Re: GPG-Tui, a Terminal User Interface for GnuPG

#66

Post by cpach »

stingraycharles wrote: post #42
aborsy wrote: post #25

It’s straightforward to use GPG via command line. I don’t find its CLI more complex than, say, SSH’s. I use it daily (with secret keys on a hardware key) for passwords, back up, file encryption, some email (admittedly most recipients don’t use encryption), software verification etc. Newer tools are simpler, but GPG is also workable.

For me the problem is that I use ssh way more often, so it’s easier to remember all the commands. I need to encrypt/decrypt something with GPG only a few times a year, and every time I struggle remembering the commands to do so.

As pointed out elsewhere in these threads there are now much better alternatives available. It’s time for PGP to retire.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#68

Post by xorcist »

user3939382 wrote: post #34
kingo55 wrote: post #2

The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

In the situation where you want to distribute a sensitive file without a trusted third party of any kind of key infrastructure in place, it's probably easier to not bother with public key encryption. Which isn't too bad:

  gpg -c secretfile.zip
Not sure it can get much easier? To decrypt:

  gpg secretfile.zip.gpg
The point is that gpg is a tool that most people either already have or can install in a trusted way without downloading binaries from public web pages. Even more common to have installed is openssl:

  openssl enc -aes256 -in secretfile.zip -out secretfile.zip.enc
  openssl enc -d -aes256 -in secretfile.zip.enc -out secretfile.zip
Using these tools are perfectly secure for all practical attacks. The hard part is transmitting the password over a secure channel.

Public key encryption is even more useful, but requires a little more knowledge on the end user's part on key pairs, signing keys, publishing them etc. Should an end user just wish to transmit an encrypted file then symmetric encryption is easier to understand.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#69

Post by swiley »

beermonster wrote: post #51
user3939382 wrote: post #34

Earlier quoted context omitted.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

If you want to send something securely, I’m not sure email is the best method. Even if you understand all the risks and pitfalls and side-step the minefields it’s still insecure in non-fixable ways. ProtonMail make a service out if it mitigating those issues as best they can (but even they explain their threat-model and what they DON’T mitigate. Others such as Silent Circle ended up giving up. You could recommend to…

Signal is not secure if you're concerned about the App Store maintainer or Signal themselves having access to your data (you can't know what the contents of the app on the app store are and it my exfiltrate keys. This has been done with other similar apps in the past.)

Re: GPG-Tui, a Terminal User Interface for GnuPG

#70

Post by williamtwild »

cpach wrote: post #66
stingraycharles wrote: post #42

Earlier quoted context omitted.

For me the problem is that I use ssh way more often, so it’s easier to remember all the commands. I need to encrypt/decrypt something with GPG only a few times a year, and every time I struggle remembering the commands to do so.

As pointed out elsewhere in these threads there are now much better alternatives available. It’s time for PGP to retire.

With tour logic , Keurig exists so get rid of teapots? No thanks.
Post reply on HN