Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPGMail 2 is finally here

gpgtools.org

Post reply on HN
Print view View original

71–77 of 77 posts

Re: GPGMail 2 is finally here

#71

Post by Camillo »

lukele wrote: post #42
Camillo wrote: post #37

Earlier quoted context omitted.

They just shipped support for Mountain Lion, which was released one year ago. I hope there is not as big a delay for Mavericks. I understand that it's a volunteer project, but a kickstarter could surely help them muster the $100 for a Mac developer subscription and access to the developer previews of 10.9.

10.9 is being actively tested internally and we've already released two hacked together preview versions for it. Doing everything we can to be on time this time for real.

Great!

Re: GPGMail 2 is finally here

#72

Post by gcv »

cel wrote: post #70
Steuard wrote: post #46

Earlier quoted context omitted.

There is a "Customize" option in the installer that seems to provide an option to not install MacGPG, but I haven't tried that to make sure.

Yes, you can choose to install GPGMail, GPGPreferences, etc., without MacGPG, and use your own gpg binaries such as from homebrew.

I tried installing GPGMail stand-alone with a previous version, and it caused Mail.app to crash on start, presumably because /usr/local/bin/gpg was not available.

Re: GPGMail 2 is finally here

#73

Post by gcv »

lukele wrote: post #43
gcv wrote: post #21

The last version of GPGTools I looked at had the irritating habit of always installing its own copy of GPG into /usr/local and not letting me use my own version (e.g., from Homebrew). Is this still the case in version 2? It would be far cleaner if it was more self-contained (e.g., included GPG inside its installation bundle), and then let the user pick an alternative OpenPGP installation in the preferences.

It's "self-contained" in /usr/local/MacGPG2. Only creates symlinks into /usr/local/bin but will avoid that if it recognizes another gpg already being linked there. Also, linking warnings when using homebrew's GPG are resolved.

I see. This isn't clean enough for my tastes. I run Homebrew from a custom directory, not /usr/local, and I want to make GPGMail refer to the gpg binary there. No Mac app installer should ever write anything to /usr/local.

PS: If you are a maintainer, thank you for all the hard work. I'm only criticizing the current installation system because I really want to use GPGMail, and it does not fit into the way I like to set up my machine.

Re: GPGMail 2 is finally here

#74

Post by e12e »

napoleond wrote: post #67
joshuak wrote: post #19

My company's internal mail goes through gmail so I decided after recent news to setup GPGmail and s/mime. I identified a couple of usability issues, which where fixed. I'd say all in all its very good. Regardless if you believe or care about the NSA issues, simply the idea of routing clear text email through mail exchanges, and advertisers should give you enough reason to follow the few steps it requires to generate…

GPGMail is not quite Grandmother ready My little company is working on an encrypted email solution that is-- http://parley.co will be entering pre-beta next week :)

Since you seem to server your site (parley.co) over https, you might want to accept signups over https as well -- it's a little disconcerting to get a warning message of information being posted in the clear from a page that is all about making it easier to communicate securely online:
Other than that it'll be interesting to see your implementation -- I've been considering the idea of key storage for a while, and I also think so long smart cards aren't ubiquitous (and usable with all clients, such as phones as well as PCs) -- pass-phrases is unfortunately as good as it gets.

It's unfortunate, because anything based on shared secretes (directly) makes key revocation tricky.

Re: GPGMail 2 is finally here

#75

Post by e12e »

lbenes wrote: post #63

I had some experience with GnuPG and Symantec PGP and Outlook a few years back. All non-public information like CAD files were supposed to be PGP encrypted. Yet, even the engineers would send most files in plain text. I remember many times having to logmein to a clients machine to try to figure out why they couldn't read our emails. This is why PGP never took off. Until the tools take 5 min to setup, and encryption/d…

I'd say ("first time") setup is pretty easy (and has been for a while). The tricky part (as always) is managing the keys (the private key, and the (optional) revocation key) -- and managing trust.

Key management is tricky because if you have a truly secure pass-phrase (that is, one that contains >= 128 bits "worth" of entropy (or even >= 65 bits which might be enough), a pass-phrase that can be considered at least as secure as the symmetric session keys) -- then that is going to be awkward to type in (and remember). And if you don't -- then you need to be (extra) careful about where you store your secret key ring, where it is backed up, etc (you should be careful about this anyway).

And it is still tricky to carefully manage which keys you trust, and bootstrapping trust is hard. The latter can be alleviated somewhat by having a few "designated CAs" in a company -- eg: have the IT department set up GPG, and make sure that they verify and sign people's keys along with setting up accounts etc.

Re: GPGMail 2 is finally here

#76

Post by napoleond »

e12e wrote: post #74
napoleond wrote: post #67

Earlier quoted context omitted.

GPGMail is not quite Grandmother ready My little company is working on an encrypted email solution that is-- http://parley.co will be entering pre-beta next week :)

Since you seem to server your site (parley.co) over https, you might want to accept signups over https as well -- it's a little disconcerting to get a warning message of information being posted in the clear from a page that is all about making it easier to communicate securely online: Other than that it'll be interesting to see your implementation -- I've been considering the idea of key storage for a while, and I a…

Thanks for the heads up! We just set up SSL for the main site, and obviously missed a few things--I'll fix that right now.

Re: GPGMail 2 is finally here

#77

Post by wiml »

undoware wrote: post #26

This is just MacOS nonsense. It plays in the Valley and at the mall, and nowhere else. The only reason it is on the front page of Hacker News is that we can't see outside our own event horizon. Poke me when a popular web email service implements GPG.

https://github.com/seancolyer/gmail-crypt http://www.curetheitch.com/projects/webpg-chrome/ http://www.mailvelope.com/ https://github.com/crised/SafeGmail

That was ten minutes of looking. (Of course, you still have to trust your webmail provider completely... but that's the price of webmail.)

Post reply on HN