Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using GPG to Encrypt Your Data

nas.nasa.gov

Post reply on HN
Print view View original

11–20 of 100 posts

Re: Using GPG to Encrypt Your Data

#11

Post by jesseb »

HappyTypist wrote: post #5
parfe wrote: post #2

>We suggest that you include five words of 5-10 letters in size, chosen at random, with spaces, special characters, and/or numbers embedded into words. >You need to be able to recall the passphrase that was used to encrypt the file. Why bother writing security guidelines which are impossible for a human to follow? edit: Try recalling any passphrases generated by the command below, and that's before the random sprinkl…

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

At work I constantly deal with people who can't remember passwords as short as 8 characters, you have to remember we're not representative of the average person.

Re: Using GPG to Encrypt Your Data

#12

Post by jph »

gcp wrote: post #4
discreditable wrote: post #3

Why would they not use asymmetric encryption?

...and why encrypt stuff transferred with scp?

NASA has historically done at least some open transfers, such as HTTP, FTP, etc. Using GPG for these is good. And it keeps the file encrypted at rest too.

Re: Using GPG to Encrypt Your Data

#13

Post by keymone »

jesseb wrote: post #11
HappyTypist wrote: post #5

Earlier quoted context omitted.

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

At work I constantly deal with people who can't remember passwords as short as 8 characters, you have to remember we're not representative of the average person.

you should ask them what they prefer - remembering 8 random characters or 4 random words

Re: Using GPG to Encrypt Your Data

#14

Post by LordKano »

HappyTypist wrote: post #5
parfe wrote: post #2

>We suggest that you include five words of 5-10 letters in size, chosen at random, with spaces, special characters, and/or numbers embedded into words. >You need to be able to recall the passphrase that was used to encrypt the file. Why bother writing security guidelines which are impossible for a human to follow? edit: Try recalling any passphrases generated by the command below, and that's before the random sprinkl…

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

That's a good long term solution but when policies force you to change your password every 45 days, it falls apart.

In my experience, overly restrictive password policies force users to choose passwords that are less secure and easier to remember.

Re: Using GPG to Encrypt Your Data

#15

Post by larose »

jph wrote: post #8

For GPG symmetric encryption, the kind the article describes, here are the best options I've found for my typical case: gpg --symmetric \ --cipher-algo aes256 \ --digest-algo sha256 \ --cert-digest-algo sha256 \ --compress-algo none -z 0 \ --quiet --no-greeting \ --no-use-agent "$@" I keep this command here: https://github.com/SixArm/gpg-encrypt The options are chosen to balance tradeoffs of convenience, strength, an…

I did something similar to gpg-encrypt: https://github.com/larose/eef/

It's a wrapper for gpg to edit encrypted files.

Re: Using GPG to Encrypt Your Data

#16

Post by Spooky23 »

LordKano wrote: post #14
HappyTypist wrote: post #5

Earlier quoted context omitted.

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

That's a good long term solution but when policies force you to change your password every 45 days, it falls apart. In my experience, overly restrictive password policies force users to choose passwords that are less secure and easier to remember.

The good news is that the practice is going away NIST revised it's guidance/recommendation for password cycling.

Re: Using GPG to Encrypt Your Data

#17

Post by rakoo »

discreditable wrote: post #3

Why would they not use asymmetric encryption?

Because the paragraph on key generation and management would be 3 times as long as the entire article in its current form ?

Asymmetric encryption solves the problem of transmitting the password safely ("solve" is a rather optimistic word, maybe "delegates" is more appropriate); if you can safely transfer passwords from point to point, then using symmetric encryption is far easier.

Re: Using GPG to Encrypt Your Data

#18

Post by COil »

LordKano wrote: post #14
HappyTypist wrote: post #5

Earlier quoted context omitted.

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

That's a good long term solution but when policies force you to change your password every 45 days, it falls apart. In my experience, overly restrictive password policies force users to choose passwords that are less secure and easier to remember.

Yes indeed. For example they add the current year and month and keep the same "base password" which is unsafe.

Re: Using GPG to Encrypt Your Data

#19

Post by eriknstr »

HappyTypist wrote: post #5
parfe wrote: post #2

>We suggest that you include five words of 5-10 letters in size, chosen at random, with spaces, special characters, and/or numbers embedded into words. >You need to be able to recall the passphrase that was used to encrypt the file. Why bother writing security guidelines which are impossible for a human to follow? edit: Try recalling any passphrases generated by the command below, and that's before the random sprinkl…

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

Embedding special characters only makes it harder to remember correctly yet has little benefit. Your example is the same used in the xkcd where they explain this (except you've added an additional word at the beginning) so you've probably seen it already but I'll link it anyways. https://xkcd.com/936/

Re: Using GPG to Encrypt Your Data

#20

Post by tptacek »

jph wrote: post #8

For GPG symmetric encryption, the kind the article describes, here are the best options I've found for my typical case: gpg --symmetric \ --cipher-algo aes256 \ --digest-algo sha256 \ --cert-digest-algo sha256 \ --compress-algo none -z 0 \ --quiet --no-greeting \ --no-use-agent "$@" I keep this command here: https://github.com/SixArm/gpg-encrypt The options are chosen to balance tradeoffs of convenience, strength, an…

What is this getting you that a simple 'gpg -c' isn't?

(I'm asking seriously; I don't have a strong opinion about GPG command line arguments)

Post reply on HN