Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPGMail 2 is finally here

gpgtools.org

Post reply on HN
Print view View original

11–20 of 77 posts

Re: GPGMail 2 is finally here

#11

Post by BjoernKW »

blakeperdue wrote: post #9

How does this work? I assume all encrypted emails require both parties use the software, right? So, all my friends, associates, coworkers have to have GPGMail to read my encrypted emails?

No, they just have to use GPG or PGP. GPGMail is just a front-end for those tools.

Re: GPGMail 2 is finally here

#13

Post by lukele »

blakeperdue wrote: post #9

How does this work? I assume all encrypted emails require both parties use the software, right? So, all my friends, associates, coworkers have to have GPGMail to read my encrypted emails?

GPGMail uses a very well known and white spread technology OpenPGP as its base. Everyone you want to use it with has to have a mail client which supports OpenPGP in one form or another, but there are many plugins out there, who add support for your favorite mail clients on windows and linux.

Enigmail for Thunderbird: http://www.enigmail.net/home/index.php

GPG4Win provide plugins for Outlook: http://gpg4win.org

Evolution on Linux has OpenPGP support built in.

FYI: Another term used for OpenPGP is gnupg or GPG, should you want to google for other solutions on other operating systems.

Re: GPGMail 2 is finally here

#14

Post by Kaali »

blakeperdue wrote: post #9

How does this work? I assume all encrypted emails require both parties use the software, right? So, all my friends, associates, coworkers have to have GPGMail to read my encrypted emails?

GPG uses asymmetric keypairs for encryption. You generate (at the same time), two different keys: a private key and a public key. The private key is your identity, which you can use to sign outgoing messages, and decrypt incoming messages. The public key, you share to your associates can be used to verify your signature, or encrypt messages only meant for you.

With asymmetricity, the public key is a key which can only encrypt the message, but even the sender cannot decrypt that same message again with that key. Only the single unshared private key can decrypt them.

This ofcourse means that all parties must have their own key pair, and the public keys have been shared between them. Also they must use a GPG compliant program to encrypt/decrypt or sign and verify the messages.

Re: GPGMail 2 is finally here

#17

Post by Steuard »

blakeperdue wrote: post #9

How does this work? I assume all encrypted emails require both parties use the software, right? So, all my friends, associates, coworkers have to have GPGMail to read my encrypted emails?

It's a typical crypto add-on for a mail client, yes: you can only exchange encrypted mail with other folks who can use PGP. That's pretty much how crypto works.

But to be clear, this is just an interface to the MacGPG backend, so it's not some proprietary format. Your friends, etc. don't need to use GPGMail in particular; any PGP implementation will be fine.

Re: GPGMail 2 is finally here

#18

Post by lukele »

Osmium wrote: post #12

I thought they just announced a new version recently? Is this a new version again, or just a new website?

All versions before this were beta. This is the stable version of GPGMail 2 with 77 bugs fixed from the last beta, so you should update.

Re: GPGMail 2 is finally here

#19

Post by joshuak »

My company's internal mail goes through gmail so I decided after recent news to setup GPGmail and s/mime.

I identified a couple of usability issues, which where fixed. I'd say all in all its very good.

Regardless if you believe or care about the NSA issues, simply the idea of routing clear text email through mail exchanges, and advertisers should give you enough reason to follow the few steps it requires to generate a key, and start encrypting and/or signing email. Except for post cards we don't do this with our regular mail, so why are you ok with it with you email (and your email is far more machine readable).

GPGMail is not quite Grandmother ready, and unlike s/mime it doesn't really have an incremental value[1], but it is far more secure, and very easy to use once setup. Plus the other tools in the toolkit are useful for general encryption.

s/mime is another option, here are some pros and cons:

s/mime pros

  integrated with many mail apps
  usually plays nice with mailing lists (adding a footer doesn't invalidate a sig)
  works on iOS devices (perhaps others?)
  has an incremental value even before all your contacts are using it[1]
s/mime cons

  based on a certificate authority model
  cost money depending on the cert you get
  requires a 3rd 'trusted' party
  does not seem to be secure in some respects:
    (web cert generation, no rules regarding sigh/encrypt/sign[2],
    does not make use of a certificate request so anyone who has
    even momentary access to your email can generate a cert to
    masquerade as you)
  your identity is associate with your email address not you
    (you will need certs for each email address)
--

GPGmail/tools pros

  Based on web of trust instead of CA (web of trust is not required)
  You can revoke your key if it is compromised
  Based on you not your email, so you can use the same sig with any email address
  You can even associate your picture with your key
  Optional Anonymity
  Strong cryptography
  Use the same keys for non email encryption
  Free
GPGmail/tools cons

  Less widely integrated.
  Does not work on devices yet.
  May break email lists (adding footers may change the sig, I haven't tested though)
  Can't help much until your have other people to use it with.
[1] With s/mime you can sign email documents even if your friends don't have s/mime that can still see your signature is validate.

[2] See the answer by Adam Liss (not the accepted answer) for the security issues http://stackoverflow.com/questions/13512026/how-to-check-if-...

[Edit: formatting]

Post reply on HN