GPG-Tui, a Terminal User Interface for GnuPG • Hacker News Board

Re: GPG-Tui, a Terminal User Interface for GnuPG

#101

Post by ekianjo » Mon, May 31, 2021, 1:02 PM UTC

0xCMP wrote: post #28

ekianjo wrote: post #27

Earlier quoted context omitted.

Recommending signal fails to realize that it can be compromised in many ways precisely because it is centralized. A false sense of security.

Email clients and server instances are just as centralized in practice. Yet email servers almost always know everything about you in contrast to Signal. And you can prove this by reading their code and by the fact that they respond to subpoenas with as little info as they do. How would signal be compromised that email could not and which signal is not better prepared for?

> Email clients and server instances are just as centralized in practice.

I don't follow. Not everyone uses Gmail or the big email providers.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#102

Post by kasey_junk » Mon, May 31, 2021, 2:05 PM UTC

ekianjo wrote: post #101

0xCMP wrote: post #28

Earlier quoted context omitted.

Email clients and server instances are just as centralized in practice. Yet email servers almost always know everything about you in contrast to Signal. And you can prove this by reading their code and by the fact that they respond to subpoenas with as little info as they do. How would signal be compromised that email could not and which signal is not better prepared for?

> Email clients and server instances are just as centralized in practice. I don't follow. Not everyone uses Gmail or the big email providers.

If anyone on the communication thread uses GMail or the other big providers then the entire conversation is subject to the weaknesses of the protocol.

Right now that sits at about a 1 in 5 chance for Gmail alone.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#103

Post by tptacek » Mon, May 31, 2021, 4:27 PM UTC

reifyx wrote: post #99

tptacek wrote: post #96

Earlier quoted context omitted.

Again: without forward secrecy, you can't delete old messages, because your adversary has already recorded them. The point is that a lack of forward secrecy creates a subtle limit to the security that can be achieved.

Yes, that's exactly what we both agreed on 6 comments ago. The question is, is the ability to delete messages critical enough to require in any possible secure messaging solution, at the expense of features like email search, archiving, backup, and transfer-to-new-device?

Yes, it obviously is.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#104

Post by xorcist » Tue, Jun 01, 2021, 7:22 AM UTC

tptacek wrote: post #89

xorcist wrote: post #68

Earlier quoted context omitted.

In the situation where you want to distribute a sensitive file without a trusted third party of any kind of key infrastructure in place, it's probably easier to not bother with public key encryption. Which isn't too bad: gpg -c secretfile.zip Not sure it can get much easier? To decrypt: gpg secretfile.zip.gpg The point is that gpg is a tool that most people either already have or can install in a trusted way without…

Never use the OpenSSL CLI to encrypt things. It creates unauthenticated ciphertext. It is anything but "perfectly secure". I don't think it's even the case that the OpenSSL project wants you to be using their code this way. It's just that Unix nerds (hey: it me) find things like this and adopt them, then write things about how they're "perfectly secure" in message board slapfights. It's a microcosm of the whole probl…

Given the use case here, where someone wants to send a single file to someone else, with no pre-existing way to communicate securely, why would it matter? The only practical attacks would be on the passphrase itself (which they have no way of protecting). The fact that openssl accepts any passphrase is likely a bigger problem in practice than the lack of authentication.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#105

Post by njt » Mon, Jun 07, 2021, 6:07 AM UTC

R0b0t1 wrote: post #85

njt wrote: post #81

Earlier quoted context omitted.

> these things still do not seem to get adopted If I understand your comment correctly, the reason you are using an old, insecure, and broken tool is because the secure replacement is not as widely used? Are you looking for some specific percentage of the population to adopt it? What is that threshold? > Signal is OK I guess, but still does not solve a lot of things a decentralized system can. Serious question: what…

Bunch of straw questions, I don't care to answer them. Answer your own pointless questions.

> Bunch of straw questions, I don't care to answer them. Answer your own pointless questions.

By "straw question", you are implying that I replaced your argument with a false one.

In the upstream comments, you agreed that PGP/GPG is broken and insecure. We have no difference of opinion there. You then stated that the reason you still continue to use it is because a) the alternatives are not getting adopted and b) are not decentralized. You also c) questioned the motives of people suggesting the alternatives, and d) stated that they have not used them in existing workflows.

All of these are things _you_ stated, I was careful to quote each point you made as I responded to them.

If I misstated your position or replaced it with a straw man, feel free to point out where I did that and I'll gladly correct myself.