121–130 of 261 posts
Earlier quoted context omitted.
Yes, PGP is better than the Bass-o-matic ZIP cipher many implementations of ZIP use. PGP clears that very, very low bar.
I did mention "openssl enc" as well. Is there some other common bundled utility I missed? Or it's not useful to compare what's at hand? Not sure I'm getting the message behind the jab.
So author offers to replace PGP for sending files with a piece of software which requires to send/say a password to your recipient? Oh yeah, that's smart, and very modern!
Earlier quoted context omitted.
So...you are aware that "saying that makes you an asshole" and "you can't say that" are different things, yes?
Attacks on free speech in USA and Europe have nothing to do with offensive language and everything to do with control. Be careful what precedents you set and what things you celebrate. Pendulums swing. Are you referring to this? I don't think anybody tried to censor her for this, even though it was incredibly offensive. https://talkingpointsmemo.com/news/tlaib-going-to-impeach-mo...
Please...this is ridiculous. Nobody falls for that besides the right wingers themselves.
Nobody wants the right circle jerk in their comment section. The same way the right doesn't want any criticism of their behavior within their own bubble portals.
As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)
Earlier quoted context omitted.
I did mention "openssl enc" as well. Is there some other common bundled utility I missed? Or it's not useful to compare what's at hand? Not sure I'm getting the message behind the jab.
"openssl enc" requires you to select from over 105 different cipher constructions, virtually all of which are terribly insecure.
Earlier quoted context omitted.
I did mention "openssl enc" as well. Is there some other common bundled utility I missed? Or it's not useful to compare what's at hand? Not sure I'm getting the message behind the jab.
"openssl enc" requires you to select from over 105 different cipher constructions, virtually all of which are terribly insecure.
Earlier quoted context omitted.
Keybase is one version of a modern take on Web of Trust. https://keybase.io/
Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/
So author offers to replace PGP for sending files with a piece of software which requires to send/say a password to your recipient? Oh yeah, that's smart, and very modern!
It is indeed. Magic Wormhole implements a PAKE to individually encrypt and authenticate a secure channel without requiring any other root of trust. It's exceptionally easy to use and secure.
- both parties to be online at the same time
- have access to a secured channel to transfer the secret
- Transfer a new autogenerated secret for each file transfer.
PGP lets you:
- verify the key once
- re-use the key
- the key be submitted through a public channel
- the verification be done in a public (though tamper proof) channel or by web of trust
- the file be stored in transit, no need for online
But obviously, if the complaint is that pgp is too complex, then each single tool to replace some functionality doesn’t cover the whole spectrum.
Some problems PGP (these days, this means GnuPG) solves pretty well for me: - offline encryption; - distributed web of trust; - digital signature (for messages and software packages); - batch processing; - certification of other users without a server at all; - ability to use a completely "offline" infrastructure; - sending messages without revealing the actual recipient (i.e. --hidden-recipient) - multiplatform; - e…
Of your list, the alternatives that George provided check off: - offline encryption - digital signatures - batch processing - no server - offline infrastructure - "hidden recipient" (which, ironically, is a command line flag to mitigate a flaw in PGP, and not in fact a feature of PGP) - multiplatform - easy to integrate - copying and pasting ciphertext - open source and well-tested - not bound to phones - not being a…
I believe what the parent likes about "all in a single package" is the practicality and simplicity that this brings to the user: you could either just install gpg and read the man, or review tens of different relatively new applications (none of them widely used, yet) for each step of your normal workflow, learning their different interfaces and quirks, and then keeping yourself updated of any new disclosed vulnerability that may affect your custom crypto tool set.
Obviously a small application that only do one thing hopefully right should be, at least in principle, easier to maintain and audit (and therefor safer) than the ol' swiss army knife of cryptographic communications, but the convenience of all-in-one is also a reality that shouldn't be overlooked.
Some problems PGP (these days, this means GnuPG) solves pretty well for me: - offline encryption; - distributed web of trust; - digital signature (for messages and software packages); - batch processing; - certification of other users without a server at all; - ability to use a completely "offline" infrastructure; - sending messages without revealing the actual recipient (i.e. --hidden-recipient) - multiplatform; - e…
Of your list, the alternatives that George provided check off: - offline encryption - digital signatures - batch processing - no server - offline infrastructure - "hidden recipient" (which, ironically, is a command line flag to mitigate a flaw in PGP, and not in fact a feature of PGP) - multiplatform - easy to integrate - copying and pasting ciphertext - open source and well-tested - not bound to phones - not being a…
Maybe the article should mention scrypt (https://www.tarsnap.com/scrypt.html) as a tool for password-based offline encryption/decryption. That tool seems like it might be a good replacement for `gpg -c`. It is frustrating though because its name is almost un-googleable (most results just talk about "scrypt" as a hashing function, rather than "scrypt" the encryption tool! It really needs a better name) and I rarely see it mentioned. It doesn't even seem to have a recommend file extension for encrypted data, which bothers me possibly more than it should. Its files aren't recognizable.
Magic wormhole is extremely cool though and does replace a big subset of my GPG usage.