Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

151–160 of 267 posts

Re: GPG and Me

#151

Post by SquidLord »

DanBC wrote: post #13
diyorgasms wrote: post #4

The old adage is that perfect is the enemy of good enough, but the author is claiming that GPG isn't even good enough. I have to somewhat disagree. While the ideal product in this space would be as easy to use as clicking a 'Like' button, and just as ubiquitous, GPG works well enough for now. The most sensitive use case for GPG has to be sending correspondence that, if decrypted, could put you in severe physical dang…

You've missed out "Use GPG, but perform one of many steps wrongly, and thus face torture or death". See also "deanonymizing alt.anonymous.messages" https://ritter.vg/blog-deanonymizing_amm.html

If the potential to be rendered to a blacksite or tortured to death somewhere less polite isn't sufficient motivation for people to be careful, I'm not sure "security" is their biggest problem.

Re: GPG and Me

#152

Post by JoelJacobson »

I think it's mainly GnuPG's fault. There is no API, so developers can't integrate it into their applications. The only way is to pass arguments to gpg binary and interpret the output on STDOUT using regexes. The "libraries" that exist for Python and other languages all work like this. That is why they require you to specify the "The path to the gpg executable."

If GnuPG provided a real API, then there would be hope, because the actual OpenPGP specification isn't that bad if you only implement and use the bare-minimum features.

This is one of the reasons my company developed support to deal with PGP signatures directly in PostgreSQL, without using GnuPG: https://github.com/trustly/bankapi/tree/master/debian/postgr...

It's a bit funny it's now actually safer/better/easier to use PostgreSQL instead of GnuPG if you are developing an application which uses PGP, as your only option is to pass input to the gpg executable and regex it's output, which is hackish and not suitable for production purposes.

Re: GPG and Me

#154

Post by mkesper »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

You say "cryptography of the 90s" as if the cryptography part of GnuPG was old and therefore unusable. This seems to be quite misleading to me.

Re: GPG and Me

#155

Post by na85 »

moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Blaming "1990s crypto" is, IMHO, missing the point. Until we discover attacks against the ciphers there's no reason to throw them out just due to their age.

If you're referring to GPG's shitty interface, then sure. But how much of that is "1990s crypto" and how much is due to the fact that it's one guy working by himself and barely being able to afford it, for years?

GPG with Linux-levels of support would be an entirely different beast.

edit: oh sorry, are we not allowed to disagree with Big Names™?

Re: GPG and Me

#156

Post by zobzu »

csoghoian wrote: post #99
zobzu wrote: post #92

Earlier quoted context omitted.

To be technically precise what makes 2FA easy to use is that all services are web-enabled and issue you a temporary-long-term token (ie a cookie with a session id). If you had to open an app on your phone at each login you'd get crazy real fast :) I do like your analogy tho. Digital music is a breeze to buy nowadays. Moxie seems to appear as covertly saying its misguided to donate money to GnuPG so that it finally ge…

You say "Redphone? Whisper? and various other projects - while very cool - didn't achieve even as much popularity as GnuPG" The Axolotl protocol that was created for Whisper System's TextSecure is now used, by default, by Cyanogenmod (10 million users) and the Android version of WhatsApp (more than 500 million installs from the play store). I'd say Moxie's tech has been pretty widely adopted.

Its like saying notepad is a popular because its installed with Windows.

Re: GPG and Me

#157

Post by odiroot »

copperx wrote: post #124
guelo wrote: post #114

Earlier quoted context omitted.

Get out of your bubble. Windows is ubiquitous. It has 90% of the desktop market share. There is no generalization you can come up with about that many people.

I think the OP meant that, given a choice, say, of getting a Mac or a Windows PC at work, you voluntarily pick the Windows PC.

That's also a false dichotomy, a dangerous one at that. Sort of like two party system.

Re: GPG and Me

#158

Post by pstrateman »

alrs wrote: post #136
ghshephard wrote: post #109

Earlier quoted context omitted.

GPG is way, way, way to complex for all but the 0.01% of people who are GPG experts. It's too complex for me - and I've read (and enjoyed) Applied Cryptography. But, not having used it for a few years, I went to take a look again - list some keys, maybe SMS some friends to exchange fingerprints and sign their keys, etc... - I'm trying to recall what the relationship between PUB, SUB, UID, Key Fingerprints are. And ho…

apt-get install haveged

I'm not sure why you're being down voted.

haveged is an absolute essential for all servers

http://www.issihosts.com/haveged/

Re: GPG and Me

#160

Post by zvrba »

ghshephard wrote: post #109
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

GPG is way, way, way to complex for all but the 0.01% of people who are GPG experts. It's too complex for me - and I've read (and enjoyed) Applied Cryptography. But, not having used it for a few years, I went to take a look again - list some keys, maybe SMS some friends to exchange fingerprints and sign their keys, etc... - I'm trying to recall what the relationship between PUB, SUB, UID, Key Fingerprints are. And ho…

> and been prevented by lack of entropy

This sounds like an implementation fail / lazy implementor. GPG shouldn't need more than 32 bytes of entropy (for keying AES-128 and then encrypting a 128-bit block of data repeatedly until you collect enough randomness.)

Post reply on HN