Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

171–180 of 267 posts

Re: GPG and Me

#171

Post by qznc »

napoleond wrote: post #73
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

What do you think that looks like, though? Is it TextSecure on the desktop, with file attachments? Is it Pond? Is it just email, but with a different crypto layer? I feel like a lot of the things GPG aims to do are fundamentally hard. It's not the technology that sucks, it's the problem . I completely agree that the answer will come from thinking about user interactions first, but I'm not sure that the solution will…

I also believe that some complexity is inherent to secure communication, so people are required to learn a little to properly use this. Hopefully, this will be taught in high school or earlier at some point.

However, I also (like Moxie) believe PGP is not at the sweet spot. It has too much complexity for the most popular use cases. Thank you Moxie and others who are searching for the sweet spots.

Re: GPG and Me

#172

Post by 59nadir »

oskarth wrote: post #170
59nadir wrote: post #168

Earlier quoted context omitted.

Perhaps it would be better to leverage your position and your knowledge and come up with something before you write up a post like this? As other commenters have pointed out, you're in a prime position to actually come up with a working concept instead of just writing your opinion about it. I don't open a link to Paul Graham's site to read "Shit's bad, guys, and here are some fairly shallow reasons why I feel I can m…

In case you didn't know, Moxie is already doing that https://whispersystems.org/ In any case, your point still stands, generally speaking.

Yes, I was referring to the post itself, which is essentially just complaining in the end. I am surprised it reached the top of HN, considering it really adds nothing.

Re: GPG and Me

#173

Post by qznc »

ChecusIban wrote: post #133
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

It's one thing to recognize the limitations of GPG. I think we all do. It's another to declare it an abject failure and continue to use it and complain. Go generate a revocation certificate and push it to the global pool. You'll stop getting those disappointing emails. But seriously, go build something better. I fucking dare you. We'd all be better off for it if you really did.

He does build something: https://whispersystems.org/

Re: GPG and Me

#174

Post by Saavedro »

pstrateman wrote: post #158
alrs wrote: post #136

Earlier quoted context omitted.

apt-get install haveged

I'm not sure why you're being down voted. haveged is an absolute essential for all servers http://www.issihosts.com/haveged/

It's snake oil -- entropy isn't "depleted" in any meaningful way; once your kernel PRNG has accumulated enough entropy that you'd be comfortable using it to generate a crypto key it is not going to cease being suitable for that just because you continue asking it for random numbers.

Re: GPG and Me

#175

Post by bonn1 »

Clever Marketing gig for TextSecure which has been rumbled by the third commentator on that page:

> Okay, since you want to play in the same league as OpenPGP: where can I find the RFC describing TextSecure? How many independent implementations of the TextSecure protocol currently exist?

Re: GPG and Me

#176

Post by ianso »

Sorry but what is the actual point of this blog post?

GPG is just one guy. Who's practically beggared himself writing and maintaining the tool.

GPG is actually used by human rights activists, journalists etc. That, right there, is reason enough to celebrate it and NOT "kill it off".

I think the massive pile-on this is creating is really dumb, to be honest. So Moxie thinks it could be done better; that's great. He's good enough that he can "show, not tell".

Why waste time denigrating a project that's basically a labour of love for one guy that is actually tremendously important, even if it's "90's technology"? Old doesn't necessarily mean bad.

Re: GPG and Me

#177

Post by vog »

A_COMPUTER wrote: post #59

>When I receive a GPG encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. >the email was written by someone who would voluntarily use GPG. >There just seems to be something particular about people who try GPG and conclude that it’s a realistic path to introducing private communication in their lives for casual correspondence with strangers. Is it just me or is the impl…

Indeed, that argument is utterly stupid.

First of all, if he receives an encrypted email from a stranger, this is because he has a GPG key, too. So that stranger had every reason to assume that he's also a "GPG tinfoil hat".

Sarcasm aside, using GPG for minor stuff is not about paranoia, but about protecting minorities! This includes discriminated minorities as well as whistleblowers, investigative journalists, and so on. I for myself may not need that level of protection, but others do. Maybe even the stranger I'm writing to. The more encrypted communication we have, the less minorities spike out who really need that protection.

So encrypting everything is not "I fear", but a political statement. And that political statement is simply "I want encryption to become the norm rather than the exception, to protect minorities".

Re: GPG and Me

#178

Post by DanBC »

ianso wrote: post #176

Sorry but what is the actual point of this blog post? GPG is just one guy. Who's practically beggared himself writing and maintaining the tool. GPG is actually used by human rights activists, journalists etc. That, right there, is reason enough to celebrate it and NOT "kill it off". I think the massive pile-on this is creating is really dumb, to be honest. So Moxie thinks it could be done better; that's great. He's g…

We need very good quality encryption software that is not really hard to use.

PGP is impossible for many people to use correctly. That means there is a bunch of -- often insecure -- software to fill the gap.

So the people who really need PGP/GPG have to struggle to use it and don't know if they've managed it or they use some other software instead that probably doesn't protect them.

Re: GPG and Me

#179

Post by TaylorAlexander »

Ar-Curunir wrote: post #29
TaylorAlexander wrote: post #20

Earlier quoted context omitted.

I don't think that the author ever disputed that GPG is a highly secure system when functioning, or that it is "the best we have". Certainly it's the best we have, and that highlights the sad state of affairs. I think a lot of engineers make the mistake that regular people will be so won over by a new technology that they'll learn it as well as the engineers do. That isn't how it works. So far we still haven't gotten…

The problem is that security and crypto specifically, is a complex beast, so often it isn't possible to abstract away the details. You cannot expect to avail of the benefits of crypto without taking some time to understand how different protocols work, how public key vs symmetric key crypto works, etc. I agree that the situation could be much better than it currently is, but people can't expect to be given everything…

I have to say I really disagree. Why would someone need to know how different crypto protocols work? Do facebook users know how TCP/IP works? Or are they just given a series of user interactions required to make the computer do what they want? Couldn't we do this with secure communications software? I don't need to know why a certain crypto method is recommended, for example, if I know that a trusted party recommends it (say - Edward Snowden and Jacob Appelbaum).

We could have an open source crypto program with a set of basic modes for use. Maybe "mode 3" is good for basic interaction, while "mode 5" is recommended for whistleblowers but requires another step in the physical world, while modes 1 and 2 are deprecated because they were discovered to be vulnerable or weak.

The above is stuff a regular person can understand. Do they need to know how these modes work? Well, they need to know what input is required, but they don't really need to know how it works behind the scenes if they trust someone else to recommend the basic modes. Then it must certainly be possible to write software that walked a user through how to complete the required information. It could say "plug in your secure USB key now", then "type in your passphrase" and then "remove USB key to continue".

Really, I think engineers have a hard time seeing how easy we could make things. Yes that would all take a ground up rewrite and open source projects don't do well with that. Yes it would be easier if people would just learn, but that's a fantasy and we should understand that.

It must be possible to make a secure communications "wizard". Disregard for mathematics has nothing to do with it. People want to know what to do and they want to use as few steps as possible. Installing a handful of command line utilities and remembering a bunch of commands isn't the answer. One program with a simple graphical interface must be possible.

Re: GPG and Me

#180

Post by pstrateman »

Saavedro wrote: post #174
pstrateman wrote: post #158

Earlier quoted context omitted.

I'm not sure why you're being down voted. haveged is an absolute essential for all servers http://www.issihosts.com/haveged/

It's snake oil -- entropy isn't "depleted" in any meaningful way; once your kernel PRNG has accumulated enough entropy that you'd be comfortable using it to generate a crypto key it is not going to cease being suitable for that just because you continue asking it for random numbers.

/dev/random is an entropy estimating entropy pool

that means it will block when it estimates that you have "used up" all of the available entropy

you can check how many bits of entropy your kernel thinks are available easily

cat /proc/sys/kernel/random/entropy_avail

edit: i should have mentioned that there is some reason to argue against this behaviour but that doesn't change the usefulness of haveged for existing systems

Post reply on HN