21–30 of 261 posts
> No one was sending you encrypted emails anyway,... Ouch, the unfortunate truth.
As far as I can tell none of these "alternatives" implement what is at least for me the most interesting feature of PGP: web of trust and key servers. It would be really nice to see a modern take on this. > No one was sending you encrypted emails anyway I actually use PGP for e-mailing quite often, for instance: how am I supposed to report security issues without gpg? (please don't suggest Whatsapp...)
I want to be able to encrypt/sign and have web of trust be a different issue.
The context for this is this Go project proposal: https://github.com/golang/go/issues/30141 Filippo proposes to deprecate (but not remove) Blowfish, archaic curves, CAST, MD4, RIPEMD160, TEA, Twofish, XTS, and OpenPGP from the Golang x/ libraries (which are "officially supported" but not part of the standard library. It's really heartening to see a project get serious about shedding legacy crypto.
All of you are using pgp wrong, emails are a crap way to use it. It's not your fault, it was meant to be used that way. There's a better way to use it though.
Earlier quoted context omitted.
The only encrypted mail I get is from Facebook. It drives me crazy that nobody else bothers to put a "enter your public key here" field. It seems like it should be super easy to implement, but Facebook is literally the only company that I've ever seen do it.
How many people in the industry you know (besides Tech), who use an e-mail client that is neither OS X's Mail or a web mail client?
Ted Unangst of OpenBSD gave a nice talk on the design of signify: http://www.openbsd.org/papers/bsdcan-signify.html
The OpenBSD use case is quite limited and doesn't require PKI, so you won't find web of trust, keyservers, or anything like that. It would be awesome to have minimal solutions to those problems as well though. Anyone aware of attempts?
Earlier quoted context omitted.
All of you are using pgp wrong, emails are a crap way to use it. It's not your fault, it was meant to be used that way. There's a better way to use it though.
You're holding it wrong.
I really don't think that this is secure.
> nacl/box and nacl/secretbox
Both of which use XSalsa20 - which while not broken there should be no reason to use it rather than (X)Chacha20.
The context for this is this Go project proposal: https://github.com/golang/go/issues/30141 Filippo proposes to deprecate (but not remove) Blowfish, archaic curves, CAST, MD4, RIPEMD160, TEA, Twofish, XTS, and OpenPGP from the Golang x/ libraries (which are "officially supported" but not part of the standard library. It's really heartening to see a project get serious about shedding legacy crypto.
All of you are using pgp wrong, emails are a crap way to use it. It's not your fault, it was meant to be used that way. There's a better way to use it though.
What should I use instead of email.
> one-time-use combinations of three English words I really don't think that this is secure. > nacl/box and nacl/secretbox Both of which use XSalsa20 - which while not broken there should be no reason to use it rather than (X)Chacha20.
Earlier quoted context omitted.
All of you are using pgp wrong, emails are a crap way to use it. It's not your fault, it was meant to be used that way. There's a better way to use it though.
I want a peer to peer communication not beholden to a particular provider where I can optionally host myself where I can communicate to most people in the US. It would be optimal if I could communicate with people privately but being able to communicate with them at all is the primary point. What should I use instead of email.