Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gpg.fail

gpg.fail

Post reply on HN
Print view View original

201–210 of 376 posts

Re: Gpg.fail

#201

Post by josephg »

bruce511 wrote: post #181
ekjhgkejhgk wrote: post #168

Earlier quoted context omitted.

The way it works is: A company adopts some software with a free but not copyleft license. Adopts means they declare "this is good, we will use it". Developers help develop the software (free of charge) and the company says thank you very much for the free labour. Company puts that software into everything it does, and pushes it into the infrastructure of everything it does. Some machines run that software because an…

>> A some point the company says "you know what, we like this software so much that we're going to fork it, but the fork isn't going to be free or open source. It's going to be just ours, and we're not going to share the improvements we made" Right. So at that point all those contributing developers are free to fork, and maintain the fork. You have just as much control as you always did. And of course being MIT or GP…

> Right. So at that point all those contributing developers are free to fork, and maintain the fork. You have just as much control as you always did.

Yep. And we've seen this happen. Eg, MariaDB forked off from MySQL. Illumos forked from Solaris. Etc. Its not a nice thing to have to do, but its hardly a doomsday situation.

Re: Gpg.fail

#202

Post by josephg »

tptacek wrote: post #89
akulbe wrote: post #88

Earlier quoted context omitted.

Is there a better alternative to GPG?

Everything is better than PGP (not just GPG --- all PGP implementations). The problem with PGP is that it's a Swiss Army Knife. It does too many things. The scissors on a Swiss Army Knife are useful in a pinch if you don't have real scissors, but tailors use real scissors. Whatever it is you're trying to do with encryption, you should use the real tool designed for that task. Different tasks want altogether different…

The thing I can't get past with PGP / GPG is that it tries to work around MITM attacks by encouraging users to place their social network on the public record (via public key attestation).

This is so insane to me. The whole point of using cryptography is to keep private information private. Its hard to think of ways PGP could fail more as a security / privacy tool.

Re: Gpg.fail

#203

Post by johnisgood »

kuschku wrote: post #200
p2detar wrote: post #68

Earlier quoted context omitted.

> Encrypting email > Don't. https://www.latacora.com/blog/2019/07/16/the-pgp-problem/#en... I’m not sure I completely agree here. For private use, this seems fine. However, this isn’t how email encryption is typically implemented in an enterprise environment. It’s usually handled at the mail gateway rather than on a per-user basis. Enterprises also ensure that the receiving side supports email encryption as well. edi…

Even my doctor's office and local government agencies support PGP encrypted emails, and refuse to send personal data via unencrypted email, but tech nerds still claim no one can use it?

[flagged]

Re: Gpg.fail

#204

Post by UqWBcuFx6NV4r »

ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

You are attributing a general trend to a particular language community. I also believe that you are unjustifiably unfairly interpreting “default license” just because you disagree with what they think the “default license” is. We all know what is means by this. It just sounds like you think it should be something GPL

Re: Gpg.fail

#205

Post by miki123211 »

ekjhgkejhgk wrote: post #168
rendaw wrote: post #158

Earlier quoted context omitted.

How would MIT make anyone lose control of it?

The way it works is: A company adopts some software with a free but not copyleft license. Adopts means they declare "this is good, we will use it". Developers help develop the software (free of charge) and the company says thank you very much for the free labour. Company puts that software into everything it does, and pushes it into the infrastructure of everything it does. Some machines run that software because an…

Large parts of Chrome are actually GPL AFAIK, which is one reason both Apple and Google made it open source in the first place.

> chrome is what everybody uses because google has lock-in power.

Incorrect. At least on Windows, Chrome is not the default browser, it is the browser that most users explicitly choose to install, despite Microsoft's many suggestions to the contrary.

This is what most pro-antitrust arguments miss. Even when consumers have to go out of their way to pick Google, they still do. To me, this indicates that Google is what people actually want, but that's an inconvenient fact which doesn't fit the prevailing political narrative.

> so that websites only get rendered well if they use certain APIs, so now competitors to Chrome are forced to implement those APIs, but those aren't public.

What is a Chrome API that web developers could possibly implement but that "isn't public?" What would that even mean in this context?

> google says "oh I'm going to disallow you running the extensions you like, so we can show you more ads".

And that could have happened just as well if Chrome was 100% open source and GPL.

Even if you accept the claim that Manifest V3's primary purpose was not increasing user security at face value (and that's a tenuous claim at best), it was perfectly possible for all third-party browsers (notably including Edge, which has 0 dependency on Google's money) to fork Chromium in a way that kept old extensions working. However, open source does not mean that features will magically appear in your software. If Google is the primary maintainer and Google wishes to remove some feature, maintaining that feature in your fork requires upkeep, upkeep that most Chromium forkers were apparently unwilling to provide. This has nothing to do with whether Chrome is open source or not.

Re: Gpg.fail

#206

Post by miki123211 »

johnisgood wrote: post #91
tptacek wrote: post #89

Earlier quoted context omitted.

Everything is better than PGP (not just GPG --- all PGP implementations). The problem with PGP is that it's a Swiss Army Knife. It does too many things. The scissors on a Swiss Army Knife are useful in a pinch if you don't have real scissors, but tailors use real scissors. Whatever it is you're trying to do with encryption, you should use the real tool designed for that task. Different tasks want altogether different…

Now can you give us a list of all the features of PGP and a tool that does one specific thing really well?

This is exactly that, in more detail than you could possibly ever ask for:

https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

Re: Gpg.fail

#207

Post by deknos »

some_furry wrote: post #111
johnisgood wrote: post #108

Earlier quoted context omitted.

No, because there is no keyring and you have to supply people's public key each time. It is not suitable for large-scale public key management (with unknown recipients), and it does not support automatic discovery, trust management. Age does NOT SUPPORT signing at all either.

Why is a keyring important to you? Would "fetch a short-lived age public key" serve your use case? If so, then an age plugin that build atop the AuxData feature in my Fediverse Public Key Directory spec might be a solution. https://github.com/fedi-e2ee/public-key-directory-specificat... But either way, you shouldn't have long-lived public keys used for confidentiality. It's a bad design to do that.

We need a keyring at a company. Because there's no other media for communicating, where you reach management and technical people in companies as well.

And we have massive issues due to the fact that the ongoing-decrying of "shut everything off" and the following non-improvement-without-an-alternative because we have to talk with people of other organizations (and every organization runs their own mailserver) and the only really common way of communication is Mail.

And when everyone has a GPG Key, you get.. what? an keyring.

You could say, we do not need gpg, because we control the mailserver, but what if a mailserver is compromised and the mails are still in mailboxes?

the public keys are not that public, only known to the contenders, still, it's an issue and we have a keyring

Re: Gpg.fail

#208

Post by deknos »

akerl_ wrote: post #70
alphazard wrote: post #61

Earlier quoted context omitted.

It's a fundamentally bad idea to have a single key that applications are supposed to look for in a particular place, and then use to sign things. There is inherent complexity involved in making multi-context key use safe, and it's better to just avoid it architecturally. Keys (even quantum safe) are small enough that having one per application is not a problem at all. If an application needs multi-context, they can h…

> The disk is fully encrypted, and applications should be isolated from one another. For most apps on non-mobile devices, there isn't filesystem isolation between apps. Disk/device-level encryption solves for a totally different threat model; Apple/Microsoft/Google all ship encrypted storage for secrets (Keychain, Credential Manager, etc), because restricting key material access within the OS has merit. > I'm sure th…

and now certain people in corporate security only trust gpg, because they grew up with it :D

Re: Gpg.fail

#209

Post by closewith »

johnisgood wrote: post #196
akerl_ wrote: post #161

Earlier quoted context omitted.

I stand by what I said.

I mean... why?

Not the GP, but most of us want to communicate with other people, which means SMS or WhatsApp. No point have perfect one-time-pad encryption and no one to share pads with.

Re: Gpg.fail

#210

Post by closewith »

jhgb wrote: post #143
akerl_ wrote: post #136

Earlier quoted context omitted.

There's no future-proof suggestion that's immune to the government declaring it a crime. If you want a suggestion for secure messaging, it's Signal/WhatsApp. If you want to LARP at security with a handful of other folks, GPG is a fine way to do that.

Nobody decided that it's a crime, and it's unlikely to happen. Question is, what do you do with mandatory snooping of centralized proprietary services that renders them functionally useless aside from "just live with it". I was hoping for actual advice rather than a snarky non-response, yet here we are.

You're asking for a technical solution to a political problem.

The answer is not to live with it, but become politically active to try to support your principles. No software can save you from an authoritarian government - you can let that fantasy die.

Post reply on HN