Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG and Me

thoughtcrime.org

Post reply on HN
Print view View original

261–267 of 267 posts

Re: GPG and Me

#261

Post by BuildTheRobots »

ghshephard wrote: post #109
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

GPG is way, way, way to complex for all but the 0.01% of people who are GPG experts. It's too complex for me - and I've read (and enjoyed) Applied Cryptography. But, not having used it for a few years, I went to take a look again - list some keys, maybe SMS some friends to exchange fingerprints and sign their keys, etc... - I'm trying to recall what the relationship between PUB, SUB, UID, Key Fingerprints are. And ho…

Entropy is a massive problem, especially on headless servers.

Timer EntropyD [1] can be extremely handy (as can the audio-entropy gathering)

[1] http://www.vanheusden.com/te/

Re: GPG and Me

#262

Post by contingencies »

Developer of phone-based crypto afterthoughts that give people a false sense of security and ignore the evidence that using phones is the worst thing you can do for privacy and security: "[my competitor] the most widely deployed message-oriented cryptography application in the open source world is crap". Well, yes and no. Forward secrecy is nice, but a world without forward secrecy and a workable standard when required is still arguably better than a world full of people throwing away insecure phones every six months while convincing themselves App1.2.3 makes them untouchably secure because n-marketing claims.

Re: GPG and Me

#263

Post by Guvante »

xorcist wrote: post #191
moxie wrote: post #48

A lot of the comments I've been getting are in the genre of "well... but GPG works." Yes, GPG is a powerful tool that makes some encrypted communication possible . But is it really "working" if it's the tool we've had for the past 20 years, and we still ended up in a world where surveillance is so ubiquitous and privacy is so rare? Having used GPG, it seems more likely to me that there are only ~50k GPG users in the…

Why 50k users? PGP/GnuPG is used to secure a _lot_ more than email. Every Linux distribution signs packages with it. So that's at least 100M users right there. Several APIs regarding domain name and AS registrations is based on it. I know at least two financial systems that signs their messages with it. That's just mentioning a few I can think of right now. I'm sure it secures a lot lot more. It's used all over the p…

You misunderstand, they are talking specifically about encrypted communication for the new use case. Think of it instead as trying to replace email for unencrypted communication, you need a different use case as the user base is too entrenched. In contrast GPG encrypted messages are a small community.

The fact that GPG is used for other things is fine, as it will still exist and can still be used for those things.

Re: GPG and Me

#264

Post by aaron_m04 »

glogla wrote: post #212
droopyEyelids wrote: post #96

Earlier quoted context omitted.

It might be people who miss the forest for the trees. Right now Moxie is working on bringing encryption to the masses. That involves a whole-product view, with empathy for the unsophisticated (think about a kid who's only computing device is a phone). I know stereotypes often treat people unfairly, but the kind of person who has the dedication required to use PGP seems, to me, to often coincide with the people who fi…

> Considering Moxie seems to be dedicating a large part of his life's work to helping average people, I believe the attitude I described could play foil to the inspirational messages he also receives. But I don't pretend to know him or anything. You may say that, but after the "we specifically work to make TextSecure impossible without Google Play because using Android without google is 'going back to the old broken…

Moxie's stance on non-Play releases is not as extreme as you suggest:

https://github.com/WhisperSystems/TextSecure/issues/127

Re: GPG and Me

#265

Post by Uhhrrr »

chralieboy wrote: post #68
Uhhrrr wrote: post #15

>When I receive a GPG encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. This is an interesting case where a barrier to entry makes discourse less valuable. Perhaps the barrier makes people feel like they have to prepare a short speech in order to make the effort worthwhile. I certainly would rather converse with most people than listen to one minute speeches from the…

If you ready on, you'll see that his gripe isn't with the effort put into decrypting, but the subset of people who voluntarily use GPG.

I'm talking about the effort the sender has to put into encrypting.

Re: GPG and Me

#266

Post by naveen99 »

tptacek wrote: post #256
yellowapple wrote: post #255

Earlier quoted context omitted.

> You know you're one of only a few people in the world who is in a position to do that, right? Anyone else would (rightfully!) get torn to shreds on HN by tptacek or yourself. And I say "rightfully" because it is very likely that other people would screw up some central aspect to the security of any new product that claims security. This attitude is why GnuPG (and other PGP implementations) are in a position to be c…

Yes, there is a reason to discourage those people. In between the time that a cryptographically illiterate developer releases their MVP 1.0 version and the time that it's discovered that their cryptography is fundamentally flawed --- a window of time that can stretch on for years --- actual people will rely on the tool for their security, not realizing that serious adversaries are reading their messages. Most new cry…

what's a CTR nonce stutter ? Its not listed on the cryptography attacks wikipedia page: http://en.wikipedia.org/wiki/Category:Cryptographic_attacks

i think any 3rd party distributed crypto is only useful against weaker adversaries (weaker than the person doing the distributing). For p2p crypto designed and agreed to by the two parties, there are lots of options, starting with a 1-time pad, CTR mode hash based ciphers, etc...

Re: GPG and Me

#267

Post by tptacek »

naveen99 wrote: post #266
tptacek wrote: post #256

Earlier quoted context omitted.

Yes, there is a reason to discourage those people. In between the time that a cryptographically illiterate developer releases their MVP 1.0 version and the time that it's discovered that their cryptography is fundamentally flawed --- a window of time that can stretch on for years --- actual people will rely on the tool for their security, not realizing that serious adversaries are reading their messages. Most new cry…

what's a CTR nonce stutter ? Its not listed on the cryptography attacks wikipedia page: http://en.wikipedia.org/wiki/Category:Cryptographic_attacks i think any 3rd party distributed crypto is only useful against weaker adversaries (weaker than the person doing the distributing). For p2p crypto designed and agreed to by the two parties, there are lots of options, starting with a 1-time pad, CTR mode hash based ciphers…

That Wikipedia page is not very useful.
Post reply on HN