Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG-Tui, a Terminal User Interface for GnuPG

orhun.dev

Post reply on HN
Print view View original

41–50 of 105 posts

Re: GPG-Tui, a Terminal User Interface for GnuPG

#41

Post by tomcooks »

user3939382 wrote: post #34
kingo55 wrote: post #2

The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

7zip encrypted archives, the "create protected archive" should be accessible with right click on most platforms (I use the CLI version and I only have a vague memory about the UI)

Re: GPG-Tui, a Terminal User Interface for GnuPG

#42

Post by stingraycharles »

aborsy wrote: post #25

It’s straightforward to use GPG via command line. I don’t find its CLI more complex than, say, SSH’s. I use it daily (with secret keys on a hardware key) for passwords, back up, file encryption, some email (admittedly most recipients don’t use encryption), software verification etc. Newer tools are simpler, but GPG is also workable.

For me the problem is that I use ssh way more often, so it’s easier to remember all the commands. I need to encrypt/decrypt something with GPG only a few times a year, and every time I struggle remembering the commands to do so.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#43

Post by tomcooks »

njt wrote: post #29
R0b0t1 wrote: post #12

Earlier quoted context omitted.

I am aware of these arguments. Still, GPG exists, and no one has really proposed good solutions, or at least the solutions that have been proposed are not taking off for some reason . It is true that pointing out a problem does not need to be accompanied by a solution to be valid, but at this point, if you're going to complain please work towards solving the issue. It is too easy in this case to come off as someone w…

> GPG exists, and no one has really proposed good solutions [...] > if you're going to complain please work towards solving the issue Perhaps because you are asking the wrong question: "PGP/GPG is old, broken, and insecure, what is an exact drop-in replacement that I can substitute for it?" Instead, the question should be: "PGP/GPG is old, broken, and insecure, what is a replacement for [this specific thing I am tryi…

GPG is broken and insecure‽

Re: GPG-Tui, a Terminal User Interface for GnuPG

#44

Post by upofadown »

KirillPanov wrote: post #40
user3939382 wrote: post #34

Earlier quoted context omitted.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

(r)age https://news.ycombinator.com/item?id=21895671 https://github.com/str4d/rage

The thing where you have to deal with raw keys? For non-technical people?

* https://articles.59.ca/doku.php?id=pgpfan:agevspgp

Re: GPG-Tui, a Terminal User Interface for GnuPG

#45

Post by juliusmusseau »

tptacek wrote: post #19
AlexCoventry wrote: post #10

Earlier quoted context omitted.

Is there a way to do forward security in a non-interactive protocol (which seems necessary, if you want to communicate over email?) I guess users could publish partial key exchanges out of band?

Don't use encrypted email. Encrypted email is deeply problematic, for many reasons having little to do with PGP. https://latacora.micro.blog/2020/02/19/stop-using-encrypted....

This reminds me of my father's advice to every client (he had a corporate litigation practice):

"When you feel the urge to write an email, pick up the f*king phone instead. When in 5 years you're being cross-examined you can say 'I don't remember saying that' and you won't be lying, because we're too old to remember things, and I won't have to bill you for the time it takes to read all the f*king emails."

Re: GPG-Tui, a Terminal User Interface for GnuPG

#46

Post by upofadown »

doomrobo wrote: post #8
young_unixer wrote: post #5

Earlier quoted context omitted.

What do they use instead?

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Age is not even close to being some sort of GPG replacement:

* https://articles.59.ca/doku.php?id=pgpfan:agevspgp

Re: GPG-Tui, a Terminal User Interface for GnuPG

#47

Post by upofadown »

reifyx wrote: post #26
tptacek wrote: post #9

Earlier quoted context omitted.

The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…

I don't think people want forward secrecy for their email. If they get a new computer, they probably want all their mail on there, right? Isn't porting over their email efficiently at odds with forward secrecy? Also, is forward secrecy compatible with any kind of encrypted search (I know most encrypted search schemes leak too much these days, but if the alternative is not encrypting email at all...)? Also, how would…

Keeping old messages around for all practical purposes negates forward secrecy in any messaging system. It isn't just an email issue. If they can get your secret key they can pretty much for sure get your old messages.

Most email users keep their messages in cloud storage (IMAP) so that changing computers is a non-issue. OpenPGP is an encrypt once scheme so that messages on an IMAP server are encrypted and stay encrypted.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#48

Post by tptacek »

upofadown wrote: post #47
reifyx wrote: post #26

Earlier quoted context omitted.

I don't think people want forward secrecy for their email. If they get a new computer, they probably want all their mail on there, right? Isn't porting over their email efficiently at odds with forward secrecy? Also, is forward secrecy compatible with any kind of encrypted search (I know most encrypted search schemes leak too much these days, but if the alternative is not encrypting email at all...)? Also, how would…

Keeping old messages around for all practical purposes negates forward secrecy in any messaging system. It isn't just an email issue. If they can get your secret key they can pretty much for sure get your old messages. Most email users keep their messages in cloud storage (IMAP) so that changing computers is a non-issue. OpenPGP is an encrypt once scheme so that messages on an IMAP server are encrypted and stay encry…

Systems that lack forward secrecy are by design incapable of preventing archives of eventually-plaintext messages. There's nothing you can do about it; every message you send is irrevocably a part of the adversary's record, and, because you rely on a single long-term key, you know eventually that record will be plaintext. That's why forward secrecy is such a big deal, and why every modern messaging cryptosystem uses ephemeral keys.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#50

Post by upofadown »

tptacek wrote: post #48
upofadown wrote: post #47

Earlier quoted context omitted.

Keeping old messages around for all practical purposes negates forward secrecy in any messaging system. It isn't just an email issue. If they can get your secret key they can pretty much for sure get your old messages. Most email users keep their messages in cloud storage (IMAP) so that changing computers is a non-issue. OpenPGP is an encrypt once scheme so that messages on an IMAP server are encrypted and stay encry…

Systems that lack forward secrecy are by design incapable of preventing archives of eventually-plaintext messages. There's nothing you can do about it; every message you send is irrevocably a part of the adversary's record, and, because you rely on a single long-term key, you know eventually that record will be plaintext. That's why forward secrecy is such a big deal, and why every modern messaging cryptosystem uses…

>Systems that lack forward secrecy are by design incapable of preventing archives of eventually-plaintext messages.

That is not what is being claimed here. Unless you add extra security in the form of something like a strong unique passphrase for the archived messages then an attack that gets the private key also gets the archived messages. In general, if you have a more secure method for protecting the archived messages you could of used it to protect the private key. It is effectively the same problem.

Post reply on HN