Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG-Tui, a Terminal User Interface for GnuPG

orhun.dev

Post reply on HN
Print view View original

51–60 of 105 posts

Re: GPG-Tui, a Terminal User Interface for GnuPG

#51

Post by beermonster »

user3939382 wrote: post #34
kingo55 wrote: post #2

The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

If you want to send something securely, I’m not sure email is the best method. Even if you understand all the risks and pitfalls and side-step the minefields it’s still insecure in non-fixable ways. ProtonMail make a service out if it mitigating those issues as best they can (but even they explain their threat-model and what they DON’T mitigate. Others such as Silent Circle ended up giving up.

You could recommend to those non-technical people to either:

- Use Signal

- Sign up to two free ProtonMail accounts and use those to exchange with one another. That way they’re both e2e and don’t leave the eco-system. And no setting up of PGP keys and such like, and a nice web UI.

If they’re non-technical I wouldn’t suggest PGP IMHO. It’s actually easier to setup S/MIME for non-technical people (I’ve had some success there myself).

Of course part of this is that no one has solved the UX and usability and that it never reached mainstream in most ‘typical’ email clients. To set it all up you have to be fairly technical. When it should just work out of the box - like Signal.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#52

Post by imiric »

upofadown wrote: post #46
doomrobo wrote: post #8

Earlier quoted context omitted.

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Age is not even close to being some sort of GPG replacement: * https://articles.59.ca/doku.php?id=pgpfan:agevspgp

I don't think that's a fair comparison. Age was never meant to fully replace GPG, so complaining about missing features it was never meant to have doesn't make sense.

The only valid criticism is about its handling of corrupted data, but for that too you can use an external tool like PAR2 to generate recovery data. I do this with my GPG backups and other data as well.

I like that age follows the Unix "do one thing well" philosophy, and that I can use other similarly scoped tools for other features. There are still some things I'm missing, but these are slowly being worked on[1,2].

[1]: https://github.com/FiloSottile/age/issues/137

[2]: https://github.com/FiloSottile/age/pull/132

Re: GPG-Tui, a Terminal User Interface for GnuPG

#53

Post by upofadown »

doomrobo wrote: post #8
young_unixer wrote: post #5

Earlier quoted context omitted.

What do they use instead?

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Signal is an instant messenger ... which is fine, but sometimes you really do need the extra security provided by an offline messaging solution like OpenPGP. The Cellebrite thing was a good example of this. Cellebrite doesn't get OpenPGP messages as they can and are usually protected by a passphrase. Cellebrite gets Signal messages.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#54

Post by throwaway45209 »

user3939382 wrote: post #34
kingo55 wrote: post #2

The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

TLDR at the bottom.

It seems the answer is Brian Warner's magic-wormhole. You're gonna see lots of file transfer sites with wormhole in their name, but if you want security you should use the original one, which is BW's m-w.

It is implemented in Python [1], so it's hard to install.

So someone made a Go version of it [2] that has binaries for windows, Mac, Linux, BSD etc. But it's command line so maybe not suitable for lay people.

So another person made a GUI for it that also has binaries for all OS [3].

Also there is an android app [4]. Someone needs to implement an iOS one.

[1] https://github.com/magic-wormhole/magic-wormhole/

[2] https://github.com/psanford/wormhole-william/

[3] https://github.com/Jacalz/wormhole-gui/

[4] https://github.com/psanford/wormhole-william-mobile/

TLDR: ask them to install [5] and [6].

[5] https://github.com/Jacalz/wormhole-gui/releases/

(click on 'Assets' under 'Latest release' and download the zip or tar.gz for your OS)

[6] https://play.google.com/store/apps/details?id=io.sanford.wor...

Try it, it's usage is cute and really feels like magic.

. .

Edit: Discussion from few days ago. The creator is in the comments.

https://news.ycombinator.com/item?id=27262193

Re: GPG-Tui, a Terminal User Interface for GnuPG

#55

Post by beermonster »

fragileone wrote: post #23
spicybright wrote: post #3

Eh. Still think we need a decent GUI version that integrates with things seamlessly. Like a password manager does.

It's virtually seamless now that it's native in Thunderbird.

I never had an issue using Engimail but so nice it’s native - though haven’t tried it out myself (note to self, go have a play !).

They did have this issue recently (ouch)

https://www.theregister.com/2021/05/24/mozilla_thunderbird_o...

Re: GPG-Tui, a Terminal User Interface for GnuPG

#56

Post by throwaway45209 »

tomcooks wrote: post #41
user3939382 wrote: post #34

Earlier quoted context omitted.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

7zip encrypted archives, the "create protected archive" should be accessible with right click on most platforms (I use the CLI version and I only have a vague memory about the UI)

The problem with this is it's only as secure as the password, and most people choose weak passwords.

Edit: Another is you need to manually enable the checkmark to 'encrypt file names'. Otherwise all file names are in the clear.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#57

Post by yrro »

sneak wrote: post #22
JasonFruit wrote: post #7

Earlier quoted context omitted.

I really don't get this attitude, though I think it must be valid, since I seem to be almost alone in disagreement. I use plain old GPG for a lot of purposes, and I don't find its command-line usage difficult at all. Key management, encryption, decryption, signing — all of these operations are pretty straightforward. What specific tasks have you found difficult?

It's very hard to simply encrypt a file to a given pubkey (due to the key trust model) compared to, for example, something like age (where it's just `age -r $PUBKEY`). You also have to set GNUPGHOME somewhere and import the key first, you can't easily do it statelessly without tracking mud into the filesystem first.

gpg has had a --recipient-file option for a while now... no need to import it.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#58

Post by throwaway45209 »

cpach wrote: post #36
user3939382 wrote: post #34

Earlier quoted context omitted.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

Signal (on desktop or smartphone) or https://webwormhole.io/

For webwormhole.io, it's server is a weak spot:

https://news.ycombinator.com/item?id=23024833

Re: GPG-Tui, a Terminal User Interface for GnuPG

#59

Post by rakoo »

user3939382 wrote: post #34
kingo55 wrote: post #2

The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.

I get requests from non-technical people in my life for how they can email sensitive files (to other non-technical users) in a way that is especially secure. My refrain: “Technically there is, but… (contemplates PGP for half a second)… it’s very complicated to setup.” Between email phishing attacks, Dropbox and everyone else on HIBP, I honestly don’t know what advice to give non-technical users besides put it on a US…

You can use gpg with emails without having to deal with keys and stuff: use deltachat (https://delta.chat/en/)
Post reply on HN