Slashdot Mirror
Is There a Future for PGP?
Thom Dyson asks: "So it looks like McAfee is walking away from PGP. At least that's how I interpret their marketing
speak. I've been told PGP doesn't work on XP, does that hold true
for the Open Source version as well?"
I know I don't.. :)
455fe10422ca29c4933f95052b792ab2
I'm working on a software project with a few friends, and whenever we talk about highly sensitive stuff, or send source code, we always PGP encrypt our messages.
Also, if i'm at work and I want to send sensitive material home to work on, I'll usually encrypt it to my own key before I send it.
The fact of the matter is, though, most people don't think what they have to say is worth protecting with encrpytion...and most of the time, they're right.
What we need is completely transparent use of PGP in an e-mail client. The user should never know it's there at all.
McAfee has one of the hardest-to-navigate webpages in existance, of the 5 friggen versions of PGP (Note, this was 1-1.5 years ago), I could never tell which one was 'right for me', and every attempt to navigate or search their hack of a website yielded in a different product!
That alone stopped me & my company from using McAfee's product. We opted for the free pgp + perl scripts instead.
They win the award for 'products most hidden by obfuscation'.
PGP 7.0.3 for Windows 2000 does run on XP.
Well, kind of. Okay, so it gets very confused with fast user switching (it uses services which i think don't understand the concept of multiple users logged in simultaneously) so apart from the various errors that come up when you log in, yeah, it works. (Come to think of it, if it doesn't understand multiple users it certainly won't run on W2k Adv. Server with terminal services then...)
You can right click on files and do encrypt. pgpkeys and pgptools work fine.
Outlook 2002 (Office XP) plugin support is different. Yeah, it works. But not really well at all. The icons seem corrupt in outlook too. You need to enable an option to auto decrypt mail. Then when you open an email PGP tries to decrypt it automatically. (the reason you must do this is that the decrypt button on the toolbar doesn't work *shrug*). Sending encrypted mail on Outlook 2002 works fine too.
I've been doing this for about a month now, with no ill effect.
So yeah, PGP 7.0.3 works on WinXP. It would be nice if it supported XP properly.
D.
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
Most hardcore cypherpunks seems to still use PGP 2.6.x! (If USENET sigs/keys are any indication)
In any case, check out pgpi.com for different versions of PGP, many of which are actively developed. Also, search for "Cyber-KnightsTemplar PGP". I only used this version when I was a dedicated Windows user.
Now, I use GnuPG for mail/file crypto, and loopback crypto for filesystems (/pub/linux/kernel/people/hvr at your favorite mirror). I run Windows and Linux under VMWare, using the "undoable" drive type, hosted on a blowfish-encrypted loopback volume, which leaves no physical evidence on my machine of activities in the VM). I also dabble in Ouguess for my stego "needs".
While my practices in paranoia are fun, I don't take them too seriously. However, I like the idea of being able to Ascroft-Proof(tm) my machine if I wish. :-)
Method of processing duck feet
I know one of the guys who writes PGP. Last I talked to him, he was writing the Palm version. I heard today about this thing from his wife, and as far as I know, there are only 8 developers left working on PGP. I dunno if that makes you folks appriciate why it doesn't work on WinXP or not, but I felt like I should stick up for my friend (since he's a mentor and all :P).
What? You want a sig?
S/MIME is an Internet Standard. I know that Outlook, Outlook Express, and Netscape Mail all support it. Others probably do, too. I can send a signed message to an Outlook user today and they can respond with an encrypted one. With PGP, that isn't usually possible today.
The other problem with PGP is that it is nearly impossible to securely exchange keys, unless you luck out and trust someone who has signed it (not likely!). You end up having to call them up on the phone and read the fingerprint or trust that your mail was secure (in which case, why are you encrypting?). S/Mime relys mostly on certificates, which although they have many problems, do solve the majority of key distribution problems.
- PGP on Windows XP. PGPtray works, PGP for Outlook XP is dodgy, PGPdisk is broken and PGPnet will hork your system. At least, those are the reports on alt.security.pgp.
- NAI is walking away from PGP. This is a Good Thing, believe it or not. Or, at the very least, not a Bad Thing. PGP has always existed in two different components with totally different agendas:
- The community's agenda is to enhance individual liberties and ensure electronic privacy.
- The corporation's agenda is to turn a profit.
- The community is alive and well. There are a lot of individuals who are interested (and some who are genuinely obsessed!) with the notion of personal privacy and personal liberties. The GNU Privacy Guard crowd is part of this community--so what if their initials are GPG instead of PGP? So are the remailers, mixmasters and everyone else.
- NAI is dying. Due to the fact that I'm a former NAI employee, I'm not going to say more than that--except to recognize that Network Associates has a long history of buying great software companies and failing to capitalize on them. (Check out the San Jose Mercury-News from February 2001 for some brilliant examples.)
- Summary: the community is alive and kicking. GPG keeps getting better and better--at 500k, it's slim enough to fit on a floppy, it supports RFC2440 and RFC2440bis, and has good integration with almost all UNIX mailers. The WinPT and GPGshell programs give friendly Win32 front-ends (but both still need a lot of work).
... Don't panic. Unlike the Monty Python parrot sketch, PGP really is just resting.... It doesn't take a rocket scientist to see that those two agendas are not exactly in sync with each other.
PGP doesn't have to be hard and GPG can be dead easy... not that useing either from the command line is that difficult.
There is PGPTray and on the free software side there is WinPT (Windows Privacy Tray). This is a little system tray application that encrypts and decrypts from the clipboard and supports most of the common command line options.
There is also GPGOE, a GPG plug-in for Outlook Express.
S/MIME seems to be no longer supported in current Netscape (version 6.0 and newer). There were problems transfering signatures/mails between mail programs of different brands (i.e. M$ and Netscape) with S/MIME. PGP / GnuPG is without any problems for any mailprogram when using the tray application.
SMIME is in the current Mozilla releases, so expect it to show up in the Netscape builds shortly. There are no plans from either Netcape or McAffee to integrate PGP, although one is free to write the code themselves.
From what I've seen SMIME mail between Netscape and Microsoft clients interoperates fine. What you can't do easily is move certificates between the clients. This puts the burden on the CAs to have 2 different cert install facilities (which the roots do, but your random corporation might not).
When you get into the MS/NS world, SMIME is an order of magnitude nicer for the user than PGP/GPGP because it's integrated directly into your mailer. (For example, signatures are automatically verified and you get a nice icon. Encrypted mail is marked in the Inbox, etc).
I use them every day at work mostly in combination with Outlook 2002. Importing keys is a little weird, but it only took me about 2 mins to figure it out. The GUI isn't the pretiest but it functions fine.
No
How does one get a S/MIME key??
i hate pansy republicans