Slashdot Mirror
Network Associates Gives Up Search for PGP Buyer
nakhla writes: "I came across this article which states that Network Associates has given up the search for a buyer for its PGP division. The company has laid off 18 workers, and plans to continue to maintain the product for one year. It's a good thing that there are still products like GnuPG and others out there for people who need cheap, reliable encryption."
I actually bought a version of PGP Personal Security 7.0.3 from these guys. It comes with some nice extras such as a very nice firewall. It's a shame that not enough people contributed to the development. Hopefully they will open source the latest version so that development can continue for long after one year.
I've got mixed feelings about this. On the one hand, PGP was revolutionary and is probably one of the main reasons encryption is as free and available today as it is. If Phil hadn't released that (at the expense of considerable suffering), I suspect that the governments of the world would have been able to clamp down on encryption big time, and all of us law abiding types would take it as an axiom that none of us really need anything like that, only terrorists do. It's sad to see the company that was carrying that torch give up on it. I fear this is just one more indication that personal encryption of e-mail and such isn't really going to catch on with the masses.
On the other hand, NAI's not been a perfect angel. Phil left them because of differences about releasing (if memory serves) source code-- not because Phil is an open source advocate per se, so much as for reasons of being able to verify the security. And, myself, I'm an open source geek and have been using GnuPG for quite some time as my encryption software of choice. There still is hope that GnuPG will be turned into something that can catch on with the masses (just like there's hope, however faint, that things like GNOME and KDE will catch on with the masses).
-Rob
Seems from comments I read in other places (theregister.co.uk,newsforge.com,...) they never did any serious effort to market PGP. Still, there is a market for products like this. It is even growing. Some article also mentioned certain US government administrations as key clients... Doesn't this look a little suspicious?
Not in your wildest dreams. PGP Desktop was as easy as it gets.
/Pedro
That a product as great as PGP is going under. I personally think that if it had stayed the way it was before the buyout, it would still be around. I wonder if something like this could eventually happen to /. or Gnome.
This is the reason I am always concerned when a major company snatches up some cool new technology; they see it in major use by techs/geeks/etc, and think, "hey, with some good marketing...". They fail to understand what features matter to the original audience, fail to capture a new audience, and then drop the product.
In the meantime, it strands people who used to like the product. I was a major PGP user since its inception. Now, I can't stand the darned thing. I tried the Palm and Pocket PC versions, I tried the Windows versions. They added too many toys and widgets to a small, light application.
Oh well. I hope the Gnu PGP clone keeps up.
-WS
An operating system should be like a light switch... simple, effective, easy to use, and designed for everyone.
PGP encryption could use a nice high profile use case where its use saved the ass of someone the average joe could relate to.
/you/ so interested ... ?")
.. ?
I really dont think that the average consumer is concerned about having their private messages intercepted. (The logic is usually: "I dont do anything bad. Hey, waitaminute. Why are
That being said, I'm not surprised that it was difficult to find a buyer for them. The market really hasn't encountered the high profile case that justifies wide spread deployment of PGP use. I think
"Old man yells at systemd"
Who cares? I stopped taking PGP seriously when NAI decided to stop releasing source code and expected me to 'just trust them' instead. Any crypto company that does that obviously knows nothing about security.
I'm glad the option is there, and I know it's done a lot of good in a lot of places, but even using e-mail encryption automatically draws attention to yourself. It would be far better if everyone used it for every e-mail they sent. It would be great if keysigning and verification was a normal event in meatspace, but it just isn't to be. How is it that SSH and OpenSSH became so widespread but PGP and GPG haven't?
I think it's because PGP and GPG have such a sucky interface. It takes me forever to read the manual every time, and the integration with current mail programs sucks! Evolution seems to be fixing this and I know mutt and pine can support it, but it's just too much work to setup if no one else you e-mail can do it too!
Is there any hope? I'd like to think so, but only if it becomes the default in hotmail and MS Outlook will it become widespread, and what are the odds of that? *sigh*
The more you know, the less you understand.
Maybe a smells a bit of conspiracy-theory, but this article at The Register opens the floor to the idea that NIA's decision isn't entirely due to commercial factors, and in fact looks a bit "fishy".
Quite an interesting point - why would they give up on such a good product like this? And who could gain from them giving up a product like this?
Thank goodness they laid off 18 works and not 18 workers.
//m
If they arn't going to activly try and sell the product, how is this a better deal than taking the less appealing offer?
I'v been an ocassional user of PGP for year, first the DOS client then GPG on linux.
A friend of mine tried to use the freeware NA windows version. Hes a typical windows user and won't read instructions. After giving him a five minute talk saying "Other people use you public key to write messages to you, only you can read the message with your private key etc". Days later I call in at his house and he had not managed to use it. The user interface was horrible. Despite having used command line PGP for user and having a quick look at the help I couldn't find his keyring or work out how to use it from a quick look at the menus.
I can't imagine what the staff working on PGP were doing, certainly not useability
There were three background processes running on his already unstable win98 machine poping up box's demanding he type in his details and register. I think he reinstalled windows in the end. People who use PGP are gneerally a bit paranoid, annoying them by trying to make tem register seems pointless.
PGP Desktop is a well-integrated application that has a nice file protection app (PGP disk), makes PGP signing your mail a lot easier (it integrates to most e-mail clients I've used), has a good IPSec VPN component, and runs on Mac and Windows (1 more platform than most products do, though there's no Linux desktop version). NAI never did a very good job of selling the product, though - it was always one of those "semi-orphan" packages. NAI couldn't figure out if it was meant to be a business package or a home use package, and pricing was never set in stone.
Ironically, it's probably an easier sell now than it's ever been, given that organizations are finally getting a little more security-conscious.
GPG is probably the best hope for a cross-platform replacement, but there's still a need for better snazzy front-ends on most platforms (I'm using it on MacOS X) to help Joe Average, and there's no easy PGP VPN or PGP Disk equivalent.
NAI - if anyone's listening, why not re-open the PGP codebase and let the marketplace solve the problem? Nobody wants to buy it, you don't want to sell it, so give it away!
-- Josh Turiel
"2. Do not eat iPod Shuffle."
First, some kudos to the GnuPG team. I think this is one example of free software really taking over a given market. I only know of one person who uses the commercial version of PGP, and that's because his job requires it. Everyone else I know uses GPG.
Now:
For those of you lucky enough to be using MacOS X (go ahead a flame me - I've been using Unix for ten years, and MacOS X rox my sox), just grab a copy of GnuPG from Fink and install GnuPG.
After that, grab a copy of PGPMail from Sente, and use the easy, one-drag install. It's still in beta, but it's damn nice integration.
For reference, I'm running MacOS X 10.1.3. When I send an email to someone whose public key is in my keyring, I just click the button "Encrypt" before I click send. Voila. When I receive something encrypted, I have the option of having it automatically decrypt, or I just click "decrypt" in the toolbar. Very nice.
...but it's being eaten...by some...Linux or something...
Network Associates made a fatal mistake in my opinion, that singularly was to belive people are smart enough to ACTUALLY KNOW they need encryption.
People in general, Im not talking slashot techno geeks. Have NO clue WHATSOEVER that information can be snatched from the net. I have told people they have mail bouncing only to see hen freak and become accusitory , HOW do You KNOW ?? You mean You could READ IT ? Blah Blah Blah, I look at em and say yeah but to bwe honest I could give a crap less what you write and to who. hat usually tones em down a notch.
BUT Back to the point, If someone dosent KNOW there is a NEED then there is NO market for the product , If people dont buy it because they dont know there is a need can you blame em ? If someone tried to sell you say a under the desk testicle shield for radiological effects from monitor transmission would you buy it ? a few would , but most no , WHY ? Becaues if here is no problem, the product COMPLETLEY loses its percieved value.
Now, that said they are in a bad market to try and pitch the inherent Insecurity of networks, being Network Associates and all...
Sig went tro...aahemmm.....fishing........
Encryption is one of those things that goes really well with open source. PGP started out as Philip Zimmermann's free and open project which he released with a written warning against software that locked away its source code and algorithms. This makes it a little difficult to go back to closed source and proprietary encryption methods. The internet community's love affair with PGP was broken when Phil quit working with Network Associates. The trust wasn't with PGP alone, it was with Phil heading up PGP's development that drew the trust of us all.
So, its not too surprising that Network Associates is having a little trouble trying to pawn off a product that has no market.
Exit PGP, enter GnuPG.
You are receiving this message because your browser supports Slashdot Sigs and you have Slashdot Sigs enabled.
One of the coolest things about the latest version of PGP (Corporate Desktop, I believe) is its support for smartcards. I have a Rainbow iKey, but it's pretty much useless for personal use because I don't have a certificate compatible with the device. With the newest version of PGP I could store PGP certs/keys on my iKey. It would be great if this kind of support was built into GnuPG. I'd LOVE to be able to use my iKey for PGP on Linux or for token-based authentication
I work for a small HMO, and we are one of the insurance options for Federal Government employees in our state. *All* data that goes back and forth between us and the Feds is supposed to be encrypted with PGP. They even specify which PGP version we are supposed to use.
It will be interesting to see what happens now. I wonder if they will consider using GPG eventually?
Hey kids, there's only 5 days left 'til Yak Shaving Day!
There are, IMHO, two things that keep the average email user from using encryption:
First, it has to be absolutely transparent. It can't put more of an overhead on a standard email send-and-receive than already exists. Key management would have to become at least as easy as address book management (say, having addresses and keys automatically integrated into your keyring). While this would present a security hole, most users aren't going to want to go and verify keys. They're also not going to want to type their password every time they send an email. Most users of apps like Outlook just store their passwords on their PCs anyway, because they can't be bothered logging in once per session (ever deal with someone who didn't remember their password because they never type it in anymore?). IIRC, PGP had several of these features, but with some apps you still had to encrypt to the clipboard and then paste the encrypted message back into your document.
Second, to even get people to do this minimum, and to demand it in products, they have to see the need for it. Phil put it best, I think, when he drew an analogy in the docs for PGP. I can't remember the exact wording, but it was something along the lines of "So you're not saying anything illegal. What would you think if the government outlawed envelopes, and all mail had to be sent on postcards?
Most people don't believe how easy it is to read email, because they have no idea how to go about it. Instead, they shrug and say that they don't care. If instead you ask them how they'd feel about having all of their corporate correspondence and private letters going out on postcards, they'd think twice, and (hopefully) bite the bullet and start using something like PGP. There can be a huge market for applications like PGP, but it has to be sold to people with the right message, and it has to, even at the expense of some security (and yes, I realize the implications of that, and know the argument that no security is better than flawed security), be easy to use.
(email addr is at acm, not mca)
We are Number One. All others are Number Two, or lower.
--The Sphinx
easy, damn straight. not saying it's great, not saying it isn't, but it sure as hell is easy and is for OS X ONLY:
Cypher is an easy-to-use interface to a powerful encryption and decryption tool: ccrypt. Peter Selinger's (selinger@users.sourceforget.net) ccrypt tool is an open-source, fast, and powerful encryption/decryption program. For more information on ccrypt and to download the source code, please visit the ccrypt site at http://sourceforge.net/projects/ccrypt/.
Cypher was developed by ernieWare. For more information, visit the Cypher (http://homepage.mac.com/jhammer/cy) homepage.
Cypher is very easy to use. The easiest way to encrypt a file is to just drag and drop it onto Cypher's icon. Enter the passphrase you want to encode the file with and click "OK". That's it.
To decrypt a file, just drag the file onto the Cypher icon. Make sure the "Decrypt" icon is selected. Enter the passphrase you encoded the file with and click "OK". That's it.
Cypher allows you to create self-decrypting files. If you check the "Save as self-decrypting" button, then Cypher will encrypt your file, then turn it into an application. This allows any Mac OS X user that you send the encrypted file to to open and decrypt the file -- even if they don't have the Cypher application installed (and provided they enter the correct passphrase to decrypt it).
About ccrypt Encryption (from the ccrypt README file):
ccrypt is a utility for encrypting and decrypting files and streams. It was designed to replace the standard unix crypt utility, which is notorious for using a very weak encryption algorithm. ccrypt is based on the Rijndael cipher, which is the U.S. government's chosen candidate for the Advanced Encryption Standard (AES, see http://www.nist.gov/aes/). This cipher is believed to provide very strong security.
ccrypt License
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
Maybe CAI didn't want to keep improving the product. DJB's crypto paper and methodology shows that any key less than 1024 can be "easily" cracked. CAI would have had some more work to do on their product (just as I'm sure the GNUPG team is reconsidering the approaches they are using).
Finding the people to verify PGP is secure and proving that any new method of encryption is secure takes money, and since many people still consider zipping a file up with a password as "strong encryption" there was no market for it.
To think, not to long ago the US govt. was complaining that the world would end if we all had encryption. As it turns out, few cared enough to use it.
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
Remember how Commodore's incompetence helped kill the Amiga? Well I,
:-(. And TIS used to be a pretty good
personally, don't see much difference between that and what NAI has done
to the companies/products is bought/merged.
Where I work we use McAfee VirusScan and the Gauntlet firewall. At home,
personal use only, I use PGP. (Good ol' 2.6.) Since NAI raised its ugly
head:
. Working with McAfee has become more difficult in nearly
every respect, in my experience.
. The Gauntlet firewall product has become so bad, particularly
the support, that we gave up on it. (We're still using it. We just
haven't bothered with (non-)support contracts or "upgrading.") I
used to love that product
company to work with.
. When I tried to license PGP for business use, not only did
NAI not have a Unix version for sale, they had no mechanism whereby
I could license the "open source" version for business use. Think
of it: basically free money for them. They had to do no more than
charge me. No media. No downloads. No support. Just me saying to
them "Here! Take some money." The concept was utterly beyond
them.
So the PGP product is now dead. Imagine that. They've sold Gauntlet to
Secure Computing Corp. God knows what the status of the McAfee product
line is.
In summary: it's my opinion that NAI has done those products, not to
mention their (ex-)customers no favours. Needless to say: NAI is not one
of my favourite companies.
I currently use PGPDrive volumes, does anybody know of one that is better? With PGPDrive volumes I can defrag, mount and unmount and transfer to other systems too, nice integration.
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
Yeah right. Like all the /. trolls are going to flame the poster!
Sheesh! Slashdot moderation isn't worth shit!
There was some short news preview (either for a book or an upcoming show) on fox news yesterday, that I only caught in passing, about the use of technology by terrorist groups. They mentioned in passing that the NSA had cracked pgp 2 years ago. This was news to me.
File encription is very easy with several products. But what key management? And what about email? That is where these products fail.
/Pedro
what about email? so you create a word doc, encrypt it and attach it to your dang email. hard? not.
key management? i'll do that for myself. hard? not.
More info at The Register. This one is better, if only for the reference to Ashcroft and a "lucrative surveillance state."
Sleep: A completely inadequate substitute for caffeine.
We mostly use PGP for VPN access at work, when will GPG have such feature (if ever) ?
On the other hand, the Gauntlet firewall which used to be under the PGP division did find a buyer thankfully. Secure Computing acquired it and IIRC the support people. Now, whether they bought it just to strip the proxy technology from it and integrate it into Sidewinder (x86 based) or if they plan on continuing to develop the Solaris and HP-UX based Gauntlet itself has yet to be seen. As for PGP, like people said, use GnuPGP. Lately PGP has seemed like it turned down a dark path of distrust. I can't ensure that what I've encrypted with the latest versions are actually secure because I don't know what impact 9/11 has had on this proprietary closed source piece of software and any backdoors it may contain.
Perhaps the EFF should buy them and make PGP opensouce/freeware/shareware or whatever, just so there's something out there that the common computing schmuck can rely on in the future.
That was part of the problem with NAI. They integrated too much together on the desktop suite. You had the VPN client (ipsec based), PGP client for encrypting mail and files, PGPDisk for creating what is basically just a loopback encrypting disk image that looks like a drive to users, the PGP desktop firewall software, the PGP desktop IDS software bundled with that firewall, etc.
GPG is just the equivalent of the mail and file encrypting tool that was part of the PGP Desktop package. It has nothing to do with VPN access, firewall software, etc.
Oh that's JUST how I want to get "average joes" using encyrption on e-mail. By building up big freaking attachments and slinging the attachments around, forcing the recipient to download the attachment, save it, decrypt it, and load it in $APPLICATION.
Are you stoned?
any folow-ups on this?
It's a good thing that there are still products like GnuPG and others out there for people who need cheap, reliable encryption.
Yeah, because if NA had a monopoly on encryption they'd definately still be dissolving that business.
Key management? Why all the fuss? Just send the attachment password by email! ;-)
/Pedro
Nope. he's not stoned, he's just a Linux user who thinks that is "ease of use."
He doesn't realize that half the non geeks only attach documents to an email by using Word/Excel/Powerpoint's "mail this document" feature. I couldn't tell you the number of times I've had to show people how to attach a another kind of document (like a picture).
DO NOT DISTURB THE SE
I loved NAI's PGP because it made things so easy!
For instance, if I have a truckload of files to decrypt, it goes as follows.
Select Files > Right Click > PGP > Decrypt > Input passphrase and voila!
Cooler even is that it preserves the original filename after decrypting.
Its always an annoyance to decrypt multiple files with gnupg on linux. Does anyone here know how to implement a passphrase caching mechanism so that I do not have to type that bloody lengthy passphrase everytime? I know this might be a security risk but hey, my home system is not networked. To reduce the risk of people doing stupid things, how about having to edit the source and modify something before the passphrase caching works? I am ready to do that. I am sure most seasoned gnupg users would find that useful too.
Also, how do you preserve the original filename?
Hint: to see the original filename use --list-packets with gnupg.
Simpleguy
Security schemes based on what you know (passwords) or what you can calculate (public/private key encryption) are fundamentally flawed.
Security based on what you are (biometrics) is much more reliable and can range from voice recognition over a 3kHz phone line to DNA scans. The more you need to KNOW, the deeper (but not necessarily the more invasive,) the source. The more you need to be sure, the more biometric signatures you can use to corroberate a message.
Use a pair of biometric keys to encrypt/decrypt using the same algorithms as public key and you've got some underivable security. (The keys don't have to be primes.)
As the Beatles sang all those years ago "There's nothing you know that can't be known." So much for passwords.
And remember, encryption calculations are cumulative. Once you've worked out all 128-bit factors, cracking a code you've never seen before just becomes a table look up. (First rule of performance optimization: NEVER do anything TWICE. You can't buy a second but you can rent one if you use cold hard cache.)
And the price of storage falls every month and the number of factors calculated grows every second. (Don't think the NSA hasn't figured that out yet.)
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
For one dollar!
Hopefully it would come with at least one aeron chair.
mmm. Aeron chair...
autopr0n is like, down and stuff.
Actualy, gpg works on windows. I actualy wrote a COM interface for it a while back at my old job.
autopr0n is like, down and stuff.
Part of the issue with widespread adoption of PGP isyou can't deploy it in a corporate environment. Imagine one disgruntled employee who encrypts a bunch of mission critical files, takes his keys, and goes home (resigns).
Yeah, we will su his a$$! Well, in the meantime, you are SOL and out of business for all intents and purposes.
PGP is great for individual use. It is a far too risky for corporate use.
I don't see why it should. Gnu Privacy Guard is a program that talks OpenPGP (RFC 2440). A OpenSource/Free VPN solution is for example FreeS/Wan. Those are different things ad selling them under one brand, while business-wise feasible, is like mixing aplles and oranges.
If anyone else out there has gotten a chance to use the PGP API, it's simply a beauituful thing for adding crypto to your application. I don't think GnuPG has anything near what PGP had as far as an API (their motto: "Use the command line program as a base for other things!", yeh, real usefull for in-memory encryption)
It sucks to see that go. GnuPG may be free, but the source was available for PGP, and the API was just fantastic.
autopr0n is like, down and stuff.
shows that any key less than 1024 can be "easily" cracked.
eh?
Yes some weeknesses have recently been discoverd in the RSA algoritham meaning that 1024 bit keys are less secure than people thought. HOWEVER PGP defaults to a 2048 bit Diffie Hellman (sp?) key.
Not only that but PGP will happly accept DH keys up to 4096 bits (and RSA keys to 2048 bits if you are set on using RSA), just by changing the defaults!
I think your comment is missleading. Standard PGP keysizes are secure (and should remain secure for many more years) but uping the keysizes can be done very easily!
Anyone quoted by a reporter knows how little they understand
Don't believe what you read is the truth.
easy as proxo or zonal? Yeah, right pad're PGP wuz another 6-finger webfoot bitch.
Only reliable, when care is taken to maintain system security. Let us not forget the pgp virus
created by the Chinese Government, which simply sends them all your key rings........
Suppose someone finds an exploit in the device that does your retinal scan. Your admins must now deny your retinal scan credentials, and you have to switch to the other eye (presuming you have a spare). If that credential is compromised as well, you're completely out-of-luck.
With a passphrase-based system, by contrast, you can just change your passphrase as needed.
Hes a typical windows user and won't read instructions.
That is a bit like giving someone keys to your house and not showing them how the funny lock works
For him to send a plaintext message that he thought was encrypted (because he didn't RTFM properly) could have been disasterous. In the same way that your friend not locking your door properly ('cos he didn't know how) could be disasterous
Anyone quoted by a reporter knows how little they understand
Don't believe what you read is the truth.
You know, I'm a huge believer in open source, but I'm starting to loose faith.
We always cry that OS software is the way to go, and greedy bastards who charge for software are evil.
Well, look at the economy. Look at the number of out-of-work techies out there mowing lawns and flipping burgers to stay afloat. I wonder how many of them would have jobs if there was less open source software in existance. Are we shooting ourselves in the foot?
Guys, everybody here is missing what really happened here. About a year and a half ago, NAI separated the command line product from the GUI desktop product. NAI discovered that people will pay a large chunk of change for scriptable, command line stuff, and that they almost had to give away the GUI version. When they dissolved the business unit last October, they decided to KEEP the command line version [the McAfee biz unit sells it now, for the same large chunk of $$$] but were trying to sell off the GUI version. Now, riddle me this, riddle me that, how do you sell the GUI version to another company when the command line version you're keeping USES THE SAME CODE?! That's why NAI couldn't sell it -- no company wanted to pick up a product that NAI was going to keep the core product to. I know because I worked for NAI in the PGP division.
It all is a big shame too. The last version, 7.1, was cool. It was stable, had an IPSEC client that could talk to pretty much any VPN gateway out there in addition to creating peer to peer IPSEC tunnels with other PGP clients as well. A mini firewall / IDS rounded it out. Frankly, companies just aren't paranoid enough to require that level of encryption yet. And until that happens, no commercial product is likely to succeed in this arena.
The freeware version on the PGP International site goes up to 7.03: downloads here. This site is not owned by NAI so it shouldn't be affected by this decision.
it comes with some nice extras such as a very nice firewall
And that is partly the reason nobody bought it.
PGP evolved into a nice e-mail encryption program. NA added so much crap to this (VPN that hardly worked, Firewall, hard drive encyption) they forgot there core market..... secure E-MAIL and convincing people that it was nessisary!
(In a corperate enviroment, people alredy have firewalls etc... NA just made PGP more complex)
I actually bought a version of PGP Personal Security 7.0.3
YTC !!!
NA never published the source code for version 7. That was the reason Phil Zimmerman left NA.
Version 6.5.8 could be downloaded as freeware and is every bit as compatable!
Anyone quoted by a reporter knows how little they understand
Don't believe what you read is the truth.
I agree that NAI has brought the demise of this product upon themselves. This product was destined to be a killer app, but they have not given it a proper chance.
They have never marketed it properly to the corporate world. Except for us geeks, who knows about it? Surely the underlying concepts of cryptography will never be well-known, but they haven't even tried to push the feeling "PGP makes my email secure". (This marketing goal is feasible; compare it to the majority that thinks "Linux is secure!")
To make it worse, NAI effectively denied the existence of a consumer market. In fact, in my area (Netherlands) it was not possible to buy PGP 7 as an end-user until end 2001 (I gave up trying then). No web shop for Europe, so no impulse purchases. NAI's dutch branch only sold the obsolete 6.x version; does a geek want to spend their money on a (flawed) old version? I know several other people in my area who were willing to buy a copy but failed. If this sample is representative for NAI's overall policy I can imagine why they could not "excel" in this market.
I hardly feel sorry for NAI, they have made serious mistakes and the lack of revenue and market share is a logical result. Although NAI effectively destroyed PGP's credibility, PGP (even their PGP application suite) still has a lot of potential and even now NAI could be able to clean up their act; they have a good working set of applications which can easily be adapted to all ages and markets!
To see this valuable product moved into maintenance mode is a big shame. I wonder who will jump in to fill the hole they left.
What puzzles me most is - why hasn't Microsoft Corp. made an offer to buy the PGP technology?
( ^_^)/
Uses GPG and works with all Windoze applications that allow cut/paste of ascii text.
Government of the people, by corporate executives, for corporate profits.
There is no open source IPSEC client for windoze. I know, since a guy wanted me to setup a VPN for him. I setup FreeSwan, then realized that the only way to make windoze connect up was to buy copies of PGP/NET's IPSEC client...
-Erik -- --This message was written using 73% post-consumer electrons--
you can't deploy it in a corporate environment.
You ARE wrong! Read this about which PGP version to use.
Here is a cut 'n' paste of the intersting bit....
The Business versions allow you to set up how PGP will be used throughout an organization, and also allow for use of an Additional Decryption Key (ADK); but do not really include anything of additional value to an individual user. The ADK is just a master key used by an organization that all of its email/files is also encrypted to, so that if someone leaves the organization, there will still be access to his/her encrypted files - It has absolutely nothing to do with concepts such as government key recovery.
Anyone quoted by a reporter knows how little they understand
Don't believe what you read is the truth.
Try the new mailvault.com.
PGP is a nifty little package for encrypting files & e-mail. If it had been sold as a nifty little package at a low price, NAI would not be looking to dump it.
I played with PGP when it was freeware. In a pilot project, I exchanged office gossip with a co-worker to see if ordinary people could use it effectively for secure e-mail communications. It worked quite well, but we didn't have a pressing need for the technology so deployment went nowhere.
Years later, I'm at a different company and now I have a use for it. I visit NAI to see if I can buy just the basic file & e-mail encryption. I discover all they really want to sell is the entire PGP Desktop bundle, for a price that IMHO far exceeds what basic encrypted e-mail should be worth. Eventually, I managed to buy the basic package, but only after making phone calls and finding a reseller who could do such a thing. The licensing complexities of the whole process was as if I was buying an nuclear reactor! Had this been an easier process, I might have deployed it on hundreds of PCs, instead it's only a handful.
I am the customer; I am always right. I want an easy-to-buy, easy-to-use, cheap-to-deploy package that encrypts the 5% of my users' e-mail & files that are worthy of encryption. NAI could have marketed PGP successfully to a high percentage of business and home PC owners, but for whatever reason they chose to go after the ultra-paranoid, encrypt-everything, price-is-no-object crowd instead. PGP is a great product; better management could have made it profitable. Maybe someone will buy the product and figure out how to broaden its appeal.
PGP is a good solution to email security. However, commercial software is mostly now using S/MIME, which is probably not less secure (if you use a good algorithm and reasonable-length keys). S/MIME is specified in a bunch of RFCs and is actively being extended and improved (see the IETF site for details). You can get open-source code for it (e.g. it is part of Mozilla).
I don't believe someone hasn't posted this. I use PGP CKT and am VERY happy with it. It is built off of the last version of PGP that came with the source (6.5.8 Desktop Security, if i'm not mistaken), and they are currently on their 6th build (Build 07, which will fix XP problems is in Beta).
PGP CKT, comes fully loaded with PGPDisk, and PGP4ICQ, and the plugins for Outlook/Outlook Express, I'm not sure about PGPNet, I don't use it.
I was just about to download the freeware version of PGP last night when, in response to the mandatory registration, I read their privacy policy. Things like "We may also carefully select other companies to send you information about their products and services." caught my attention. Basically, they sell your information and require you to contact them to prevent this from happening. No, there isn't a 'please do not share this information' checkbox.
That doesn't look like much of a privacy policy to me. Hence the reason I didn't proceed.
I pledge allegiance to the flag...
of the Corporate States of America...
It used to be that one could just find a file named idea.c in the contrib directory of the primary gnupg ftp repository, but they were forced to remove it. You can find the idea.c in the contrib directories of mirror sites in countries that allow the distribution.
The idea.c file and it's detached signature made by Werner Koch.
All editorial writers ever do is come down from the hill after the battle is over and shoot the wounded.
what about the other 90% of the people (literally) who don't use unix?
Thank you.
Considering that there's no open source version of Windows, why not just use the built-in IPSec stuff? AFAICT, FreeSwan interoperates with it.
> Oh that's JUST how I want to get "average joes" using encyrption on e-mail. By building up big freaking attachments and slinging the attachments around, forcing the recipient to download the attachment, save it, decrypt it, and load it in $APPLICATION.
.exes compared to the other, easier mail, and why can't .exes just work as nicely?..back to Square One so far as antivirus efforts are concerned.
> Are you stoned?
You're making the "average Joe's" case for auto-executing attachments and scripts as well. If you want people to get used to handling attachments in a secure manner, then all of them need to be handled that way or Average Joe will whine about how 'inconvenient' it is to work with
Ease of use has its limits if we all want safer email reading.
So NA kills PGP?
Is that a silent 'S' between the 'N' and the 'A'?
-- veni vidi nuclei deceri --- I came, I saw, I dumped core.
When Phillip Zemmerman sold pgp. Their was a cluse in it. That clause is that a person can get pgp for free for personal use. However you must purchase pgp if you are going to use it in a corporation. You can down load it for free at the MIT web site. You must be a US resadent.
My kingdom for a mod point. PGP 6.5.8ckt is the most feature-powerful and trustworthy version of PGP available.
-----
PGP Key ID 0xCB8FF658
Anyone care to comment on how long ldap://certserver.pgp.com will remain operational?
-----
PGP Key ID 0xCB8FF658
and what is closed source ?
I only know UNIX/Linux and BSD.
That, of course, means replacing Microsoft "swiss cheese" Outlook and other oh-so-convenient-yet-sieve-like software, which is why it hasn't been done yet. It might also be necessary to switch to Linux to avoid all the security problems of closed source Windows. As reported on Slashdot, this is already in the works.
For a corporate of enterprise environment you NEED the ADK that the NAI corporate version comes with. At home we can all use the free versions, and in fact I do, but it is not even a remote contender for most of my clients with 50000+ employees.
NAI dropping this is going to seriously shaft them! There are some alternatives, but the transition is going to be expensive. Even the change of user licenses will cost over 1 Million pounds for a couple of my clients.