Slashdot Mirror
An Introduction to GNU Privacy Guard
An anonymous reader writes "This is a great article about GnuP . . . "In the first half of this article David Scribner discussed the various uses that GNU Privacy Guard could bring to your business or personal life in enhancing security of your digital documents and files, as well as the basics in getting started with GnuPG. As there is so much more to public-key security than command-line operations, in this second half I will continue with importing and exporting keys, building (and keeping) your 'web of trust' sound, and a few of the more popular GUI front ends available for GnuPG . . ."
Warm and fuzzy feeling aside, how do we convince companies to use this? Is it at all possible? Are there any success stories (I know it's new and all)?
Slashdot: Where people pretend to be twice as smart as they really are by behaving like children.
Remember this can be used to copyright stuff as well. But technology should always win, and we can defeat it or more likely ignore "copyrighted" stuff.
"the first half of this article David Scribner discussed ..., in this second half I will..." (emphasis mine).
Gee, could the "anonymous reader" be David Scribner giving himself a shameless plug? See the above quote.
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
- Read PGP messages I send them
- Encrypt messages they send to me
- Sign their messages and
- Verify messages that came from me
This is just the first step in the great battle for our Constitutional online rights, but it's a good one. As long as I have something to keep them from tying all my information together in a giant government database and crossreferencing them to steal my organs when I die, I can sleep at night.--sdem
I know new systems and apps create a bit of a chicken-and-egg situation.. but what about this:
Today, I use GnuPG for a variety of tasks. Whether it's to sign and encrypt documents and contracts submitted to businesses, encrypt local files, or merely sign email and files to ensure others that no modifications have occurred to its content, I have found GnuPG to be a 'must have' utility kept close at hand when using my PCs.
Documents submitted to businesses? Signing e-mail and files?
Signing these sorts of things is a good idea, but just how many businesses are going to have GnuPG at this time. And, since you can get the files out of the e-mail without HAVING to use GnuPG (GnuPG just checks the authenticity), it doesn't really encourage people to go get it either.
Considering most people are Joe Schmoes using Windows, I can't see how using GnuPG (or even PGP, for that matter) to sign things is going to help anyone at this stage.
Outlook Express is the most common e-mail client out there today and from all the e-mail I get.. I'd say that far less than 1% of its users actually use the signing and encryption features that are BUILT IN! GnuPG is an add-on, at best.. so can we really see millions of people using this?
Until the public learn more about security, how it works, and why it should be used, I think not.
mogorific carpentry experiments
prevents innovation of great new things
What are you doing that you don't want the government to know about?
Now, how do I keep my passphrase a secret while the CIA is bashing my toes with a hammer?
I guess my point is that public/private key encryption is only as good as the passphrase which is often not good enough, and that the ecryption is way stronger than your personal torture threshold anyway.
.....the GNU/Linux Guard? After all, GNU runs on Linux............ :)
There are a number of applications GPG is good for besides cryptography -- I use it to verify Linux kernels from kernel.org, for example -- but I know several people that think that once you figure out how to encrypt mail you're secure. It's probably good to keep in mind that there are a number of other points at which an attacker can read the mail (swapfile, keyboard logger, trojan, net sniffer, tempest, emp, and buffer overflows) even if the application itself is bugfree and Open Source, so remember that this is just supposed to be a component in a system of security.
If your family and friends insist on using Outlook or Outlook Express, try pointing them at G-Data's, GnuPG Pluginfor those MUAs. One downloadable Win32 .exe and a simple installation puts buttons to sign/verify and encrypt/decrypt on the toolbar.
/we/ all know how to encrypt our email. But until "Your Mom" (TM) can do it, it's not useful.
Because let's face it,
--
E_NOSIG
sorry if this is a repost..
why run from Vincenzo?
the "original" handbook does the job much better.
I've been interested in GPG and encryption for a couple of years, but I can't convince any of my friends to be interested. So all my communications with them must be unencrypted.
:(
I know you can get it as easy as typing in a password when an email gets sent, but that's too much effort for my parents and most of my friends.
An actual method of attacking encryption listed in a text book on it in my university library listed the "Rubber-hose" method. The point is to remind people that if you are protecting something of value, monetary or other to someone else, you can not just rely on encryption. Beating you and/or your loved ones,ie. wife, children, pets is an effective means of getting access to something protected by encryption. Luckily I never tell my wife any of my passwords, and last time I checked my cat wasn't talking.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
crypting to the masses, make it mainstream to crypt your messages... i'd like to see one single person who isn't all that paranoid etc... in security things that would use some kind of crypting...
Pulsed Media Seedboxes
GnuPG is definitely, certainly, and really the way to go with secure encryption and security systems, here's why..
The simple and undisputed -- and often argued -- fact is that we've come a long way, and the majority of large businesses are now using Linux as both a desktop and server OS which means these things are efficient to do.
GnuPG's (shouldn't that be GNUPG since GNU is an acronym?) ease of use and its (almost) seamless connectivity with most Linux communications applications allows the average workplace user to encrypt documents and files, preventing PR-disasteresque leaks -- such as the recent leak of the salary details of Lycos' staff to InternalMemos.com..
The seamless and very good encryption and decryption system allows staff of lots of big and small companies to simultaneously access and also work on their valuable and secure data as usual, but means that even if sites like F**kedCompany get hold of it, it's no use to them. Copying and pasting will just result in goobledygook being produced.
GnuPG's automated hyperencryption routines also mean that it could have some extremely useful and oblique military functionality, allowing our brave patriots to fight terrorism around the world.
One such example is in the encryption of numeric data such as numbers like digits between 0 and digits under 9. These encyrption routines can improve the efficiency of this by 24%.
mogorific carpentry experiments
I use gpg all the time, and I know a lot of other people that use it, it is a great program.
However, a problem is that people just aren't good enough at getting their public-keys out. I hope this article enlightens them on the lovely export option. Which I believe to be one of the most important parts. I receive email from a lot of lists everyday, LUGS, development lists and so on. A lot of this email is signed, but a lot of these people obviously don't get the points of signing completely since they haven't got their public key available in anyway (of course some may not believe in the keyservers and so on, and want to be contacted in other ways for key-exchange, but not all are that pre-cautious, some just don't understand), and thus I cannot verify their signature.
I don't believe most people with 'nothing to hide' will be convinced by this argument for privacy. So, can anyone come up with a concise line of reasoning that will work?
If there is hope, it lies in the trolls.
One of the problems I always had using pgp/gpg was client support. Getting it to work with outlook/outlook express, then finding something under Linux that would support it, having to scrap together a bunch of tools, all of which were half-written...
I've found a solution. Mozilla and Enigmail. Yes, Mozilla/Netscape mail used to be putrid. It's better with Mozilla 1.0+, honestly. It has progressed to a competitive state, and I switched over totally about a month ago.
Enigmail is a plugin for Mozilla that handles signing, encrypting, decrypting and verifying mail for you.
GnuPG, Mozilla and Enigmail all work on Windows as well as Linux, so I have the same tools no matter what I'm running.
You still need a key manager, but getting what mozilla+enigmail provides is a great step forward.
How does it feel to be ignored???
Werner Koch is a great guy and everything but he is very confused about security and good design. What we need is a library form of ths program so we can link it into everything and anything: mail readers, web browsers, databases, Java Native Interface, VoIP, just about anything. Unfortunately the confused Mr. Koch thinks that making gpg available as a library would compromise its security. This is a large part of the reason why pgp encryption isn't available everywhere. The other part of the problem is that it's under GPL, which means that even if it were a license, it couldn't be included in commercial software. pgp didn't take off because of licensing issues and design problems, and gpg isn't taking off because of license issues and design issues. Mr. Koch is a good programmer but he doesn't understand security or design. This is very unfortunate.
After reading Crypto, and now this Slashdot post, PGP has really heightened my interest.
I'm particularly curious about how secure the GnuPG key-gen process is. How "pseudo-random" is it? What's the likelihood that I could generate a private key matching someone else's?
Should I be concerned?
-jc
GPG only runs from the command line meaning apps that wish to call it have to construct a command-line, invoke gpg and parse the results in a pipe. It desperately needs a LGPL lib to relieve this burden. The only lib so far is gpgme which is GPL making it pretty useless for this task.
I pointed out gpg to my bank [umbrellabank.com] for account-related communications (but they don't seem to get it yet...they're a bank). Everybody else ask your bank about it too. It's evangelism. The squeaky wheel gets the grease.
;)
That might be possible in the US since you have regional banks and actually get to talk to people there.
In the UK, all of our banks are national, and very very faceless. Not many people have 'bank managers' anymore, and even people with big money have 'account handlers' instead. You can talk to stupid 'business advisors' at the bank, but only at certain branches. Good luck trying to give a bank advice in this country!
And most importantly, I encrypt love letters to my girlfriend. Don't want anyone reading that stuff.
I wouldn't want a girlfriend who's geeky enough to decrypt encrypted e-mails though!
mogorific carpentry experiments
I have never understood why people use this phrase. The answer to "which came first?" is quite clear : the egg, by many millenia. The first chicken was a mutated version of its non-chicken parents, but it hatched from an egg.
In this case, "chicken & egg" actually is a useful metaphor, but not in the way the original poster means. We already have the egg (ability to use strong encryption); tech evangelism of the kind you describe will bring us chickens.
My next sig will be ready soon, but subscribers can beat the rush
There's an excellent system called rubberhose that solves the problem of 'rubber hose' cryptography (ie. beating the key out of someone.)
You give it a certain amount of space to play with and then can encrypt "aspects", sets of files, to it. Each aspect is protected with a passphrase and there isn't any way to show how many or few there are. If tortured, the user has no way to prove they've given up all the keys - making it possible for them to hold out.
It's also possible to use it to give people some information and limit disclosure - the documentation has an excellent example using safehouses.
Sometimes the utility of GPG has little to do with the capabilities of the recipient.
khl
Have you read the FAQ on this point? Apparently many people have been able to get valuable work done with GnuPG as a CLI app, so saying it "desperately" needs to be an LGPL-covered library doesn't follow.
This makes it seem like your objection has to do with the license chosen, not whether the program is an executable or a library. And yet I see no argument supporting your desire to switch the license to the Lesser GNU GPL.
Digital Citizen
I've been saying this for years. Werner Koch is a good coder but he's not very smart about design and security. He believes that making gpg a lib would compromise its security, which is hard to even imagine that someone could think that but there you are. At some point if I have time I will write one.
A key aspect of GPG's success is to increase its adoption by users of Windows. For those of you wishing to give GPG a whirl, I suggest you get WinPT, an easy-to-use, open-source frontend.
Here are four easy steps to get you up to speed:
If you use Outlook Express, you would definitely want to get GPGOE, a GPG plugin that seamlessly integrates with Outlook. You need to install and configure GPG for this - the easiest way is to install WinPT as described above [WinPT also makes key management very easy, so there's a bonus]. Then you can download and install GPGOE, and enjoy all the goodness of integrated GPG functionality within OE.
Play around with the different options available; make a key for fun; experiment and learn. Spread the word. But most of all, have fun and be excellent to each other
Good luck.
Use ISO 8601 dates [YYYY-MM-DD]
The FAQ is just plain wrong on this. Keeping the code in a separate binary does not do the tiniest bit of good for security. In fact it makes security worse because then programs have to figure out how to parse the output and input of gpg in some secure way. History has shown that this is not an easy task. Someday I'll hire someone to write a pgp library under lgpl and we'll solve this problem.
although I will probably be using it through enigmail, can anyone recommend a win32 front end ?
mwahwhwahwaha!!! That is great.
If you use Outlook or Outlook Express, get the Gdata plug-in.
It is a very easy install. Easier than Enigmail (which is good, too). In fact, it will install GPG for you if you don't already have it.
... ...
A simple method of making your wireless stuff invisible to any other
wireless stuff or signal that would want to communicate with it.
www.mobilecloak.com
It blocks RF signals, 10MHz to 20 GHz from leaving or entering the bag.
It's cool for EZ Pass, cell phones, and RFID tags.