An Introduction to GNU Privacy Guard

An anonymous reader writes "This is a great article about GnuP . . . "In the first half of this article David Scribner discussed the various uses that GNU Privacy Guard could bring to your business or personal life in enhancing security of your digital documents and files, as well as the basics in getting started with GnuPG. As there is so much more to public-key security than command-line operations, in this second half I will continue with importing and exporting keys, building (and keeping) your 'web of trust' sound, and a few of the more popular GUI front ends available for GnuPG . . ."

Comments

The weakest link

[FreshMeat-BWG]

Ok, so I have n-bit keys protecting my super secret confidential data that is going to take x-million computers y-thousand years to crack and I feel pretty good knowing the CIA won't spend $z trillion dollars finding out my grandma's secret cookie recipe.

Now, how do I keep my passphrase a secret while the CIA is bashing my toes with a hammer?

I guess my point is that public/private key encryption is only as good as the passphrase which is often not good enough, and that the ecryption is way stronger than your personal torture threshold anyway.

Re:The weakest link

[tbmaddux]

I guess my point is that public/private key encryption is only as good as the passphrase which is often not good enough, and that the ecryption is way stronger than your personal torture threshold anyway.

That's true, which is why it was originally well-named as "Pretty Good Privacy." It solves the lowest-order problem, that your email is transmitted as plaintext across the Internet for anyone to read.

And of course, the CIA doesn't really need to bash your toes; they can just put a keyboard sniffer on your machine, or put a spy camera to capture your keystrokes while you type your password, or lots of other interesting things that only require a warrant and don't require torture.

GPG was easy to setup (on our Macs, even!) and now I don't have to worry about whether or not the script kiddie down the road can sniff the private messages I send to my wife. That's Pretty damn Good Privacy.

Re:Really that useful yet?

[mcelrath]

I know new systems and apps create a bit of a chicken-and-egg situation.. but what about this:

...

Until the public learn more about security, how it works, and why it should be used, I think not.

So you state it's a chicken-and-egg problem and then go on to demonstrate it's a chicken-and-egg problem, adding nothing to the discussion. Then you say we all shouldn't use it, because it's a chicken-and-egg problem. Give me a break! Here are a few ways to crawl out of the chicken-and-egg situation:

Signing your e-mail makes GPG visible to those that don't know yet. Every once in a while someone will actually look at that attachment, follow the little link, and maybe learn something. For technically saavy users, this is simply tech evangelism. Someday we will all learn in high school how to manage our private keys, instead of teaching us how to fill in the blanks on a check. I have personally converted 4 or 5 friends (and my dad!) to using it.

I use GPG to store sensitive information. I keep a GPG-encrypted file with passwords (mostly for websites) in it. That way for each %@#(&@$ vendor that insists on storing my credit card info, I can generate a 20-character random password, put it in this file and forget about it.

As a system administrator, I have had many occasions where people want an account but I'm not physically nearby for them to type in a password. I usually point out GPG saying that if they used it, I could send them a password. Since they don't, they'll have to wait a few days until we can be in the same room. Again, it's evangelism.

I pointed out gpg to my bank for account-related communications (but they don't seem to get it yet...they're a bank). Everybody else ask your bank about it too. It's evangelism. The squeaky wheel gets the grease.

And most importantly, I encrypt love letters to my girlfriend. Don't want anyone reading that stuff. ;)

Making the public aware that this kind of technology exists is, in my mind, the single most important revolution happening today. It is the key to take back freedom from our oppressive government (and the even more oppressive governments out there). It is the key to the electronic money of the future. It is the key to the electronic contract of the future (this click-to-accept shit has got to go). I definitely don't want to "click" to buy a house. As long as we keep them ignorant and don't evangelize, we can guarantee we will never see the electronic future we read about in books.

-- Bob