PGP's New Release, Source Code, and PRZ

In high tech time, the span between Network Associates dropping PGP, its purchase by the purpose-formed PGP Corporation and that company's release today of PGP 8.0 may not be a short stretch, but it's been a busy several months. A product which appeared moribund despite widespread acclaim a few years earlier -- a victim of skewed corporate logic -- has rebounded for another major release, and Philip Zimmermann is doing something he's never done before: actually selling PGP. And as Zimmermann had urged long before NAI forged a deal with PGP Corporation, this time around the full source code is being released, albeit with strings. Read on for the rest of the story.

Would you buy PGP from this man? Long before Dmitry Sklyarov was arrested for helping people undo e-book encryption, and before DeCSS was unlocking DVDs, Philip Zimmermann was being prosecuted for a nearly opposite endeavor: providing software which allowed ordinary people with a modicum of computer savvy to encrypt their own data in a way impractically difficult even for large government agencies to reverse. His modestly named application Pretty Good Privacy, or PGP, was released in 1991 as freeware and was quickly adopted by privacy seeking computer users.

Export controls then in effect barred international trade in such software; because of PGP's inevitable spread online well past the borders of the U.S., Zimmermann was accused of violating munitions-export laws. For a while, this made Zimmermann a poster boy for the right to create software free of intrusive restraint, and ended up in a three-year battle with the government which Zimmermann eventually won.

Now, in a twist worthy of novelization, Zimmermann has joined a small number of PGP Corporation partners on North America, and will be reselling PGP Corporation's version of PGP. Outside North America, PGP Corporation has sales partners in countries from Germany to Singapore -- in a sense, Zimmermann is simply their most famous salesman. (He also serves on PGP Corporation's technical advisory board and maintains a consulting relationship with the company.)

Sales, though, is really a sideline to Zimmermann's consulting business. "I'm not really switching my career to sales," he says. Zimmermann is nonetheless enthusiastic about his new role selling the software he kick-started more than 11 years ago, though it's a switch from his role in creating it. "I don't write code anymore," he said from his Silicon Valley home office. "As you get further along in your career, you get further away from the things you like to do. I wish I could get back to it, but it's the Peter Principle, and here I am." Zimmermann downplays the Federal government's legal proceedings against him in the first half of the 90s, calling it "old news" and "years in the past."

Like any large organization, in fact, the Federal government has a need to encrypt certain documents, so it's no surprise that the government bodies of every stripe use "a ton" of PGP. It seems likely that his sales venture means that Zimmermann will soon have come full circle, from producer of verboten software to vendor selling his product to government agencies. Zimmermann admits "It would be funny, and there would be a certain irony if that happens ... I'm hoping to sell to enterprise customers, large users, and that includes the government. If the government wants to buy it from me, that would be fine with me."

Something to sell, and source code, too. PGP's present is finally catching up with its history (try this google search for a number of links): today's release of version 8.0 for Windows and Mac OS X differs not just in name from PGP as it was released under NAI's stewardship, because this time there is full source code to go along with it. (A Linux release is being investigated.)

The 8.0 release doesn't differ in basic purpose from previous versions of PGP: it's still intended as an easy-to-use approach to encryption for both business and personal use, with hooks to a wide range of network operating systems and mail systems; there are several simultaneous releases, actually, from freeware (for non-commercial use) to an Enterprise edition, and the features available vary with the price. There's also a link to download the full source, under certain conditions, from PGP Corporation's home page.

PGP Corporation director of products Stephan Somogyi says he's proud of the way the company has walked the tightrope between source code availability and securing its own interest in the product based on that code.

The license agreement it takes to download source code, however, contains clauses guaranteed to rankle some open-source advocates and security enthusiasts. For instance, part of the third section of the eight-section source code license reads: "You agree that you will not post any information about any bug, problem, deficiency, or weakness in the PGP software on any web site or electronic bulletin board, or otherwise disclose or provide any such information to anyone else, unless you have first reported it to PGP and until at least 30 days after PGP sends its email acknowledgement to you."

Another section carefully lists uses of the code which are explicitly prohibited, including a note that a downloader may not "give (meaning sell, loan, distribute, or transfer) the source code files to anyone else" (except under certain outlined circumstances). Further, those who download the source code may not "use executable code versions of PGP software programs created by compiling these source code files for any purpose or reason other than verifying that there are no unknown vulnerabilities or the like or otherwise making your own assessment of the integrity of the source code and the security features of the PGP software."

Somogyi draws a distinction here between the meaning of an End User License Agreement (EULA) and a source code license such as the one required to download the PGP source. The source code is there, he says, because "PGP [Corporation] is making it clear that we don't have anything to hide and that PGP remains a trusted brand, a trusted codebase."

With nothing more than a click-through license protecting it, there will almost certainly be rogue copies of the source code soon, but as Somogyi puts it, "the only place that anyone who cares about their security is going to get PGP is from us -- no one is going to use some randomly compiled version of PGP, because they don't know the provenance. It's all about trust, from our perspective."

Zimmermann, too, takes pains to note a distinction which sounds similar to one made by Microsoft in describing that company's "Shared Source" source code disclosure. "Publishing source code doesn't mean you've giving away the software -- if you think about it, John Grisham publishes his novels in source code form. Does that mean he's giving up his copyright in them? No. If Microsoft published the source code to Office, does that mean they wouldn't still want money for it? There's a difference between letting people look at your source code -- finding bugs, fixing problems -- and giving it away."

Reputation and Propriety. It's hard to say how much of PGP's reputation is really that of its creator.

Zimmerman's insistence on his right to create troublesome code, and on the freedom to encrypt which his software provided its users, endeared him to crypto-libertarians before most of the current battles of software freedom and philosophy had reached public consciousness.

Whereas Zimmermann famously left Network Associates, PGP Corporation seems much more interested in maintaining the integrity of Zimmermann's connection to PGP, which is if anything a tacit admission of Zimmermann's importance to the company's reputation.

"We would be foolish if we did not seek counsel from people who are the best in their fields," says Somogyi. "It's really important that Phil be involved." Zimmermann's presence on the technical advisory board from its inception will probably serve to reassure users worried about corporate machinations.

Should You Buy PGP from this man? When PGP was first released, it was cutting edge -- in the sphere of ordinary computer users, it was a runaway hit. Now there are alternatives to PGP; in the Free software world, these include notably the GNU Privacy Guard (GPG), a suite of tools which aims to be a user-friendly equivalent to PGP consisting entirely of Free software.

Neither Zimmermann nor PGP Corporation's Somogyi seems worried about Free software alternatives to their own products, which can after all still be used free of charge.

"There's still a freeware version of PGP, and there's still going to be a free version of PGP, including the version that's coming out, version 8," says Zimmermann, who actually points to GPG and several other products from his sales web page. "I applaud the creation of GPG, we need to have multiple sources for this kind of technology. But you know, PGP is a good product, I think that it's easier to use."

Somogyi echos this line of reasoning. "Fundamentally I think that the people who use PGP is one group, and the people who use GPG are another, and I don't see a heck of a lot of competition between the two efforts," he says.

Zimmermann says that the prospect of selling PGP, though -- and making money from it -- is key to its prospects for success. "Look at what happened last time when nobody paid for PGP. NAI pulled the plug on the product. From February of this year until August, PGP was in limbo. ... Remember the National Lampoon from 70s, 'Buy this magazine or we'll shoot this dog'? That's what happened. They shot the dog!"

"It takes money to pay the engineers, it takes money to do all this stuff. PGP is a big important product, it doesn't just happen for free." And when NAI dropped PGP development, the software "went into an intellectual property black hole. When a company pulls the plugs on a product, it just disappears. All this political posturing about saying that cryptography should be free, that's all very nice, but it doesn't pay the bills."

Comments

Good for Zimmermann

[BlueAlien.Org]

If he can get corporations and individuals to buy his product, then where is the harm? I wish him the best of luck on trying to profit from his creation. Of course, the license is very prohibitive, but I don't see that as being a major factor affecting sales.

- Rick

Re:Good for Zimmermann

[krog]

Good for him if he can pull it off, but GnuPG is free-as-in-your-mom. Who wants to pay for it?

Re:Good for Zimmermann

[Anonymous Coward]

Due to the overwhelming demand for PGP 8.0 products, we are experiencing difficulties with the volume of downloads being requested. Please accept our apologies and try again in a few hours. If this problem should persist, please contact PGP at (801) 772-1875.

Companies typically don't do anything with licenses other than abide by them. It won't take much for ``management'' to hear of PGP as the solution to all security problems and sign on for it. On the other side of the coin, if everything is protected by PGP (email too), then the workers can't be snooped on, and who knows what those evil little ants could be doing!

Re:Good for Zimmermann

[Gemini]

On the other side of the coin, if everything is protected by PGP (email too), then the workers can't be snooped on, and who knows what those evil little ants could be doing!

PGP comes with corporate access features (the "ADK") so that the boss can always read employee messages. Needless to say, it's a controversial feature, but companies don't like the idea of an employee encrypting all their work and then, say, walking in front of a bus.

GnuPG ignores ADK packets, incidentally.

Re:Good for Zimmermann

[/dev/trash]

When the government makes free encryption illegal, then what will you do?

Re:Good for Zimmermann

[Anonymous Coward]

Hey guys, what is PGP anyways?b

Re:Good for Zimmermann

[Anonymous Coward]

Hey guys, what is PGP anyways?

Re:Good for Zimmermann

[Anonymous Coward]

I'll worry about that when the time comes.

I can buy it but ....

[frovingslosh]

OK, I can now buy the software for personal use, but I can download the source for free (for review, yada yada yada). Anyone see a problem with this logic?

Re:I can buy it but ....

[Gemini]

They're relying on users to either Play Nice or not be technically inclined enough to compile their own copy. It's not that absurd, really. How many people actually compile their own PGP? (How many people *should* is another issue).

Re:I can buy it but ....

[BlueAlien.Org]

The vast majority of potential buyers of PGP will not want to fiddle around with the source code. This way Zimmermann's company can satisfy its core customer base along with the majority of geeks who like to mess around with the source code of a great piece of software. Its actually a pretty good idea IMO.

- Rick

Re:I can buy it but ....

[Night Goat]

They explain it in the article. The makers of PGP feel that some guy compiling the source code and making it available or using it himself isn't going to cut into their profits too much because most people interested in using cryptography aren't going to use some shady, homebrewed, perhaps compromised program, they're going to buy it straight from PGP so they can trust it.

Re:I can buy it but ....

[ergo98]

You can buy a copy of Windows at Best Buy, or you can download it from a warez channel, or you can go to a friends and rip an ISO of his copy. Doe sanyone see a problem with this logic?

Phil has always advocated that it is very important that there is peer review of security products, and I entirely agree with him on that point, but he is not An open source advocate (which is why I find the nitpicking about the license absurd: It's not GPLd, folks, it's peer review. The release of the source is only intended to allow for particularly paranoid folks to ensure that there aren't any backdoors in the code). They are two entirely different things, and it's completely reasonable for him to release those products as he has.

If someone builds the source and distributes the binary, they are no different from someone ripping an ISO and distributing warez.

Re:I can buy it but ....

[Anonymous Coward]

Actually.. I may be posting what others have already said, but yes, I do see a problem with that. The problem is this: dishonest people will still download the software, compile it, and use it for free, much in the same way they do with other pieces of software / music / movies. Now I'm not saying that I'm a morally upright citizen, but I do plan on buying atleast the personal edition simply because I want to support this effort.

I use gpg on my linux machines and pgp freeware (yes, I know, I didn't buy the version before -- but with security products, I want the source) on windows.

Re:I can buy it but ....

[Rick the Red]

I didn't see any instructions on how to compile it (then again, I didn't download it, so maybe the instructions are included). I doubt you can compile it with gcc; if it requires Microsoft's Visual Studio it would be cheaper to just buy PGP!

So, any idea if/when we'll see a *nix version, with source code the customer can compile on Linux, *BSD, Solaris, HP-UX, AIX, etc. etc.?

Re:I can buy it but ....

[Rick the Red]

I've seen Moderators On Crack before, but whoever gave this a "+1 Informative" is just sick.

Re:I can buy it but ....

[McVeigh]

well if you goto the pgp page you'll find the FREE version (it's crippled though).

I'd post the link but it's slashdotted :(

Re:I can buy it but ....

[Gemini]

All versions of PGP are the same (binary). They use the same sort of model as a lot of shareware - if you buy a licence, it "unlocks" some new features for you. Handy for the user, makes testing easier, etc.

Re:I can buy it but ....

[mmol_6453]

While I applaud your distinction between peer review and open source, I have to ask: How do we know that a binary we're given, and some source code we're given, amount to the same product?

Take "main(){printf("Hello!\n")}" and "main(){printf("%s","Hello!\n")}"

While functionally identical, gcc will compile them into two very different binaries.

In short, there's no way to verify that the source code and the program are the same. Even if the two programs appear to respond to every interaction in the same manner, there's no way to know that there isn't a back door in the pre-compiled version.

And we're prohibited from using the provided source code for anything but verifying a lack of flaws. Legally, we can't buy the program and compile the accomanied source for personal use.

I'm not saying "Don't trust PGP." I'm just pointing out a flaw in their peer-review logic. If they allowed you to use the compiled source for personal use, then all would be well. (Aside from moral compunctions, of course.)

Re:I can buy it but ....

[ergo98]

I would back it up by pointing to the site, however right now it appears to be completely slashdotted. As such I'll have to say this without reference, but I'm pretty sure that the source code disclaimer list specifically mentions that it can be used to compile into a binary to compare with the binary that they give to ensure that there are no back doors, etc. If it's like prior versions, they'll give a specific list of versions of software (i.e. Visual Studio version XYZ) to compile it with, and truly the result will be a perfect clone of the distribution binary.

Re:I can buy it but ....

[Anonymous Coward]

Now -that's- some serious paranoia. How do you know the compiler you're using doesnt add some backdoors to your exe? Did you read through all the code of your compiler and then compile your compiler itself? Or maybe you wrote your own compiler? What if someone swapped out the compiler on your computer with a trojan'd version while you were on lunch-break!? Snakes! Snakes! All over me!

Re:I can buy it but ....

[Demonspawn]

Laugh if you want, but that actually happened (or I'm remembering some urban legand). Story goes that a certian someone added code a a login utility (Unix, Linux? I don't remember all the details unfortuantly) so that he could log into a machine with root privlages even if he didn't have an account on the machine. He then modified the compiler to recognize if it was compiling the login program to automatically re-inject the code into the program. He then also modified the compiler to recoginize if it was compiling the compiler and again re-inject the malacious code.

One hell of a hack job. I'd give a link, but a quick google of what I remember isn't turning up anything. Anyone else who remembers this throw a link (or prove this an urban legand)? I think it was some distro of Linux but I'm not 100% sure.

--Demonspawn

Re:I can buy it but ....

[Tassach]

In short, there's no way to verify that the source code and the program are the same.

Nonesense. You download the source and compile it in a build enviornment that matches the one used to produce the official executable.

If the MD5 and SHA1 checksums of the code you compiled locally matches those of the distributed version, you have a very high degree of confidance that the distributed executable was indeed compiled from the published source code. If they don't match, tampering is a possibility.

In order to do this successfully, you need two things that seem to be lacking in this case: the makefile used to compile the official executable, and all the pertinent details about the build enviornment (compiler version, versions of statically-linked libraries, and so forth). If you can't exactly duplicate the build enviornment, it's probable that there will be differences in the executable code even if it was compiled from the same source code.

Re:I can buy it but ....

[HP LoveJet]

The story is absolutely true, and the perpetrator was Ken Thompson, co-creator of Unix. You can read all about it here.

Re:I can buy it but ....

[J. Random Software]

The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.)

Ken Thompson, Reflections on Trusting Trust, 1984.

Re:I can buy it but ....

[Anonymous Coward]

If the MD5 and SHA1 checksums of the code you compiled locally matches those of the distributed version,

Cough, cough, nitpick. Er, if you have both binaries why not just diff them?

Re:I can buy it but ....

[ergo98]

As an additional piece of information related to my prior response, I can now get at the license agreement which includes the following tidbit under "What You Can Do":

compile the source code for each PGP software program into an executable code version of the program;

Re:I can buy it but ....

[Anonymous Coward]

erm - i'm not sure you can diff binaries - i think you want 'cmp' for that

Re:I can buy it but ....

[Anonymous Coward]

What the hell are you guys talking about?

Don't compile it and compare the binaries, compile it, then encrypt a message with both and compare the encrypted text. If they are identical, the precompiled version didn't encrypt to some government/pgp owned key...
Also, don't binaries include time/date of compilation or other things that would alter the checksums?

Re:I can buy it but ....

[ergo98]

I think the concern more is "how do you know it isn't sending a copy of your private key to some malicious organization" (well...to any organization), or "does it have a keystroke logger". Because PGP is a security application, naturally a lot of its uses will be where the data is highly valuable (unfortunately, really. PGP and its ilk should be used even for the mundane).

Having said that I downloaded the source code and they indeed provide a list of the exact environment options to compile it (see readme.pdf right in the root of the source tree), namely Visual Studio 6.0 SP 5 with Visual C++, the Platform SDK, the NT 4.0, 98, and 2000 DDK. With these tools one should be able to compile an exact replica of theirs (btw: No there isn't any session or time dependent data, and two binary compiled on the same platform should indeed lead to the exact output). I gave it a shot but unfortunately VS.NET would give entirely different binaries anyways, but ignoring that there are some elements of the code that break in the more C++ conformant Visual C++ 7.

Re:I can buy it but ....

[uberdood]

I wish I had a mod point for you. Crippled is certainly correct. With lack of integration into Windows, the freeware version is useless, unless someone can come up with a reason to not use 6.58...

Re:I can buy it but ....

[Anonymous Coward]

Huh?

If your output is the same for every input you try (both encryption and decryption) with both binaries, who cares if the binaries are not the same?

Re:I can buy it but ....

[Anonymous Coward]

Sending the plain-text of your message to a 3rd party? Keystroke logger?

Re:I can buy it but ....

[shaitand]

The customer CANNOT compile it or they will be violating the license agreement, for *nix or anything else. The code is only provided so that government and military will be more willing to use it. And so that users can submit bug fixes.

Re:I can buy it but ....

[TheLink]

Actually, I've tried compiling PGP 6.5.x on Windows before, using Visual Studio. I did it more than once and the binaries were different each time - not just timestamp different. Significantly different.

I asked people in the newsgroups about it and someone said that the compilers optimize randomly. If that really was true I'm not surprised windows programs have bugs . You don't even get to see and specify the seed used for a compile. I seem to recall John Carmack making a related grumble about compiles on different machines - same source code, one worked and one didn't.

With GCC, repeated compiles = same binary. Just the way a security person would like it.

Re:I can buy it but ....

[Arkham]

Wrong!

Read the license agreement before making such assumptions. They let you compile it. You just can't use the binary you compiled for everyday use.

1. What You Can Do. Under this license, you have the right to:

1. download the PGP source code files and make a reasonable number of copies on a single computer as necessary to exercise the rights granted below;
2. review the source code in these source code files in order to verify that there are no unknown vulnerabilities or the like and in order to make your own assessment of the security features of PGP software;
3. compile the source code for each PGP software program into an executable code version of the program;
4. run the executable code version on one computer solely in order to assist in your testing and cryptographic analysis of the security features of the PGP software; and
5. modify the source code in the course of exercising the rights granted above.

Re:I can buy it but ....

[ergo98]

Actually, I've tried compiling PGP 6.5.x on Windows before, using Visual Studio. I did it more than once and the binaries were different each time - not just timestamp different. Significantly different.

I'm not sure what environment settings you had, however I have done the same and the resulting binary is exactly the same each and every time. The binary does change if any of the configuration options are modified at all, of course, or if different versions of libraries are used, etc.

I asked people in the newsgroups about it and someone said that the compilers optimize randomly.

That person is an idiot. The compiler optimization in Visual Studio isn't random whatsoever (as a sidenote it's one of the best optimizers around), and even the premise of that is absurd.

I seem to recall John Carmack making a related grumble about compiles on different machines - same source code, one worked and one didn't.

99% of the time that people complain about computers doing random things, and everything being "the same" (or the classic "I didn't change anything!") it turns out to be some idiotic human error. If a compile turned out different code on a different machine then John had different libraries (which includes the dev. environment libraries, or the platform SDK libraries), or different compile options, or entirely possibly bogus hardware. It was not all the same and one compiler just randomly decided that it'd produce bogus code.

Re:I can buy it but ....

[DJSpray]

Well, being allowed to compile it and able to compile it are too different things.

I've running Jaguar (MacOS X 10.2) with the version of the developer tools (freshly installed compiler, etc.) that they recommend.

I can't get it to build. Endless header file-referencing problems.

They explicitly do NOT provide technical help getting it to build, too.

My suspicion is just that the instructions are incorrect or incomplete and there are some dependencies out-of-order.

Anyone gotten it to build?

There may be strings...

[Cyclometh]

on publishing vulnerabilities or bugs, but at least they're making it possible, as long as you let them know, etc. Some of the more radical "full-disclosure at any cost instantly" types will rankle at this, but I think most will look at as it is- the company that has to maintain the software covering their butts as well as they can.

It could have just said "you're not allowed to publish any problems you find, period."

Re:There may be strings...

[John_Renne]

I guess this is completely true. The 30-day limit is a fair one I believe. This will provide the PGP-foundation with enough time to solve an exploit before script-kiddies get their hands on it

If I'm correct it's also a time-period a lot of bug-hunters out there usualy give a company to work out a solution. Releasing exploit-code the same minute isn't in anyones favour.

Re:There may be strings...

[Rick the Red]

I agree. For a company that's marketing proprietary code (and as much as you may support Open or Free software, only RMS would claim there's something morally wrong with selling proprietary software), they are being very open and above-board about this.

It's only reasonable for them to require 30 days to fix any bugs you might find, lest their customer's secrets be compromised in the meantime. Would you buy PGP if you knew any loopholes would be revealed before they could be closed, potentially exposing the secrets you're buying it to protect?

I wish Mr. Zimmerman success.

Re:There may be strings...

[J. Random Software]

"At least 30 days after PGP sends its email acknowledgement" is a bit worrying, since they haven't committed to ever acknowledge reports of weaknesses that aren't "serious". I have great respect for Zimmerman, but any corporation is required to act in the interests of its shareholders....

Turnaround Time

[Steve B]

You agree that you will not post any information about any bug, problem, deficiency, or weakness in the PGP software on any web site or electronic bulletin board, or otherwise disclose or provide any such information to anyone else, unless you have first reported it to PGP and until at least 30 days after PGP sends its email acknowledgement to you.

I'd be more comfortable with this if there was an absolute cap that did not depend on the acknowledgement. As written, it would seem to allow PGP to freeze the clock indefinitely by simply not responding.

Re:Turnaround Time

[Cyclometh]

It's a good point, but they know as well as anyone that an unacknowldeged problem becomes an embarrassing public one when the problem is posted anonymously, which is what would happen if they "froze the clock" in the manner you speak of.

I'm willing to extend them the benefit of the doubt on this one... they'd be hurt more than most of the software producers by having a security bug go unacknowledged/unpatched. It's not like a license agreement is going to stop the spread of any vulnerability info at any rate.

Re:Turnaround Time

[Anonymous Coward]

Also makes damn sure they got the message you sent them. It becomes your duty to prove they sent a reply rather then thiers to prove that they didn't get the message outlining the bug you submitted.

I really doubt thier intention with this is to "stop time" but rather simply offer no one an excuse out of it. "I sent you an email 31 days ago didn't ya get it?" will not cut it.

Re:Turnaround Time

[dillon_rinker]

allow PGP to freeze the clock indefinitely by simply not responding
Precisely. And what happens if they go out of business? This is one of the key things that many otherwise well-intentioned source code license agreements fail to recognize: the software may outlast the the company that created it. It would likely be problematic even if some other corporation bought the PGP vendor. It is not uncommon for someone to buy the ASSETS of an insolvent corporation, but the obligation to respond to queries about source code could would logically be considered a LIABILITY.

Anyway, I think they had good intentions with this clause but they've paid too much attention to their lawyers. Perhaps, if the clause as written turns out to be a problem, (good) hackers could merely post "I have some interesting information about the product, but I am legally prevented from disclosing it by Section X, Paragraph Y of the source code licensing agreement. Please encourage the PGP vendor to acknowledge my emails"

Re:Turnaround Time

[dillon_rinker]

So if it's not their intention to stop time, why'd they write it into the agreement? Would you sign an agreement that allowed the other party to take possession of your house at any time and sell it? "Oh, we don't really intend to do that." OK, so why are you asking for it? And even if I trust you, if you get bought by someone else, guess what? THEY can sell my house.

I'm willing to believe that intentions are pure in this case, but the agreement needs to be edited slightly.

Re:Turnaround Time

[Steve B]

I really doubt thier intention with this is to "stop time" but rather simply offer no one an excuse out of it. "I sent you an email 31 days ago didn't ya get it?" will not cut it.

Fair enough -- if they don't respond in a reasonably timely manner, the license can't prevent that fact from getting out.

Re:Turnaround Time

[javatips]

You can actually BCC yourself.

That way, you can prove that you sent the message at some point in time (you have the header added by the SMTP server).

This can protect you to some extent. It would probably be better if you use a third party SMTP server to do it.

Note that will only prove that you sent the message, not that they received it.

Re:Turnaround Time

[Deagol]

Or better yet, use a timestamp server.

Re:Turnaround Time

[Kashif Shaikh]

Well if they put an absolute cap on, then the matter becomes if you "did" or "did not" officially report it to PGP Corp according to them.

Meaning if you disclose a problem with PGP to the public after 60 days filing a report with no response from PGP Corp, they could give the excuse: "Our internal records show we did not recieve a report from you indicating the problem you now publically disclosed. Therefore the 60-day cap does not apply to you."

Next thing you know you get legal mail from PGP Corp. that you're being sued for millions of dollars for failure to abide by their agreement. And this is by no means exaggeration; companies love to give law-suits left, right and centre these days.

Re:Turnaround Time

[damiam]

If PGP went out of business, there would be no one to enforce the license agreement.

Re:Turnaround Time

[larry bagina]

after all, we all know how hard it is to fake an email header.

Re:Turnaround Time

[charon_on_acheron]

If they don't acknowledge your message within a day, resend it to them. Do so for a week's time. If still no acknowlegement, let them know if they don't respond, you will make sure your 'research partner' at BugTrak is aware of the existance of a bug/weakness, unless they reply to you. This way, you are not disclosing any information to anyone, but are only threatening to do so. They will certainly respond to you for that. But you still are not 'disclosing' the info, you are simply working on the project with another person, since two heads are better than one.

That being said, why on Earth would they pull a such a stupid stunt as "freezing the clock" by not acknowledging your message? They know as well as anyone how much flak Microsoft, Borland, etc, get when they try to pull that stunt. And since integrity and trust are essential to their existence, they will be ethical about it, if only out of self-preservation.

Re:Turnaround Time

[drinkypoo]

Precisely. And what happens if they go out of business?

I don't know if they're a corporation, but if they are then they will never go away. The corporation (And its assets and IP) will stay around forever and someone can then later purchase their assets (which will be only IP by then, and their name) and assume their liabilities.

Re:Turnaround Time

[cookiepus]

." OK, so why are you asking for it? And even if I trust you, if you get bought by someone else, guess what? THEY can sell my house.

Jesus, just don't download the source if it stresses you SO badly.

Re:Turnaround Time

[J. Random Software]

It's common to buy a bankrupt company's assets without acquiring the company as a whole and assuming their obligations. The buyer can issue new licenses to new customers, while the existing licensees are on their own--they have a contract with a corporation that's no longer doing business (though I'm not exactly sure how dissolution works).

Re:Turnaround Time

[Anonymous Coward]

"I'd be more comfortable with "

Yadayadayada. That's nice. Who cares? Start your own company, write world leading software, fight the government for the right to use/distribute it, THEN come back here with your list of demands! If you don't like it, download something else - you don't have a right to anything you want, for christs sake.

Whiny little maggot.

Re:Turnaround Time

[evilviper]

And what happens if they go out of business? This is one of the key things that many otherwise well-intentioned source code license agreements fail to recognize: the software may outlast the the company that created it.

The truth is, no company gives a damn what happens after they go out of business. They will make a license that works best for them while they are in business, and if they do go out of business, why should they care what happens?

Re:Turnaround Time

[J. Random Software]

This problem, the market ought to be able to solve. We should care enough about what happens that we'll reject the license until they find some way not to leave us SOL.

Re:Turnaround Time

[Simon Garlick]

So wait your 30 days, then post details of the bug/exploit/hole/whatever to Usenet anonymously. No big deal.

Differences from previous releases?

[masonbrown]

OK, as a corporate user with a Win2k machine using Outlook, is there any significant reason to upgrade to 8.0 from whatever I'm using now and have used for a year or so? I know the article says there aren't significant changes, but I'd be interested in what specifically is better / improved.

Re:Differences from previous releases?

[ergo98]

The fact that PGP doesn't work in general in Office XP should be a pretty big bonus (actually I think it even had problems with Office 2000).

Re:Differences from previous releases?

[Anonymous Coward]

since your running win2k i wouldnt bother upgrading. if you do feel the need to have a secure system just unplug the windows box

Re:Differences from previous releases?

[dzym]

I'd like to see PGP/MIME support for signatures, which shouldn't even be all that hard.

Unfortunately, they seem to have decided it's an Outlook issue rather than something they can implement.

Re:Differences from previous releases?

[rosewood]

How does it not or is it supposed to work? I can quickly encrypt .doc files but not inside word. Didnt know I was supposed to be able to. I can do clipboard encryption and since I can copy a whole word doc to the clipboard, then its not so bad I guess?

Re:Differences from previous releases?

[ergo98]

Sorry it's specifically the integration in Outlook that is the problem: With Office XP, and I'm pretty sure Office 2000, the toolbar integration is broken and one had to resort to a special set of configuration options to use PGP (for instance "decrypt on opening", as the manual option was no longer available).

Re:Differences from previous releases?

[Anonymous Coward]

depends - what version are you running now?

there is an adk (additional decryption key) insertion vulnerability in version 6.5.3 and earlier

Re:Differences from previous releases?

[Skorpion]

It better supports some aspects of the standard - like signatures made by subkeys.

Broken?

[Adam.Steinbaugh]

Has PGP *ever* been broken, hacked? Could it now that the source code has been released?

Re:Broken?

[Wesley Felter]

Bugs have been found in previous versions of PGP. Hopefully the source code release will allow the bugs in PGP 8.0 to be found sooner rather than later.

Re:Broken?

[Bishop]

Yes. An easy to find example. I believe there was a weakness way back in the early 2.1 - 2.3 versions as well. PGP (USA version) was probably also vulnerable due to some of the RSAref.lib bugs. Source for PGP up to 5i is available.

PGP has been shown to be good secure code. Makeing the source available won't lessen the security. That is the point: peer review will strengthen the code. Phil Zimmerman knows what he is doing.

Re:Broken?

[Kashif Shaikh]

Not to sound ignorant, but I once heard that PGP was too good and because of this the "powers that be" decided some "back doors" should be added to the PGP algorithm. This way it would be easy for the gov't to break the encryption and limit "strong information" from being transmitted. IANACE(I am not a crypto expert), but is what I heard true, or am I just babbling?

Re:Broken?

[Bishop]

There are no backdoors in PGP.

don't order it this morning...

[SweetAndSourJesus]

I plunked down my cash first thing this morning.

It looks like they're pretty swamped. The download failed, and, after the third try told me that the link had expired.

We are sorry that we are unable to complete your download at this time. This download link expires three weeks from purchase and after three downloads.

I guess this means I've got to call their customer service deptartment today. So, you may want to wait a bit before buying. The beta I've got for OS X doesn't expire until 12/06/2002, so I'm not totally screwed yet.

Re:don't order it this morning...

[notestein]

Yes, they've been /.ed

I had the same experience you did.

I talked to a support person. They reset my 'you can only download from this link 3 times' switch and told me to wait for an email. The email will let me know it's possible to download.

Talk about asynchronous message driven load balancing...

Well, we all know security isn't supposed to be easy.

GPG?

[Anonymous Coward]

How well does PGP 8 compare to GPG (or vice versa).

I know GPG cant do some forms of encryption/de-encryption because of copyright schemes, but if this has the source being released maybe we will see some more competition between GPG and PGP, or is the license for PGP too restrictive?

Re:GPG?

[entrylevel]

Competition by looking at your "competitor's" code and using what you've learned in your own product? I think the term you are looking for is "cooperation".

Re:GPG?

[Anonymous Coward]

You may be thinking of RSA and IDEA. RSA is perfectly OK, the patent has expired. IDEA is still patented, but it's ok because a) you can get IDEA plugins for GPG and b) no one uses IDEA anymore anyway, it's a relic from the PGP 2 days.

PGP must be good encryption.

[Kenja]

PGP must be good encryption. I've been trying to brute force decrypt the phrase "zimmermann" and I've had no luck at all so far.

Re:PGP must be good encryption.

[angst_ridden_hipster]

It decrypts literally to "room man," but means "carpenter."

But wait!

[Anonymous Coward]

Shouldn't PGP be labeled as evil, since it isn't open source?

One thing I've noticed:

[Sheetrock]

It's cool for a hacker (good connotation intended) like Phil Zimmerman to publish something that goes against the grain. On the other hand, it's not cool for a hacker (good connotation still intended) like those that frequent Bugtraq to publish something that goes against the grain (making public a security flaw without the express permission of PGP Corporation).

Managing disclosures of security flaws may be a good thing if you intend to fix them, but their policy doesn't mention what happens if they decide to sit on the problem instead.

Re:One thing I've noticed:

[Junta]

The implication seems to be they just want a 30 day grace period. Does not seem to be unreasonable to me. After the 30 day grace period I guess it is open season. The only part that bothers me is that the terms seem to indicate that the 30 day period starts from their acknowledgement that you submitting a flaw, not from the time of acknowledgement. If they chose to not acknowledge responses in a timely manner, that could be a problematic loophole.

Re:One thing I've noticed:

[TeddyR]

My question is:

Does it preclude the person from saying "I found a flaw in PGP" without saying what the flaw is. [maybe even only saying THAT 30 days after sending the initial message to PGP corp informing them of the details of the flaw]...

This may put a little pressure on PGP corp to fix the flaw.... And alert others that there may be a flaw that can be found with a little digging on their own so that they can also inform PGP corp thus adding more pressure....

Re:One thing I've noticed:

[Sheetrock]

That was kind of my point. If you send them an e-mail or two and get absolutely nothing back, you can't publish -- therefore, you're subject to their whims.

This provision renders dubious the actual security benefits gained from open examination of the source code, and I'll explain why:

If the corporation is on the top of its game and follows up on each and every report, sending an acknowledgement whether or not they actually decide to fix the flaw, we'll have a situation not unlike GPG or other open source projects. Anyone who agrees to a set of restrictions can examine the code and point out flaws in addition to offering fixes.

On the other hand, if they fail to acknowledge some of the issues being submitted to them, then the situation may actually be worse than not having the source code available at all. People with less-than-pure interests can find the flaws in the program much more easily, however those who actually want to help the community (perhaps making a name for themselves as well in the process) can neither disclose the vulnerability nor offer a patch.

No doubt this policy has been introduced as an attempt to encourage bugfinders to use more community-friendly methods of disclosure. My only problem with it as a potential customer would be that it fails to take into account the possibility that the company could be less than perfect with dealing with bug reports... and thirty days of operating a product of this nature with a known flaw is bad enough. Isn't RFP's policy fair?

Pay for PGP?

[failrate]

Sure, why not? Especially in an enterprise solution, where the PGP Corporation can personalize the software for each customer.

Open source != Open source, though?

While a lot of OSSes are going to get their panties in a bunch, note that it is still possible to study the code and write new code based on the *concepts* that you learned about encryption. I don't know how to write encryption, but if I were to learn, I'd love to study robust professional code for free.

RedHat too

[masonbrown]

Check out RedHat. You can download everything for free, even in ISO image format. Or you can go to Fry's and plunk down $50 for the exact same thing. This business model actually works. Not everyone wants to go get a compiler and compile the source from scratch.

Re:RedHat too

[Remik]

Not exactly.

The product at Fry's comes with support and documentation that is otherwise not included. It may be a highprice to pay for information which is otherwise available all over the net, but for some it is simply a matter of convenience.

-R

Re:RedHat too

[dillon_rinker]

A high price to pay? OK...start by putting a price on your time. Print the information that's otherwise available on the net. Now cut those pages to size and bind them together. The books that come with the $50 retail package are starting to look pretty inexpensive. =)

Re:RedHat too

[larry bagina]

This business model actually works.

No, this business model actually causes a negative cashflow

Re:RedHat too

[Anonymous Coward]

Just the cost of the paper and toner/ink justifies the $50.00 books....

PGP is overrated

[Hairy_Potter]

so is GPG. If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls. Uncrackable files don't mean much when traffic analysis shows email to the Cali cartel and cyber-cafe's in Pakistan.

But, just like the NRA sorts, who cling to the illusion that their pre-ban AR-15 will protect them against the black helicopters, PGP users delude themselves into thinking they're making a heroic stand for freedom, when in reality, no one cares about their encrypted plans to sleep in line for the Two Towers premiere.

Re:PGP is overrated

[SweetAndSourJesus]

I can't remember where I read this analogy, but I'm pretty sure Zim came up with it:

You use envelopes, right? Why? Becuase you don't want everyone in the post office reading your mail. If you didn't care, you'd use postcards. Sure, the envelope isn't bulletproof, but it's enough to keep the casual snooper out. Same deal with PGP.

You're right, if the Man wants to read your email, he's going to do it. PGP isn't designed to be a totally secure system, just a mostly secure one.

Re:PGP is overrated

[WanderingGhost]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls. Uncrackable files don't mean much when traffic analysis shows email to the Cali cartel and cyber-cafe's in Pakistan.

And that's great. They'll get the terrorists they want, and nobody will know what I've been discussing with my fiancée, or with my friends, or whoever. And they'll not know what my company has been discussing with some other business out there. (Commercial secrets are still secrets)

Doesn't sount too bad after all.

You can still get evidence to take a criminal to court -- and that's good. But people won't read yout e-mails and know what you've been discussing (they won't know too much about your private life).

Not that tere aren't other problems, of couse, but then, there is always a problem... :-)

Re:PGP is overrated

[Anonymous Coward]

You're right, as far as it goes. And don't forget the effectiveness of brute-force "rubber hose" cryptography!

However, in situations where the information is not so important that the gubmint sends in the Tempest vans, strong cryptography is still useful. Protecting trade secrets from competitors, for example. Based on the number of laptops stolen every year, this may be a very important use for strong cryptography. And, it still will protect you against the casual governmental snooping implied by "Total Information Awareness". Until they start arresting anyone using cryptography, that is.

Re:PGP is overrated

[Anonymous Coward]

1.) Yes the government COULD! But even their resources are not infinite (can only watch so many at one time)

2.)In a practical sense I am I think more concerned / annoyed by commercial interests and casual snoopers. PGP, GPG, and sometimes ROT13 are
more than adequate to discourage THEM!

Re:PGP is overrated

[sharkey]

they'll surround you with Tempest vans

Tempest vans? Are they anything like Super Vans?

Re:PGP is overrated

[Jonny Ringo]

I can open an envelope - no prob.
But I can't crack PGP.
plus envlopes keeps multiple items niceley together.
Close but bad analogy.

Re:PGP is overrated

[Anonymous Coward]

Depends on what you do. I have personal experience within the last 24 hours of PGP's usefulness. A good friend of mine is now under house arrest in the People's Republic of China. They monitor his phone calls, but thank god he's still got internet access & PGP.

Re:PGP is overrated

[SweetAndSourJesus]

Yes, you can crack PGP. It's completely unsafe to presume that it can't be done. You can't open an envelope without tampering with it, which is where PGP signatures come in.

I guess if you want to look at the utility aspects, PGP isn't designed to keep multiple items together, that's why we have tar.

Even if it is a bad analogy, isn't this a more reasonable viewpoint than the "fuck it, Uncle Sam's got us by the nuts, I give up" attitude espoused in the original post?

Re:PGP is overrated

[RealAlaskan]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls. ....

So, given that's true, why bother encrypting anything? Answer: if a lot of innocent traffic is encrypted, it significantly raises the effort level required to identify the non-innocent traffic, and thus makes it much less likely that the government WILL decide that it ``really wants to get you''.

Is that a good idea? Even after the events of the last year, government in general still seems to have the resources to be a greater threat to us than all the Islamic malcontents in the the world put together. Some of those governments definitely have the will to do us harm; after all, some of them are run by those same Islamic malcontents. Some of us are living under the power of those evil governments. PGP and its successors have been used by human rights groups operating in countries like Yugoslavia, to keep records secret.

Don't forget, also, that while a despot might tire of amusing himself by persecuting you, the bureaucrats who persecute decent folks in the western world are doing it for our own good, and their self-image as good people and hard workers depends on putting Dimitry in jail, or busting down the doors of prople who have violated a contract with their cable company by uncapping a modem, or what-not. The people who are probably the greatest threat to us in the US and Europe are these well-intentioned, honest, hardworking idiots, who honestly believe that they are protecting us all. Sometimes they ARE protecting us all, and sometimes they are doing quite the opposite, but they are always trying to earn their pay by doing their job, no matter how destructive that may be.

Overall, I think it is an excellent idea to make it as difficult as possible for the government to keep tabs on us, or to single us out, even when our government is NOT deliberately evil, as is the case in the US.

... PGP users delude themselves into thinking they're making a heroic stand for freedom, when in reality, no one cares about their encrypted plans to sleep in line for the Two Towers premiere.

It isn't just governments that have secrets. Most companies have marketing plans, customer lists, and so on that their competition would give big bucks to get. If only the sensitive email is sent encrypted, it's obvious which messages need to be cracked. It's also obvious when there is a flurry of sensitive activity. If you also encrypt your non-sensitive email at work, that eliminates that sort of problem.

Finally, personal, frivolous users of encryption ARE helping folks who have a serious need for it, at least indirectly. See my first paragraph. If they are deluded, well, that's good for the rest of us. We can't afford to have things reach the point that using PGP makes you a suspect. The world is full of folks who are eager to do bad things to good people, some of them with the very best of intentions for the very people they'd harm.

Re:PGP is overrated

[Jonny Ringo]

I never said it couldn't be done. I just said "I" couldn't crack PGP, but I can open an envelope. I beleave the majority of people are about like me when it comes to that situation. :-) I agree with you that it does keep things together which is nice as well.

Its a close analogy, maybe not entirely bad. And yes I do agree with you about the other post. Why would I worry about the gov listening to my phone converstations when all of the communciation I want kept private are done encrypted on the net. Its possible for a slip up, but I think it can be done.

Re:PGP is overrated

[Anne_Nonymous]

>> You use envelopes, right? Why? Becuase you don't want everyone in the post office reading your mail.

Actually, my Mom uses an envelope because it holds in all the irrelevant newspaper clippings she sends me each week. Arrrrg....

Re:PGP is overrated

[Anonymous Coward]

PGP isn't designed to be a totally secure system, just a mostly secure one.

One might even say a Pretty Good one.

Re:PGP is overrated

[dsplat]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls.

True enough. However, I don't want to publish my travel plans to too many people via unencrypted e-mail every time I send my family the flight number I'm coming in on. I've had my home burglerized once. I don't think anyone who has had that experience wants to go through it again.

PGP and GPG also provide signatures. In the semi-anonymous world of the web and open source, there's a lot to be said for signing your source code.

Re:PGP is overrated

[evilseabass]

....but PGP DOES protect you against Tempest attacks! It has a feature called Secure Viewer, which surpresses the electromagnetic emissions from your monitor by dimming the text within the window in which you are typing.

Re:PGP is overrated

[UID30]

You're right, if the Man wants to read your email, he's going to do it. PGP isn't designed to be a totally secure system, just a mostly secure one.

Preach on, brotha SweetAndSourJesus! If you wish to be completely private, i suggest you no longer use the internet, computers, telephones, or cable tv. The software is named Pretty Good Privacy for god's sake.

Re:PGP is overrated

[Anonymous Coward]

And in the treacherous world of the DMCA and patents, there's a lot to be said for signing and publishing your code under a pseudonym. Zimmermann was in danger of prison because his truename was on PGP, even though Goen actually posted it to Usenet (with Distribution: us, no less).

Re:PGP is overrated

[4of12]

They'll get the terrorists they want, and nobody will know what I've been discussing

Yeah, except that these days they'll profile you into the same category as those sending email to the Cali cartel and to Pakistani ISPs just because you're bothering to use PGP.

Feds: "Better look into this guy concealing traffic with PGP encryption! He's hiding something!"
.
.
(later)
.
Feds: "It's OK! After we installed our Scarfo-nabbing keyboard logger on his PC and glommed onto his passphrase we found out he was just describing an over-bed trapeze with his GF."

Islamic extremists will have effectively won their biggest victory when they get the U.S. to abandon precious rights and liberties for a society as repressive as anything the Taliban could dream up.

Re:PGP is overrated

[kalidasa]

It's called "Pretty Good Privacy" for a reason. It's not perfect, but it's good enough for most purposes.

Re:PGP is overrated

[Master of Transhuman]

Your AR-15 will protect you from black helicopters if you shoot the pilots before they get on the chopper...

'Course, you've got to find the pilots first...

Re:PGP is overrated

[Anonymous Coward]

I agree, but I'll go one step more.

If the government really wants to get you, they'll just take you. The van will put up to your house and take you to their room with the lights on 24 hours a day, and eventually they'll get everything they want from you.

Re:PGP is overrated

[LWATCDR]

Who cares about the man??? I do nothing that they would care about anyway.
What I do care about is that the owner of the company I work for let someone get the password for his email box. Someone has been reading his email. So on goes PGP and I just hope he does not give that password to someone.

Re:PGP is overrated

[Anonymous Coward]

"If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls"

That was exactly Phil's point. They've gotta do a lot more work that way.

Re:PGP is overrated

[Anonymous Coward]

I'm not anonymous, just can't remember my password ;)

An piece of mail inside an envelope may only be opened by the receipient, unless there is a judge approved search warrant. Why? Because of the *expectation of privacy*. Standard email is just like a postcard, with zero expectation of privacy. A very good lawyer could argue that encrypted email has that expectation of privacy, and may only be opened by the receipient. A law enforcement person would need a judge approved warrant to decrypt.

Ted

Re:PGP is overrated

[Chandon Seldon]

The AR-15 isn't to protect against the helicopters, it's to protect against the MiB's. For the helicopters, you need a 50 caliber machine gun with APIN rounds.

Re:PGP is overrated

[Anonymous Coward]

"email to the Cali cartel and cyber-cafe's in Pakistan."

So don't use email - post on SlashDot in stories where the first letter of the headline is a P, and make sure the subject line you use is "Feed me". Make the post relevant to the story, and make your sig file the information you want to pass on - encoded if you like. Try tracing that!

Re:PGP is overrated

[ergo98]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls.

About 99.999% of the people using PGP have no concern about their government watching them (though there should be some concern there as working in law enforcement is a job, not a moral position. What I mean by that is that there's absolutely zero guarantee that there isn't vindictive criminals with jobs in the intelligence/law enforcement community who would use casual snooping to destroy someone who they felt cult them off in traffic, or is dating their former girlfriend, or has a nice house they'd like to break into), but rather is concerned about their PC being stolen and all of their emails being read or redistributed (a very real possibility), or coworkers snooping into their emails (who nominated the email administrator the keeper of all secrets?), or corporate espionage, or that cable modem installer guy from doing some spelunking while doing his install, etc.

I use the club on my car and I laugh whenever someone offers up some witty comment about the club. It is, they proclaim, of no use against professional thieves as they saw on he latest episode of 20/20. The reality, of course, is that professional thieves are by far the minority of car thieves, but instead it's absolutely effective in stopping joy riders, or bottom barrel criminals looking for a quick lift to help them rob a variety store. I've come to realize that people critique measures like this (as they do with home security, personal security, etc) because they're lazy, but they see it as a zero-sum "game" : If MY car is secure, then it's that much more possible that THEIR car will be broken into. If my house is heavily fortified, then it's that much more possible that their house will be busted into. I've noticed this sort of "pull the lobster back in the bucket" mentality frequently, and I believe it's the same thing when people express outrage that others are protecting their privacy: They see this as a weakening of their own privacy. It reminds me of a joke about not having to outrun a bear, just making sure that you can run faster than at least one of the people you're with.

Alas I'm digressing.

Re:PGP is overrated

[Anonymous Coward]

You can achieve complete privacy if you're so inclined using GnuPG (PGP, etc) along with anonymous remailers. This is the method:

1. Sender encrypts and signs message for decryption and verification via recipient's private key.

2. Encrypted message is sent through a chain of mixmaster remailers (the number of remailers in the chain should be at least 2, but a longer chain is obviously possible). Quicksilver is one e-mail client that can handle public remailers very well. Each remailer strips information about the previous node in the chain, and re-encrypts the message before it is sent to the next node. None of the remailers know who the original sender is, not even the first node, since as far as it is concerned, the previous node is also a remailer. None of the remailers except the last one know the e-mail address of the final recipient, since that information has been encrypted along the chain until the final node.

3. Final node decrypts message from second-to-final node and sends the message to the recipient. Remember, the message is still encrypted at this point and can only be viewed by the recipient and the original sender.

Even if the connection is tapped between the final node and the recipient, there is no way to know the identity of original sender, nor is there any way to know what the content of the message is. If the message was signed by the sender, then the recipient can verify the sender's identity, something only the recipient and the sender can do. Nobody else will be able to find the identity of the sender, nor see the message.

That's as private and secure as it's going to get.

Yeah, it's pretty good.

[Anonymous Coward]

Thank you. I'll be here all week. Remember to tip your waiting staff.

GOATSE link

[Anonymous Coward]

Do not click

Java

[Yoda2]

I sure hope the pending SDK has support for the latest version of Java. I have yet to get the latest version of Cryptix OpenPGP to work with the J2SE v 1.4.1.

Re:Java

[CynicTheHedgehog]

I ended up resorting to doing Runtime.exec( ) on gpg with all the batch and automatic "yes" flags enabled. Works pretty good, but the feedback is a little crummy (0 on success, != 0 on failure).

Re:Java

[Gemini]

Use --status-fd. It was added for just this situation. GnuPG will spit out a set of standard status tags as it works.

The source has been available

[ergo98]

The source code to PGP has been available for a long time from pgpi.com. Indeed, there is the freeware copy (it actually links you back to the main PGP page) of PGP 8.0 available there.

So it's just for Windows and Mac?

[Wee]

All I see are Windows and Mac versions on their download page. That's, um, mostly useless to a lot of folks (as in the kind of folks into crypto who are more likely to be running Linux or Solaris or *BSD than Joe eMachine is).

I fail to see how the PGP vs. GPG question isn't settled on this very point. PGP won't even run on many platforms, so any ease-of-use claims should be dimissed out of hand on that basis alone. The choice is really between GPG (which is being actively developed) and freeware PGP (which looks to be getting pretty old). That isn't much of a choice.

Go ahead and flame away...

-B

Re:So it's just for Windows and Mac?

[sulli]

Yeah, because so few people use Windows and Mac. The idiots! Surely they should have released first for OpenBSD!

Re:So it's just for Windows and Mac?

[masonbrown]

PGP won't even run on many platforms, so any ease-of-use claims should be dimissed out of hand on that basis alone.

Yeah, I can't get PGP to run on my Atari 400, my Amiga, or my TI-85 calculator. Therefore it's worthless and I should use GPG instead.

Re:So it's just for Windows and Mac?

[J. Random Software]

Might want to rethink your examples. PGP has been ported to both the Amiga and the Atari. RSA, DH, and DSA take a lot of cycles but it's not as if the rest of the app is that complicated.

Re:So it's just for Windows and Mac?

[Anonymous Coward]

(as in the kind of folks into crypto who are more likely to be running Linux or Solaris or *BSD than Joe eMachine is).

Those are also the same people that don't have or say anything worth encrypting.

Re:So it's just for Windows and Mac?

[AndrewRUK]

Freeware PGP getting a bit old?!?
If you had looked at PGP's website, you would know that there is a freeware version of PGP 8 available for download, for non-commercial use.

Re:So it's just for Windows and Mac?

[Wee]

That I did not see. I was only looking at the MIT site.

-B

Re:So it's just for Windows and Mac?

[Anonymous Coward]

Not the Atari 400.
Only the Atari ST/TT/Falcon.

Please check your facts next time.

Re:So it's just for Windows and Mac?

[J. Random Software]

Sorry, I'd honestly forgotten the ST was not Atari's first home computer.

Maybe they'll fix that annoying XP problem

[angst_ridden_hipster]

... PGP 7.0 had the annoying problem that the firewall / network filtering stuff it wanted to install would completely hose XP's network stack.

Oh, and if you ran the un-installer, trying to fix it, it would remove the TCP/IP stack from XP altogether (even though that's not supposed to be possible).

If you rolled back using the XP Configuration tool, it was all OK. If you tried to reinstall XP's TCP/IP stack alone, or repair it using the install disk, you got mightily screwed by the fact that XP doesn't do a proper TCP/IP reinstall, coupled with the fact that when you run this reinstall/repair, it blows away your ability to roll back to a good configuration.

OUCH...

Of course, if you installed it without the network stuff, it was OK, and just makes XP occasionally pop up messages saying that the SDK driver is unavailable.

Re:Maybe they'll fix that annoying XP problem

[danrik]

RTFM, PGP 7 never had XP support for the networking components, only the encryption/signing of mail and clipboard contents.

IIRC, their webpage made that fact pretty clear, so trying to install the networking components was probably pretty foolish.

Re:Maybe they'll fix that annoying XP problem

[angst_ridden_hipster]

*EVENTUALLY*, their web site made it clear.

Originally, though, it was just fine print in the README.

And who reads that kinda shit?

But that's when Google Groups comes to your aid!

Re:Maybe they'll fix that annoying XP problem

[Anonymous Coward]

jesus, you're complaining about something that they warned you about in the README? The file is fucking called 'READ ME'. You should try reading it, you lazy ass.

You're the reason people hate Americans.

Re:Maybe they'll fix that annoying XP problem

[yatest5]

PGP 7.0 had the annoying problem that the firewall / network filtering stuff it wanted to install would completely hose XP's network stack.

Same, or similar, problems on 2K.

Good for United States Residents: +1, Patriotic

[Anonymous Coward]

..to thwart Total Information Awareness

Be Patriotic: Impeach George W. Bush

Cheers,
Woot

I use envelopes because I pay bills

[Hairy_Potter]

and the utilities and credit card companies get pissed if you staple the check to the bill.

Christmas time and ebaying are about the only time of year I mail non-bill stuff.

Re:I use envelopes because I pay bills

[Anonymous Coward]

and the utilities and credit card companies get pissed if you staple the check to the bill.

You think they're pissed? Try stapling them to the envelope.

Depends on how they implement it...

[Kjella]

If they have an automated reply-thingie that goes something like "Thank you for your mail. We'll be looking into it as soon as possible. Your reference no for this mail is #34524" and the 30 day limit starts there, I like it. If they can arbitrarily delay it or pretend they didn't get it, I don't.

Kjella

Re:Depends on how they implement it...

[HiThere]

The problem is, that they CAN do that. Even if they don't do that originally, a change in management can change a policy. So if they CAN delay responding indefinitely, then one must operate under the assumption that at some point they WILL.

This is the same reason that corporations are reluctant to become dependant on single-source providers. Once you become dependant on someone, even if you trust totally the people you originally dealt with, there can be a change.

So this part of the licens renders the program unuseable. The rest of it makes sense. I wouldn't do it that way, but I'm not trying to run a company around a product. But the "until we acknowledge" limitation is too big a lump to swallow.

I can't believe OSS zealots are taking this...

[NineNine]

I'm CONSTANTLY reading about how MS's EULA are so terrible, yet this one prohibits what you can and cannot say about the product and *this* is acceptable? Talk about truly restricting free speech (I don't even know if this is legal). Anyone who buys this has got to be out of their fucking minds. I buy MS stuff (licenses and all), but I wouldn't touch this with a 10 foot pole.

Re:I can't believe OSS zealots are taking this...

[stratjakt]

This isn't even open source at all. It's just available source. You can't compile, use, alter, distribute or discuss it.

The only thing you can do is free bugsearching.

Quite frankly, most OSS zealots I've met wouldn't know what source code was if they saw it. It's just an anti-corporate buzzword they picked up at college.

Re:I can't believe OSS zealots are taking this...

[analog_line]

MS Licensces say that you can't review the software you are licensed to use without Microsoft's approval.

How's that any better?

Re:I can't believe OSS zealots are taking this...

[NineNine]

At least there's nobody telling me that I can't say, "This product sucks" on a website if I choose to.

Re:I can't believe OSS zealots are taking this...

[NineNine]

All good points. My bad. I still wouldn't pay money for any product that says, "You can't bitch about it publically". Of course, there's no way that they could legally enforce this.

Re:I can't believe OSS zealots are taking this...

[TeddyR]

They could require the webmaster or the forum moderator to take the comment out; or else they would face legal hassle.

Re:I can't believe OSS zealots are taking this...

[T-Ranger]

How so? Has the webmaster or forum moderator downloaded the source code and agreed to the license? Not necessaraly, and probabaly not at all.

Re:I can't believe OSS zealots are taking this...

[Anonymous Coward]

Actually the restriction is on the time that you have to wait before disclosing any problems to give them time to fix it.

And such restrictions only apply to the source distribution.

In any case, there are products where the license explicitly forbids saying bad things about it (e.g. publishing benchmark results...).

Re:I can't believe OSS zealots are taking this...

[TeddyR]

Unofrtunately, they would fall under "knowingly contributing" once they are informed of the "license breach" if they dont take immediate action to take down the "offending/breaching" item...

blame the DMCA....

Re:I can't believe OSS zealots are taking this...

[Anonymous Coward]

I'll try to clear this up for you.

Phil Zimmermann is the creator of the world's most used e-mail privacy software. He is releasing source code and saying, again, that the peer review process will fortify it. This would be a reason why open source zealots would "take this".

However, open source zealots are not simply taking this. They are taking a moment from their zealotry to question the validity of this licensing agreement, as is explained in the article:

"The license agreement it takes to download source code, however, contains clauses guaranteed to rankle some open-source advocates and security enthusiasts. "

What you are complaining about is Phil trying to protect his product from the abuses that can occur by releasing source code. Of course you can say "this product sucks" on a website. What Phil doesn't want you to do is say "hey i reviewed the code you offered and found a bug that makes your privacy transparent. I'm going to post it on my website and damage the privacy of corporations, individuals, and governments alike. btw, your product sucks."

Your notion of "its not free enough for me, I'll just shop at Microsoft" is totally absurd. I think if you spent more time reading their EULA rather than about it you would agree.

typo:

[Bishop]

That is Phil Zimmermann. My appologies.

On the other hand...

[moquist]

The opposite of this post would be a very short post with lots of pictures about writing a novel.

Only can use source code to verify integrity?

[weave]

WTF? I can download the source code to audit, but I can't compile it for any other use than to verify it? This means I can't use the compiled source code in daily normal use?

Anyone else have a problem with this? OK, I download source code, verify it looks fine, but if I want to use the program, I need to buy/download the binary from them -- whose binaries may not necessarily be compiled from the source code I verified to my satisfaction.

(Thank god for GNU and gpg, no strings attached beyond that "nasty" "viral" (sarcasm) GPL)

p.s. I guess we won't be seeing THIS product as part of gentoo! :)

Re:Only can use source code to verify integrity?

[Kupek]

I don't think you read it correctly.

Further, those who download the source code may not "use executable code versions of PGP software programs created by compiling these source code files for any purpose or reason other than verifying that there are no unknown vulnerabilities or the like or otherwise making your own assessment of the integrity of the source code and the security features of the PGP software."

My interpretation of that is you can compile the source code, and you can use the executable generated from your compile, but only for evaluation means. You can't compile their code and then use that executable as your copy of PGP. But you can still use your compiled binary for verification.

Also, they never claimed this is GPLed code. What's with the animosity? I think this is a good thing - a for profit company showing all of their proprietary source code to their customers.

Re:Only can use source code to verify integrity?

[dillon_rinker]

So you download the software, you compile the source, and you do a bit-by-bit comparison. They're the same - you have now verified that the binaries are compiled from the source code you verified.

Or they're not the same - you now call and talk to their tech support and find out why they're trying to root you. You have your lawyer send them nastygrams. You do a write-up for slashdot about the experience.

Looks like a win-win scenario to me...

Re:Only can use source code to verify integrity?

[aridhol]

Erm...no.

Differences in the compiler used will cause small differences in the binary. Used a different optimization setting? Oops, the code is different.

What you can do is build the sources, and use that to verify the signature on the binaries.

Re:Only can use source code to verify integrity?

[weave]

What you can do is build the sources, and use that to verify the signature on the binaries.

But that still requires that you trust the person who built the binaries in the first place, since they'd be the one who also signs the binary.

I also seem to remember just compiling a simple DOS exe using the same compile settings always produced a different binary, although that might just be some sort of exe preamble or something.

My paranoia may be well unjustified, but what's the big deal about me compiling and then using my own binary rev?

Re:Only can use source code to verify integrity?

[Sloppy]

What's with the animosity?

Because they missed the whole point about why people wanted the source code: to be sure there aren't backdoors. If I send you a binary that that may contain a trojan, and then I also send you this source code:

10 print "hello world"

then you can be sure that the binary I sent you, is safe to use. Right?

Maybe the very idea of a backdoor in PGP is totally and groundlessly paranoid, but then think about who the product is marketed to.

Re:Only can use source code to verify integrity?

[Kupek]

I think they want to prevent people from making additions to the code base, compiling binaries, and distributing those. Forking, in other words. If they explicitly say you can't even do it for yourself, it might be easier to enforce. (But maybe not. That gets into legal stuff in which I am uninformed.)

Parent is overrated. Mod down please.

[Anonymous Coward]

Tempest is the technology to protect you from Van Eck Monitoring, which is the term describing using electromagnetic emission reproduction with big assed antenna setups and a monitor. Key sniffers operate from the OS, not "in your keyboard". Unless you think that "H4X0rz STLOE MY MEGAHURTZ!!1" like JeffK would say.

Re:Parent is overrated. Mod down please.

[J. Random Software]

A software key sniffer is more vulnerable. Hardware versions are widely rumored to be seeing field use. Hell, ThinkGeek sells one, though it's too big to conceal easily.

It's not just encryption

[Gemini]

A lot of people have posted comments to the effect of "If they want to get at your secret email, they will anyway despite PGP". Don't forget that GnuPG/PGP has a huge other use as well. OpenPGP signatures are what protects a huge number of software packages from tampering.

The recent trojanings of OpenSSH, etc, would have been caught even earlier if users had checked the OpenPGP signature distributed along with the tarball.

Re:It's not just encryption

[Anonymous Coward]

Not many users have Niels Provos' public key. The only way to get it is to meet him or meet someone you trust who has his key. Because so many PGP users are not really trustworthy, the number of people who can verify that the FTP is serving good tarballs by verifying a signature will remain low. It is quite possible to identify these people by their hostname or anonymous FTP password, for example. The FTP can then send them good tarballs even as it is sending the trojan horse to others. What is needed is a network of trusted users who FTP from random hosts with random passwords at random but frequent intervals to detect the poisoning of the server. So you see, encryption cannot make up for the failures of fundamentally insecure systems like anonymous FTP.

Failing assumption...

[Kjella]

You use envelopes, right? Why? Becuase you don't want everyone in the post office reading your mail. If you didn't care, you'd use postcards.

Umm no. Not that I use letters much anymore, e-mail / IM / phone covers most of my informal contact need. When I send a letter in an envelope it's because:

• I'm sending something too long to fit on a postcard
  
• I'm attaching something (photos, birthday card)
  
• It's typed up on my computer, and my printer doesn't handle postcards well
  
• The reciever expects a letter (say a job application)

Granted, there are a few times when I want an envelope for privacy reasons. But that's far from the only reason.

Kjella

Re:Good for United States Residents: +1, Patriotic

[Anonymous Coward]

Impeachment is for holders of public office. Dubya is just a squatter and should be evicted.

Student License

[rosewood]

You know - when PGP was owned by NAI I had no qualms just warezing it. I loved PGP disk and a few other PGP things. Just quick encryption of files was nice. A little tighter encorporation with Outlook and taking up less recourses would be very cool.

Now that its PGP not owned by NAI, I really want to own and use and promote this product. I however have no money as a college student. However, as a college student I think I would REALLY benefit from PGP. Not only keeping email between advisors and other students encrypted but also just keeping my personal records safe on the "wonderfully" secure campus network.

Anyhoo, just my thought trinkles.

Re:Student License

[Anonymous Coward]

Now that its PGP not owned by NAI, I really want to own and use and promote this product. I however have no money as a college student. However, as a college student I think I would REALLY benefit from PGP. Not only keeping email between advisors and other students encrypted but also just keeping my personal records safe on the "wonderfully" secure campus network.

Well, you could always do what I did when I was getting my degrees...get a job. Or if that's too much to handle, you could always sell your plasma. Provided you have no skanky diseases, you ought to collect the required 39$ in just a couple of weeks.

Re:Student License

[EverLurking]

I'd been using the various free versions of PGP and GPG forever and you're right, now that PGP finally seems to be in better control of it's own desitny, I had no qualms about shelling out $39 for the Personal Desktop version (for OS X).

I'm no longer a student. I can afford this now and it's about time I contribute to the retirement fund of a really admirable man (Phil Zimmermann) who did after all suffer through some pretty arduous shit when lesser men would have just capitulated. PGP v8.0 for OS X is a GOOD SOLID program and I'm happy with my purchase.

DaveC

Re:Student License

[rosewood]

I might have to do this as a tax write off or something cause I would really like to see my profesors and advisors talking to me via PGP encrypted IMs and emails.

I guess with trilian and ICQ I dont need encrypted IM since it does a secure connection.

Easy, multilingual, open source

[MagicFab]

An easy way to install WinPT is available now.

Cheers,

F.

Re: Easy, multilingual, open source

[Nasheer]

Does I gain a +1, Useful for building the instaler?

Original website (handle carefully, slashdots easily). Another mirror here.
(This software is intended to Windows users, only.)

Raising The Bar

[Steve B]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls.

The objective is not to create perfect security (which is, as you correctly say, not possible). The objective is to make your security good enough for most practical purposes.

Yes, the government can use various sorts of surveillance measures to get your messages anyway. However, requiring trained personnel to set up monitoring vans or do black-bag jobs limits the total number of surveillance targets. That makes wide-ranging fishing expeditions impractical, and inhibits abuse by bored or vindictive individuals. Also, it leaves a bigger trail (more memos, more people directly involved) to be traced if -- OK, when -- the government does break the law.

I contributed $50 to Phil's legal fund...

[e40]

back in the 90's. Does this mean I get a discount?

Anyone else think it's expensive? $80 for Windows for one year, or $165 for a perpetual license. Ouch!

Re:I contributed $50 to Phil's legal fund...

[Contact]

The "personal" edition is only $39, which is much more reasonable for personal use. I bought it online a few hours ago (for Mac OS X), downloaded and installed it flawlessly over the beta which I've been using for the past few weeks.

have you seen the price for a license?

[netean]

PGP Desktop (Windows) Price: $80.00 and that entitled you to "own" the license for a single year FFS. That's a lot of money IMO $30=$40 I'd gladly pay, afterall it's a great product and Phil is clever bloke. but $80 is too much when I can get the same functionality from the old free version or the completely free GNU version.

Re:have you seen the price for a license?

[Simon Garlick]

Err, how about $39 for life? Did you actually READ anything at pgp.com?

There's a more important use of PGP than privacy!

[aquarian]

To me, there's a more important, significant use of PGP than privacy. One of the biggest obstacles to *really* doing business over the internet is being able to verify where messages come from. PGP provides this. A PGP signed message is as good as a signed piece of paper.

I never cease to be amazed at how this aspect of PGP is never discussed. I guess all the stupid, nose-picking, trainspotting geeks all over the world really can't see beyond the government prying into their porn collections.

It's about trademark as a trust point

[jhantin]

If you compile your own version, you have a program based on the PGP source code that understands the PGP file formats and protocols, but by trademark law you can't actually call it "PGP"-- the trademark name is reserved for the official distribution only. That's the same reason CheapBytes has to sell their copy of Red Hat's Linux distribution images under the name "Pink Tie Linux"-- so people know up front that it's not the official Red Hat distribution.

Re:Legal vs. Illegal Presidents

[Anonymous Coward]

Iggy Pop for President!

gpg can actuall help sell pgp

[kevin lyda]

we use (or advocate the use of) gpg to encrypt and auth sensitive data for our servers. this is not to protect the files from the gov't, it's to stop data with a high monetary value from being stolen. most of us at work at least have gpg configured.

we usually recommend pgp for less technical users - of which there are far more then on the server side. so pgp would get more sales from us due to gpg. i hope they sell lots of their s/w and make it even easier to use - it would really help us if less technical people were more exposed to pgp.

You could say the same thing about Windows.

[mmol_6453]

You could say the same thing about Windows. Granted, for the people who know of them, PGP Corp has a better reputation.

Re:You could say the same thing about Windows.

[Anonymous Coward]

minor correction: everyone has a better reputation

Re:You could say the same thing about Windows.

[xski]

minor correction: everyone has a better reputation

well... except maybe... oh.... Oohh! Hitler! MS's rep isn't as bad as Hitler, right? (I'm not really sure to be honest, I don't get out much.)

-x

Re:You could say the same thing about Windows.

[shaitand]

I thought Hilter was just ballmer's predecessor, or at least just another M$ employee?? Can someone please verify this???

XP like activation

[bwalling]

From reading their site, it sounds like they are now using XP like product activation. You enter your license key, then it contacts their servers to validate your license.

Java JNI implementation

[microTodd]

OK, maybe this is wrong place to ask this question, but I've searched the web and have not found what I'm looking for. Has anyone ported the newer PGP (6.5.8+) to Java using JNI? I'd really like to programmatically use PGP in Java without using a command-line.

And I'm a lazy bastard who doesn't want to port it myself. I've got enough other coding on my plate to work on...

TIA...

Re:Java JNI implementation

[Anonymous Coward]

Search this thread for "Java". Someone mentioned an interface above.

Very interesting business model!

[Anonymous Coward]

Wow, I'm impressed with their sense of business!

Moron!

[Anonymous Coward]

If you just had one ounce of brain matter, you'd realize that this link points to Amazon. Would Amazon ever put up filthy pictures on their site?

Re:Good for United States Residents: +1, Patriotic

[Anonymous Coward]

Shut the fuck up you un-American bastard. I've had enough of America-bashing and Bush-bashing on Slashdot. It's time your kind was put in its place!

Support America, support our duly elected President! We may not agree with everything he does or says, but he is our leader, and we will give him the respect that he deserves! Anything less is unpatriotic, and un-American.

My father fought in World War II. My older brother fought in Korea. I served in the Army-- as a Ranger-- but was never called upon to fight for my country. I have personally shown my commitment to fight and, if necessary, sacrifice my own life to defend your right to make these kinds of statements. But that doesn't mean I have to like it!

SO SHUT THE FUCK UP YOU UNGRATEFUL PRICK!

Command line != GUI

[yerricde]

when I can get the same functionality from the old free version or the completely free GNU version.

Yes, but PGP is a GUI app that can talk to to Outlook Express, and last time I checked, GnuPG was a command-line app.

( /me checks the list of front-ends for Windows )

Apparently, somebody has made a GnuPG frontend for Outlook Express since I last looked. But what about about Mozilla? Does enigmail work with Mozilla 1.2.1?

Re:Command line != GUI

[Anonymous Coward]

ok, problem #1 is that anyone still gives a fuck about Outlook Express. Oh, the old versions don't work with OE? Too fucking bad. Get over it and get a real mail client.

Anyone who uses OE has no right to whine about anything.

Re:Command line != GUI

[Anonymous Coward]

It works with Mozilla 1.2, so I would assume so.

Re:Command line != GUI

[Anonymous Coward]

But there are GUI frontends for the old PGP and the new GPG's.... so there.

Re:There's a more important use of PGP than privac

[Anonymous Coward]

I guess all the stupid, nose-picking, trainspotting geeks all over the world really can't see beyond the government prying into their porn collections.

Hey, Bill Clinton used up a lot of my upload bandwidth. I simply had to do something about it.

GnuPG seems a better choice

[njdj]

I can't think of any reason to prefer PGP to GnuPG, and there are some reasons (already pointed out) for preferring GnuPG to PGP.

So, overall, I can't why anyone would use PGP.

Zimmerman made a great contribution, deserves tremendous credit for what he did, but as he says himself, it's all history.

Re:GnuPG seems a better choice

[Mitchell Mebane]

What about PGPDisk?

Re:GnuPG seems a better choice

[Anonymous Coward]

because it works ?? just a thought. Ive tried 3 times over the last 8 months to install gpg and it doesnt work. period. it can never find the files it needs. its a piece of shit and noone updates it. oh yeah, whoops, this is the windows version, so I guess Im not worthy.

Re:GnuPG seems a better choice

[Skorpion]

Why use PGP? Because i titnegrates with Windows stuff, like Outlook.

Re:Good for United States Residents: +1, Patriotic

[fsharp]

Hmmmm, lets see. I'm an American and if I want to I can say whatever I want to about the President. I can critique, disagree, agree, and even (gasp) not respect or support him.

Guess what dude, this comes under the heading of freedom of speech and last time I looked, the Constitution allowed me to just that. And does that make my unpatriotic? Not in my book, dissenting views ultimately created this Nation. Remember?

Oh, if you want to make a point, then do so with a reasoned and intelligent response. Why is dissention bad? How is speaking your mind in disagreement with leadership un-American? Because you said so? Hmmm.

To The Ranger:

[Anonymous Coward]

I appreciate your comments and have only one comment

You state:

We may not agree with everything he does or says, but he is our leader, and we will give him the
respect that he deserves! Anything less is unpatriotic, and un-American.

Would you please point out the "disprect" in my
comments. My desire to have him impeached does not
necessarily mean I disprect him even though I know
he is a moron and has difficulty completing a sentence.

Thank you and have an Afghan heroin-inspired
evening.

Yours very truly,
Woot

Freeware beta vs. Freeware final

[Anonymous Coward]

PGP may be keeping with a freeware version in name, but not in form. The beta version had PGPDisk and Outlook integration.

"PGP Freeware does not include any plug-ins for integration with electronic mail or instant messaging clients, nor does it include PGP Disk."

Too bad, too...even though I'm running WinXP, I was able to use the older freeware version with Outlook. Maybe I'll be reverting back to it.

PGP is underrated

[ChaosDiscord]

PGP is overrated... so is GPG. If the government really wants to get you [they will]

Well, duh. However, PGP might just protect my trade secrets from being intercepted by a competitor. PGP might also protect my medical information from a private detective trying to dig up some dirt on me for a bitter ex-spouse. Competitors and private detectives don't have the resources of the United States government and PGP works just fine against them. Furthermore, PGP has most certainly been successfully used to protect human rights workers from clumsy oppressive governments. If that's not a great accomplishment, I don't know what is.

Source available not as good as open source

[ChaosDiscord]

There's a difference between letting people look at your source code -- finding bugs, fixing problems -- and giving it away.

Great, I was looking for an opportunity to debug someone elses commercial software for free!

I applaud his efforts toward transparency, and restricted source is better than no source. But if I'm thinking of putting some effort into improving some software for me own use, it's an easy choice between GPG and PGP. With GPG, I know that my changes and the code that my changes are based on will be available to myself forever, and I can share my changes with others if the official source goes away.

Re:Source available not as good as open source

[Tassach]

Great, I was looking for an opportunity to debug someone elses commercial software for free!

It's called "peer review" and a long standing tradition in the academic world. It's also a matter of trust. By releasing the source, they are saying, "look, nothing up my sleeve". It's proof that they are not selling you a crippled product. It doesn't matter if you ever read the source, because someone will. There are plenty of people who have the desire and the ability to do so.

Mozilla

[yerricde]

Get over it and get a real mail client.

What do you define as a "real mail client" on the Microsoft Windows platform?

Anyone who uses OE has no right to whine about anything.

That's why I asked about Mozilla. There's apparently a well-known Mozilla plug-in, called "enigmail", that provides PGP services in Mozilla's mail component, but it doesn't work with all versions of Mozilla. My question was whether or not there was a way to use GnuPG with recent releases of Mozilla, such as 1.2.1.

Re:Mozilla

[Anonymous Coward]

Eudora and Pegasus come to mind. Lotus Notes. Netscape. Mozilla. Joe Bob's HickMail. Anything but the scab that is Outlook Express.

A search on TUCOWS will certainly help.

Re:Mozilla

[Anonymous Coward]

Mozilla.

Read yerricde's comment. He was looking for a working Enigmail package for Mozilla 1.2.

Destined to be a classic slashdot line

[Anonymous Coward]

mod this one up...absolutely captures the essence of /.

This is why we have certified mail and notaries

[Tassach]

For something important like this, where it's important to document when you sent someone a document, you have to use certified (snail) mail and have everything notarized.

Regardless of the wording of the click-through license, they would have a VERY hard time convincing a court that you were not acting in good faith if you can produce hard physical evidence that you did in fact notify them N days in advance of disclosing the bug publicly.

Re:There's a more important use of PGP than privac

[ragnar]

A PGP signed message is as good as a signed piece of paper

Possibly in the legal sense where you have the authority to take action, like billing the person or shipping a product, but not in terms of real authentication. Forging a signature (expecially one unfamiliar to you) is easy, but a PGP signed message requires knowledge of a passphrase. I have more trust in the PGP signed message.

(from a person whose mother "signed" a lot of notes to excuse him from days in high school)

Why businesses use PGP instead of GnuPG

[Nonesuch]

njdj writes:

I can't think of any reason to prefer PGP to GnuPG, and there are some reasons (already pointed out) for preferring GnuPG to PGP.

So, overall, I can't why anyone would use PGP.

You might not see any reason to prefer PGP to GnuPG, but there are many reasons why a business user my prefer to deploy PGP:

1. Technical support.
2. Well-designed GUI interfaces.
3. Directory integration with NDS, LDAP, AD, etc.
4. Key Escrow and additional decryption key (ADK) support.
5. Includes a non-intrusive and reliable MS-Outlook (not just OE) plugin.

Yes, I know the whole idea of key escrow and ADK are seen as horrible invasions of privacy by personal users, however, these features have a valid business purpose in a corporate enterprise deployment and are mandatory for certain types of business communication.

Re:Why businesses use PGP instead of GnuPG

[njdj]

there are many reasons why a business user my prefer to deploy PGP:

1. Technical support.

You can easily buy technical support for GnuPG and other open-source products. This is another advantage of open-source - support from a small independent company is usually better than support from a big company, even when it's the company that produced the software

I bought it

[Anonymous Coward]

I bought it. Not for me. GPG is good for me. I bought it for a group of morons i call the dream team, because even they can use it successfully. I applaud the effort, and I too wish him the best of luck. What a fantastic product.

GnuPG Will Win Out

[Anonymous Coward]

The problem with PGP is that it has a very robust freeware alternative. No one in the Linux/Free Software world is going to end up paying for PGP when they can have GnuPG. As far as the difficulty of the command line goes, I came across a script that makes GnuPG much more usable when compared to the plain command line version. It is in Perl and runs on Windows and Linux. See http://www.geocities.com/jvenu/software/gpgd.pl for it. My guess is that PGP will only get used in large corporations where the need to "sue someone" is paramount over all else.

I didn't even make it that far

[Wook Man]

I got the email with the link, but the page the link points to says "No Download" where I presume the download link should be.

Well, they say anything worthwhile is worth waiting for, right?

Wook

What? Functionally illiterate??

[Futurepower(R)]

George W. Bush can't even say "functionally illiterate".

Re:There's a more important use of PGP than privac

[ChrisJones]

For signatures to work, you need to trust the other persons key, that means both that it really is who it says it is (which requires a web of trust, which presents significant problems and scalability issues), plus the other person must be trusted to keep their private key safe and their password protected. That is hard enough on a single user machine, but becomes almost impossible if you want to send a message while you're mobile (e.g. an Internet cafe is right out).
The two are interlinked as well, if someone in your web of trust is not secure, by trusting their key to some degree, you are also potentially tainting the authenticity of other keys.
If OpenPGP were a more widely used standard, it would be nice to be able to get your keys signed by respectable authorities (i.e. the functional equivalent of SSL authorities). Many of the SSL key vendors also do personal certificates, but they aren't really in an especially useful form for PGP type stuff.

"Chained" encryption is uncrackable.

[Futurepower(R)]

If you encrypt a file, then scramble the bytes, then encrypt that result with another encryption method, there is no way to crack the result. "Cracking" depends on playing by the rules and using only a known encryption method. Cryptographers use mathematical methods to try to break encryption; these methods are not available when chaining is used.

To use the chain encryption method, you must secretly communicate the scramble-descramble method and encryption process to anyone who is allowed to decrypt the file, and the method and process must be kept secret. That's a big drawback in some cases, and not in others.

Re:"Chained" encryption is uncrackable.

[scotto]

You say that "chained" encryption is secure as long as you can secretly communicate the the algorithm to the recipient. If you could could communicate secretly with the recipient, why not use that method to send your message?

Also, you say the security of "chained" encryption depends on the secrecy of the altgorithm. That means that if the secrecy of the algorithm is compromised, then all past and future communications using that algorithm are potentially compromised as well. Now you have to come up with a whole new algorithm, rather than just a new key. That is why the security of an encryption system must not depend on the security of the algorithm.

Zimmerman vs Stallman?

[technoCon]

Zimmerman sounds reasonable, but I'd dearly love to hear what RMS has to say about this.

I think that both Zimmerman and Stallman are Good Guys.

There's daylight between Zimmerman's source release and the GPL. I think Zimmerman's license intends to accomplish something different than the GPL. "There's no NSA backdoors in here." is different than "Here's the source, send back any improvements you find."

I think the GPL is more realistic in that it acknowledges that (healthy) software is not static. The proof of this conjecture will come when PGP and GPG have been out there for a few years and we see which one has more useful features and fewer bugs.

We'll see.

Re:There's a more important use of PGP than privac

[Anonymous Coward]

So you are saying that PGP signatures aren't foolproof. That may be true, but neither are pen and ink signatures. Furthermore, PGP secret keys can be password protected, while anyone can use a copy machine or tracing paper.

Re:Parent post is overrated

[charon_on_acheron]

"Even after the events of the last year, government in general still seems to have the resources to be a greater threat to us than all the Islamic malcontents in the the world put together. "

You don't live in New York City do you?

Let's have a vote:
Everyone here from NYC, would you rather trust the government to not crash planes into your remaining skyscrapers, or the terrorists?

Everyone from Oklahoma City, similar question.

Everyone else in the US, who do you trust more, Uncle Sam or Osama?

Everyone not in the US, and not a terrorist?

Finally, all the terrorists reading Slashdot, who do you trust more to ensure you get to live to 100 years old? Osama picked 19 schmucks, and convinced them to not live to 50.

Ragnar

[charon_on_acheron]

I liked your pic on your Magic card. Johan was great too. **sniff** Those were the days.

I just paid my $39

[Simon Garlick]

For the use I've had out of freeware and compiled-from-source versions of PGP over the years, this is a no-brainer. PGP has been invaluable to me for a long time.

Come on PGP users, put your money where your privacy is!

A "chained" encryption method cannot be public.

[Futurepower(R)]

The "whole new algorithm" is just changing the byte scrambler. Scrambling the bytes in 512 byte chunks is very easy and fast, and there are a huge number of ways of doing this. Note that the scrambling method can depend on the 326th letter of the last email message received, or something like that.

If the chaining algorithm is compromised, the attacker must still attack the underlying encryption.

Also, your private key is stored somewhere. You can store the scrambling algorithm in the same place.

Note that chaining does not depend on encrypting the file twice. Just encrypting once and scrambling the bytes (and removing the file identifying bytes) is enough to harden an encrypted a file against mathematical attack.

The entire problem with scrambling is that it is not possible to distribute the scrambling method publicly. Public-key encryption allows distributing the public key. The scrambling method requires delivery in person, or by some other trusted manner.

Re:A "chained" encryption method cannot be public.

[Anonymous Coward]

What you're describing is essentially encrypting twice, with the "scrambling" being a weak form of symmetric encryption, and the scrambling method can either be considered a key or a secret algorithm. Without constraints to define a well-defined set of possible scrambling methods, the latter would be more natural.

In any case, while adding an extra secret component to encryption can make it somewhat less practical to crack, it does not even come close to making it uncrackable, is very impractical to use and requires a lot of work to set up.

There is nothing special about byte scrambling, either. You might as well encrypt twice using different symmetric ciphers.

eBusiness Server

[chiph]

FYI: Network Associates kept the rights to their eBusiness Server when they sold the rights to the desktop version of PGP to the new PGP Corporation. eBusiness Server is used by many corporations to automate their PGP encryption for batch processes, SOAP servers, etc.

Even when (If!) the Gnu GPG group decides to release a library/DLL version of their privacy tool, I suspect a fair number of companies will continue to use the NAI product in order to avoid having to deal with the Bureau of Industry and Security in the US Department of Commerce for exporting their own compiled encryption software.

Paranoia

[vadim_t]

That license doesn't make sense. Let's see:

1. You can use the binary they compiled.
2. You can compile the source, but not use it.
3. Source is provided to verify lack of backdoors.
4. That means that the source should produce the binary you get on their site.
5. Therefore, both binaries are identical so different use restrictions are nonsense.
7. Somebody mentioned here that while they provided information about the build environment attempts to get an identical binary weren't successful.
8. All this seems to indicate there's a quite strong possibility of PGP being backdoored.

Re:Paranoia

[MikeBabcock]

Producing the binary on their site would also require the same compiler they used (same revision of all headers too).

Re:Paranoia

[vadim_t]

I know that, as I said somebody mentioned that the build environment required was described. However the binary still didn't match.

If the binary does match, then why the license? Both would be exactly the same thing.

Great Article

[Anonymous Coward]

Since Timothy posted this, i'm going to assume that he wrote it, too. Thanks Timothy. This is possibly the best-written article I've found here in two years I've been reading Slashdot.

Here's to real tech journalism on the web. You covered the topic with the details that the Slashdot audience wants and polished it to a level of quality that is worthy of any self-respecting newspaper. If this kind of quality keeps up, I'll definately buy a subscription.

Be warned, editors who post shoddy articles here. This is the standard to which you should aspire. If you write well, you shall be rewarded.

Who's the moron?

[Anonymous Coward]

It's a fucking goatse.cx link. Sick fuck.

Zimmerman Telegram

[Vryl]

Anyone notice this co-incidence before?

http://www.archives.gov/digital_classroom/lessons/ zimmermann_telegram/zimmermann_telegram.html

Re:Zimmerman Telegram

[Jim Efaw]

Anyone notice this co-incidence before? http://www.archives.gov/digital_classroom/lessons/ zimmermann_telegram/zimmermann_telegram.html

You're the first!

Scrambling prevents a mathematical attack.

[Futurepower(R)]

There was only one point: Scrambling prevents a mathematical attack.

CORRECTION -- PGP works fine with MS Office

[Raetsel]

Dear Sir;

I regret to inform you that you have no idea what you are talking about. I am using PGP Freeware version 7.0.3 to communicate with family members. My parents use Office XP (with Outlook XP as their mail client) on Windows 2000, my in-laws use both Office 97 (Outlook 98) and Office 2000 (Outlook 2000) on Windows 98, and I use Office 2000 (yup, Outlook 2000 again) on Windows 2000. There have been no problems -- zero, zilch, none. Encrypting an email is a one-button affair; PGP adds a simple set of three buttons to the taskbar, one of which is "Encrypt Before Sending." Reading a message is as simple as opening it -- you get a dialog for your passphrase, and that's it.

To borrow a phrase, "It just works."

I will occasionally get a phone call to provide tech support for WordPerfect Office, but I have never had a complaint -- or even a question -- about PGP.

I am very curious about exactly what you were thinking when you started the FUD machine.

I have purchased PGP before. Now that NAI is out of the picture, I will do so again -- this ought to make a nice stocking-stuffer, burned onto 3-inch CDs.

FUD? You sir are a moron

[ergo98]

I regret to inform you that you have no idea what you are talking about.

Well thank you captain for informing me that the fact that PGP 7 does not properly integrate with the Outlook 2002 (Office XP) I'm looking at in front of me is all just an illusion in my head. Indeed, do a search on Google or Deja and it is verified, hundreds of times over, that 7.0.3 in particular is trashed in Outlook XP: They are not compatible. On top of that the problems encountered in the case where I selected PGP and had it installed company wide, to find that it did not properly integrate with Outlook 2002, was again all just an amazing mystery in my head.

I am very curious about exactly what you were thinking when you started the FUD machine.

Interesting seeing that one of the big features of PGP 8 over PGP 7 is support for Office XP. Gee, I wonder why they'd say that?

Normally I'd just ignore an ignorant moron such as yourself, but your righteousness in replying just blows me away. To proclaim FUD is especially laughable when I'm not scaring people away from PGP, but rather saying that PGP 8 is a nice upgrade. Learn when to cry FUD you fool.

Go away.

Facts, please -- not anecdotes.

[Raetsel]

• "...the fact that PGP 7 does not properly integrate with the (sic) Outlook 2002 (Office XP)..."

Interesting choice of words ("properly integrate")... are you taking that to mean "works the way I fantasized it would" or "works the way it was designed to"? There's a difference. This "moron", as you are so quick to label me, managed to get PGP 7.0.3 working with Outlook XP without a hitch. That doesn't lend much weight to your assertion that it doesn't work. Denying the facts won't make them go away.

• "...in the case where I selected PGP and had it installed company wide, to find that it did not properly integrate with Outlook 2002..."

Am I supposed to assume you're some sort of IT wizard and not question your anecdotal assertions because of that statement? That's not going to happen. Further, you just admitted you're the moron. You deployed it, and then found problems. That's why people use test labs -- even for small businesses, test first, then deploy.

Since you were so insistent about it, I searched Google. In the first few pages of hits, I found several articles about PGP 8, some news about (now patched) possible security holes, and what appear to be several warez sites. Odd that I didn't find the numerous tales of woe that you did...

Now, about that Fear, Uncertainty, and Doubt bit... Masonbrown wrote:

• "...as a corporate user with a Win2k machine using Outlook, is there any significant reason to upgrade to 8.0 from whatever I'm using now..."

And you replied:

• "The fact that PGP doesn't work in general in Office XP should be a pretty big bonus (actually I think it even had problems with Office 2000). "

1. Your statement offers no supporting facts.
2. "...doesn't work in general..." is laughable in light of the ease with which I managed to install and use it.
3. If you read his post again, you'll notice he's successfully using a PGP version that is not 8.0.
4. Reading it, a user will be uncertain and doubt whether or not their current version of PGP will work -- perhaps spending money on an unnecessary upgrade.
5. Further, you're spreading the fear of "problems" with Office 2000. "Gee... I've been using it, God knows what has been going wrong behind my back..."

Congratulations, you've spread FUD.

I have demonstrated a working system. You claim it won't work, and call me a moron. You can't dispute the facts, so you attack the messenger. (That's step 2 in the FUD manual.) I suggest you RTFM, install the patches, and try again. (And no, I won't go away.)

Re:Facts, please -- not anecdotes.

[ergo98]

Am I supposed to assume you're some sort of IT wizard and not question your anecdotal assertions because of that statement?

It's called empirical evidence my special bus riding friend. Am I to suppose that you're some sort of guru because you got PGP installed on your parent's PC?

That's why people use test labs -- even for small businesses, test first, then deploy.

Actually, I simplified the scenario for your sake (although obviously not quite enough. Let's try "INSTALL PGP NOT WORKEE"). PGP 7 was deployed in an environment with Office 97, and then started breaking as people upgraded to Office XP (or, alternately, when people installed new machines with Office XP). Of course this is all just in my imagination, and easy to find resources like this page, when talking about preliminary support for Office XP in 7.1 (a non-generally released NAI version), is all just a dream, right champion? I suspect that the version you really have a warez copy of a later NAI enterprise release, because it most certainly isn't 7.0.3 if you think it was install-and-use.

I have demonstrated a working system. You claim it won't work, and call me a moron. You can't dispute the facts, so you attack the messenger.

You're hilarious. Your initial posting was a hilarious contradiction of my direct experience (insinuating that I was creation fiction), claim that I'm spreading FUD (which is so unbelievably absurd given that there's a freeware version of 8 available), and then you turn around and claim that I attacked the messenger. You're a classic last worder. Keep it coming sucka: I know you will.

If you read his post again, you'll notice he's successfully using a PGP version that is not 8.0.

Actually, and perhaps you're new here so I'll just ignore the unbelieavable stupidity of that question, most people postulate for discussion generating purposes (or for karma whoring). i.e. Note that he didn't say "Why would I upgrade from x.x.x", but rather just some generic upgrade claim (and it got moderated up because it does fill a natural question void). Secondly, I put a huge question around if it might not work with Office 2000.

I still find it hilarious, though, that you're running around screaming that you just installed 7.0.3 and it ran off the bat with Outlook XP (even with all the patches at http://www.pgpi.com). I think you might want to inform those in the PGP team who worked long hard nights trying to get PGP working in Outlook 2002 (BTW, because I realize you'll misunderstand this: When I say Office, obviously I'm referring to Outlook as there is no other direct integration in Office with PGP), or those countless authors of PGP FAQs who explicitly state that PGP does not work with Outlook 2002 (AKA Outlook XP). Keep your fantasy facts coming though.

To make this most humorous, though, I've actually be using PGP (you know: A non-warez copy) successfully in Outlook 2002 for some time via some select settings in the PGP Tray to eliminate the need to use the toolbar or menu item options.

Not identical ..

[Anonymous Coward]

Take "main(){printf("Hello!\n")}" and "main(){printf("%s","Hello!\n")}"

While functionally identical, gcc will compile them into two very different binaries.

Uh... no. The first will print "Hello!
" and the second will print "Hello!\n".

Re: PGP vs GPG

[metamatic]

Well, PGP 8 won't run on my OS X machine (10.1), and I can't fix it myself using the source code because of the stupid license.

GPG works, however.

Re:Parent post is overrated

[RealAlaskan]

Who can you trust? Who can carry out his intentions, good or bad? If the bad guys are powerless to harm you and the good guys quite likely to accidently screw you up, who do you watch out for? What does trust have to do with your answer?

I thought I said quite plainly that our government in the US has good intentions for us. They also have the ability to do us far more harm than Osama ever could. Partly that's because we trust our government, partly that's because our government is keeping a lid on Osama and company.

I don't think we should change that second reason: we definitely want our government to continue keeping after the terrorists. I do think that we should never trust our government blindly; not when they're doing us good, not when they're chasing terrorists, in fact, just plain never.

Think about this: if we were in Afganistan before the US invasion, the roles of Osama and the US government would have been reversed, more or less: the US would have seemed threatening but powerless, while the Osamites might have seemed less malevolent, since they professed good intentions, but immediately dangerous. The Afganis couldn't TRUST either, but they had to watch out for the Osamites.

Re:Good for United States Residents: +1, Patriotic

[Gyan]

"I have personally shown my commitment to fight and, if necessary, sacrifice my own life to defend your right to make these kinds of statements. But that doesn't mean I have to like it!

SO SHUT THE FUCK UP YOU UNGRATEFUL PRICK!"

Talk about contradictions.

First, you say you are ready to sacrifice your like for the almost unrestricted freedom of speech.

Second, he's exercising that right (what he's saying is irrelevant) but you're asking him to STFU (restrain himself from using that right) !!!

Like you said, you may not like it but you can't ask him to shut up about it.