PGP's New Release, Source Code, and PRZ

In high tech time, the span between Network Associates dropping PGP, its purchase by the purpose-formed PGP Corporation and that company's release today of PGP 8.0 may not be a short stretch, but it's been a busy several months. A product which appeared moribund despite widespread acclaim a few years earlier -- a victim of skewed corporate logic -- has rebounded for another major release, and Philip Zimmermann is doing something he's never done before: actually selling PGP. And as Zimmermann had urged long before NAI forged a deal with PGP Corporation, this time around the full source code is being released, albeit with strings. Read on for the rest of the story.

Would you buy PGP from this man? Long before Dmitry Sklyarov was arrested for helping people undo e-book encryption, and before DeCSS was unlocking DVDs, Philip Zimmermann was being prosecuted for a nearly opposite endeavor: providing software which allowed ordinary people with a modicum of computer savvy to encrypt their own data in a way impractically difficult even for large government agencies to reverse. His modestly named application Pretty Good Privacy, or PGP, was released in 1991 as freeware and was quickly adopted by privacy seeking computer users.

Export controls then in effect barred international trade in such software; because of PGP's inevitable spread online well past the borders of the U.S., Zimmermann was accused of violating munitions-export laws. For a while, this made Zimmermann a poster boy for the right to create software free of intrusive restraint, and ended up in a three-year battle with the government which Zimmermann eventually won.

Now, in a twist worthy of novelization, Zimmermann has joined a small number of PGP Corporation partners on North America, and will be reselling PGP Corporation's version of PGP. Outside North America, PGP Corporation has sales partners in countries from Germany to Singapore -- in a sense, Zimmermann is simply their most famous salesman. (He also serves on PGP Corporation's technical advisory board and maintains a consulting relationship with the company.)

Sales, though, is really a sideline to Zimmermann's consulting business. "I'm not really switching my career to sales," he says. Zimmermann is nonetheless enthusiastic about his new role selling the software he kick-started more than 11 years ago, though it's a switch from his role in creating it. "I don't write code anymore," he said from his Silicon Valley home office. "As you get further along in your career, you get further away from the things you like to do. I wish I could get back to it, but it's the Peter Principle, and here I am." Zimmermann downplays the Federal government's legal proceedings against him in the first half of the 90s, calling it "old news" and "years in the past."

Like any large organization, in fact, the Federal government has a need to encrypt certain documents, so it's no surprise that the government bodies of every stripe use "a ton" of PGP. It seems likely that his sales venture means that Zimmermann will soon have come full circle, from producer of verboten software to vendor selling his product to government agencies. Zimmermann admits "It would be funny, and there would be a certain irony if that happens ... I'm hoping to sell to enterprise customers, large users, and that includes the government. If the government wants to buy it from me, that would be fine with me."

Something to sell, and source code, too. PGP's present is finally catching up with its history (try this google search for a number of links): today's release of version 8.0 for Windows and Mac OS X differs not just in name from PGP as it was released under NAI's stewardship, because this time there is full source code to go along with it. (A Linux release is being investigated.)

The 8.0 release doesn't differ in basic purpose from previous versions of PGP: it's still intended as an easy-to-use approach to encryption for both business and personal use, with hooks to a wide range of network operating systems and mail systems; there are several simultaneous releases, actually, from freeware (for non-commercial use) to an Enterprise edition, and the features available vary with the price. There's also a link to download the full source, under certain conditions, from PGP Corporation's home page.

PGP Corporation director of products Stephan Somogyi says he's proud of the way the company has walked the tightrope between source code availability and securing its own interest in the product based on that code.

The license agreement it takes to download source code, however, contains clauses guaranteed to rankle some open-source advocates and security enthusiasts. For instance, part of the third section of the eight-section source code license reads: "You agree that you will not post any information about any bug, problem, deficiency, or weakness in the PGP software on any web site or electronic bulletin board, or otherwise disclose or provide any such information to anyone else, unless you have first reported it to PGP and until at least 30 days after PGP sends its email acknowledgement to you."

Another section carefully lists uses of the code which are explicitly prohibited, including a note that a downloader may not "give (meaning sell, loan, distribute, or transfer) the source code files to anyone else" (except under certain outlined circumstances). Further, those who download the source code may not "use executable code versions of PGP software programs created by compiling these source code files for any purpose or reason other than verifying that there are no unknown vulnerabilities or the like or otherwise making your own assessment of the integrity of the source code and the security features of the PGP software."

Somogyi draws a distinction here between the meaning of an End User License Agreement (EULA) and a source code license such as the one required to download the PGP source. The source code is there, he says, because "PGP [Corporation] is making it clear that we don't have anything to hide and that PGP remains a trusted brand, a trusted codebase."

With nothing more than a click-through license protecting it, there will almost certainly be rogue copies of the source code soon, but as Somogyi puts it, "the only place that anyone who cares about their security is going to get PGP is from us -- no one is going to use some randomly compiled version of PGP, because they don't know the provenance. It's all about trust, from our perspective."

Zimmermann, too, takes pains to note a distinction which sounds similar to one made by Microsoft in describing that company's "Shared Source" source code disclosure. "Publishing source code doesn't mean you've giving away the software -- if you think about it, John Grisham publishes his novels in source code form. Does that mean he's giving up his copyright in them? No. If Microsoft published the source code to Office, does that mean they wouldn't still want money for it? There's a difference between letting people look at your source code -- finding bugs, fixing problems -- and giving it away."

Reputation and Propriety. It's hard to say how much of PGP's reputation is really that of its creator.

Zimmerman's insistence on his right to create troublesome code, and on the freedom to encrypt which his software provided its users, endeared him to crypto-libertarians before most of the current battles of software freedom and philosophy had reached public consciousness.

Whereas Zimmermann famously left Network Associates, PGP Corporation seems much more interested in maintaining the integrity of Zimmermann's connection to PGP, which is if anything a tacit admission of Zimmermann's importance to the company's reputation.

"We would be foolish if we did not seek counsel from people who are the best in their fields," says Somogyi. "It's really important that Phil be involved." Zimmermann's presence on the technical advisory board from its inception will probably serve to reassure users worried about corporate machinations.

Should You Buy PGP from this man? When PGP was first released, it was cutting edge -- in the sphere of ordinary computer users, it was a runaway hit. Now there are alternatives to PGP; in the Free software world, these include notably the GNU Privacy Guard (GPG), a suite of tools which aims to be a user-friendly equivalent to PGP consisting entirely of Free software.

Neither Zimmermann nor PGP Corporation's Somogyi seems worried about Free software alternatives to their own products, which can after all still be used free of charge.

"There's still a freeware version of PGP, and there's still going to be a free version of PGP, including the version that's coming out, version 8," says Zimmermann, who actually points to GPG and several other products from his sales web page. "I applaud the creation of GPG, we need to have multiple sources for this kind of technology. But you know, PGP is a good product, I think that it's easier to use."

Somogyi echos this line of reasoning. "Fundamentally I think that the people who use PGP is one group, and the people who use GPG are another, and I don't see a heck of a lot of competition between the two efforts," he says.

Zimmermann says that the prospect of selling PGP, though -- and making money from it -- is key to its prospects for success. "Look at what happened last time when nobody paid for PGP. NAI pulled the plug on the product. From February of this year until August, PGP was in limbo. ... Remember the National Lampoon from 70s, 'Buy this magazine or we'll shoot this dog'? That's what happened. They shot the dog!"

"It takes money to pay the engineers, it takes money to do all this stuff. PGP is a big important product, it doesn't just happen for free." And when NAI dropped PGP development, the software "went into an intellectual property black hole. When a company pulls the plugs on a product, it just disappears. All this political posturing about saying that cryptography should be free, that's all very nice, but it doesn't pay the bills."

Comments

Good for Zimmermann

[BlueAlien.Org]

If he can get corporations and individuals to buy his product, then where is the harm? I wish him the best of luck on trying to profit from his creation. Of course, the license is very prohibitive, but I don't see that as being a major factor affecting sales.

- Rick

Re:Good for Zimmermann

[krog]

Good for him if he can pull it off, but GnuPG is free-as-in-your-mom. Who wants to pay for it?

Re:Good for Zimmermann

[Gemini]

On the other side of the coin, if everything is protected by PGP (email too), then the workers can't be snooped on, and who knows what those evil little ants could be doing!

PGP comes with corporate access features (the "ADK") so that the boss can always read employee messages. Needless to say, it's a controversial feature, but companies don't like the idea of an employee encrypting all their work and then, say, walking in front of a bus.

GnuPG ignores ADK packets, incidentally.

Re:Good for Zimmermann

[/dev/trash]

When the government makes free encryption illegal, then what will you do?

I can buy it but ....

[frovingslosh]

OK, I can now buy the software for personal use, but I can download the source for free (for review, yada yada yada). Anyone see a problem with this logic?

Re:I can buy it but ....

[Gemini]

They're relying on users to either Play Nice or not be technically inclined enough to compile their own copy. It's not that absurd, really. How many people actually compile their own PGP? (How many people *should* is another issue).

Re:I can buy it but ....

[BlueAlien.Org]

The vast majority of potential buyers of PGP will not want to fiddle around with the source code. This way Zimmermann's company can satisfy its core customer base along with the majority of geeks who like to mess around with the source code of a great piece of software. Its actually a pretty good idea IMO.

- Rick

Re:I can buy it but ....

[Night Goat]

They explain it in the article. The makers of PGP feel that some guy compiling the source code and making it available or using it himself isn't going to cut into their profits too much because most people interested in using cryptography aren't going to use some shady, homebrewed, perhaps compromised program, they're going to buy it straight from PGP so they can trust it.

Re:I can buy it but ....

[ergo98]

You can buy a copy of Windows at Best Buy, or you can download it from a warez channel, or you can go to a friends and rip an ISO of his copy. Doe sanyone see a problem with this logic?

Phil has always advocated that it is very important that there is peer review of security products, and I entirely agree with him on that point, but he is not An open source advocate (which is why I find the nitpicking about the license absurd: It's not GPLd, folks, it's peer review. The release of the source is only intended to allow for particularly paranoid folks to ensure that there aren't any backdoors in the code). They are two entirely different things, and it's completely reasonable for him to release those products as he has.

If someone builds the source and distributes the binary, they are no different from someone ripping an ISO and distributing warez.

Re:I can buy it but ....

[Rick the Red]

I didn't see any instructions on how to compile it (then again, I didn't download it, so maybe the instructions are included). I doubt you can compile it with gcc; if it requires Microsoft's Visual Studio it would be cheaper to just buy PGP!

So, any idea if/when we'll see a *nix version, with source code the customer can compile on Linux, *BSD, Solaris, HP-UX, AIX, etc. etc.?

Re:I can buy it but ....

[Rick the Red]

I've seen Moderators On Crack before, but whoever gave this a "+1 Informative" is just sick.

Re:I can buy it but ....

[mmol_6453]

While I applaud your distinction between peer review and open source, I have to ask: How do we know that a binary we're given, and some source code we're given, amount to the same product?

Take "main(){printf("Hello!\n")}" and "main(){printf("%s","Hello!\n")}"

While functionally identical, gcc will compile them into two very different binaries.

In short, there's no way to verify that the source code and the program are the same. Even if the two programs appear to respond to every interaction in the same manner, there's no way to know that there isn't a back door in the pre-compiled version.

And we're prohibited from using the provided source code for anything but verifying a lack of flaws. Legally, we can't buy the program and compile the accomanied source for personal use.

I'm not saying "Don't trust PGP." I'm just pointing out a flaw in their peer-review logic. If they allowed you to use the compiled source for personal use, then all would be well. (Aside from moral compunctions, of course.)

Re:I can buy it but ....

[ergo98]

I would back it up by pointing to the site, however right now it appears to be completely slashdotted. As such I'll have to say this without reference, but I'm pretty sure that the source code disclaimer list specifically mentions that it can be used to compile into a binary to compare with the binary that they give to ensure that there are no back doors, etc. If it's like prior versions, they'll give a specific list of versions of software (i.e. Visual Studio version XYZ) to compile it with, and truly the result will be a perfect clone of the distribution binary.

Re:I can buy it but ....

[Anonymous Coward]

Now -that's- some serious paranoia. How do you know the compiler you're using doesnt add some backdoors to your exe? Did you read through all the code of your compiler and then compile your compiler itself? Or maybe you wrote your own compiler? What if someone swapped out the compiler on your computer with a trojan'd version while you were on lunch-break!? Snakes! Snakes! All over me!

Re:I can buy it but ....

[Demonspawn]

Laugh if you want, but that actually happened (or I'm remembering some urban legand). Story goes that a certian someone added code a a login utility (Unix, Linux? I don't remember all the details unfortuantly) so that he could log into a machine with root privlages even if he didn't have an account on the machine. He then modified the compiler to recognize if it was compiling the login program to automatically re-inject the code into the program. He then also modified the compiler to recoginize if it was compiling the compiler and again re-inject the malacious code.

One hell of a hack job. I'd give a link, but a quick google of what I remember isn't turning up anything. Anyone else who remembers this throw a link (or prove this an urban legand)? I think it was some distro of Linux but I'm not 100% sure.

--Demonspawn

Re:I can buy it but ....

[Tassach]

In short, there's no way to verify that the source code and the program are the same.

Nonesense. You download the source and compile it in a build enviornment that matches the one used to produce the official executable.

If the MD5 and SHA1 checksums of the code you compiled locally matches those of the distributed version, you have a very high degree of confidance that the distributed executable was indeed compiled from the published source code. If they don't match, tampering is a possibility.

In order to do this successfully, you need two things that seem to be lacking in this case: the makefile used to compile the official executable, and all the pertinent details about the build enviornment (compiler version, versions of statically-linked libraries, and so forth). If you can't exactly duplicate the build enviornment, it's probable that there will be differences in the executable code even if it was compiled from the same source code.

Re:I can buy it but ....

[HP LoveJet]

The story is absolutely true, and the perpetrator was Ken Thompson, co-creator of Unix. You can read all about it here.

Re:I can buy it but ....

[J. Random Software]

The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.)

Ken Thompson, Reflections on Trusting Trust, 1984.

Re:I can buy it but ....

[shaitand]

The customer CANNOT compile it or they will be violating the license agreement, for *nix or anything else. The code is only provided so that government and military will be more willing to use it. And so that users can submit bug fixes.

Re:I can buy it but ....

[TheLink]

Actually, I've tried compiling PGP 6.5.x on Windows before, using Visual Studio. I did it more than once and the binaries were different each time - not just timestamp different. Significantly different.

I asked people in the newsgroups about it and someone said that the compilers optimize randomly. If that really was true I'm not surprised windows programs have bugs . You don't even get to see and specify the seed used for a compile. I seem to recall John Carmack making a related grumble about compiles on different machines - same source code, one worked and one didn't.

With GCC, repeated compiles = same binary. Just the way a security person would like it.

Re:I can buy it but ....

[Arkham]

Wrong!

Read the license agreement before making such assumptions. They let you compile it. You just can't use the binary you compiled for everyday use.

1. What You Can Do. Under this license, you have the right to:

1. download the PGP source code files and make a reasonable number of copies on a single computer as necessary to exercise the rights granted below;
2. review the source code in these source code files in order to verify that there are no unknown vulnerabilities or the like and in order to make your own assessment of the security features of PGP software;
3. compile the source code for each PGP software program into an executable code version of the program;
4. run the executable code version on one computer solely in order to assist in your testing and cryptographic analysis of the security features of the PGP software; and
5. modify the source code in the course of exercising the rights granted above.

Turnaround Time

[Steve B]

You agree that you will not post any information about any bug, problem, deficiency, or weakness in the PGP software on any web site or electronic bulletin board, or otherwise disclose or provide any such information to anyone else, unless you have first reported it to PGP and until at least 30 days after PGP sends its email acknowledgement to you.

I'd be more comfortable with this if there was an absolute cap that did not depend on the acknowledgement. As written, it would seem to allow PGP to freeze the clock indefinitely by simply not responding.

Re:Turnaround Time

[Cyclometh]

It's a good point, but they know as well as anyone that an unacknowldeged problem becomes an embarrassing public one when the problem is posted anonymously, which is what would happen if they "froze the clock" in the manner you speak of.

I'm willing to extend them the benefit of the doubt on this one... they'd be hurt more than most of the software producers by having a security bug go unacknowledged/unpatched. It's not like a license agreement is going to stop the spread of any vulnerability info at any rate.

Re:Turnaround Time

[dillon_rinker]

allow PGP to freeze the clock indefinitely by simply not responding
Precisely. And what happens if they go out of business? This is one of the key things that many otherwise well-intentioned source code license agreements fail to recognize: the software may outlast the the company that created it. It would likely be problematic even if some other corporation bought the PGP vendor. It is not uncommon for someone to buy the ASSETS of an insolvent corporation, but the obligation to respond to queries about source code could would logically be considered a LIABILITY.

Anyway, I think they had good intentions with this clause but they've paid too much attention to their lawyers. Perhaps, if the clause as written turns out to be a problem, (good) hackers could merely post "I have some interesting information about the product, but I am legally prevented from disclosing it by Section X, Paragraph Y of the source code licensing agreement. Please encourage the PGP vendor to acknowledge my emails"

Re:Turnaround Time

[dillon_rinker]

So if it's not their intention to stop time, why'd they write it into the agreement? Would you sign an agreement that allowed the other party to take possession of your house at any time and sell it? "Oh, we don't really intend to do that." OK, so why are you asking for it? And even if I trust you, if you get bought by someone else, guess what? THEY can sell my house.

I'm willing to believe that intentions are pure in this case, but the agreement needs to be edited slightly.

Re:Turnaround Time

[Steve B]

I really doubt thier intention with this is to "stop time" but rather simply offer no one an excuse out of it. "I sent you an email 31 days ago didn't ya get it?" will not cut it.

Fair enough -- if they don't respond in a reasonably timely manner, the license can't prevent that fact from getting out.

Re:Turnaround Time

[javatips]

You can actually BCC yourself.

That way, you can prove that you sent the message at some point in time (you have the header added by the SMTP server).

This can protect you to some extent. It would probably be better if you use a third party SMTP server to do it.

Note that will only prove that you sent the message, not that they received it.

Re:Turnaround Time

[Deagol]

Or better yet, use a timestamp server.

Re:Turnaround Time

[larry bagina]

after all, we all know how hard it is to fake an email header.

Re:Turnaround Time

[drinkypoo]

Precisely. And what happens if they go out of business?

I don't know if they're a corporation, but if they are then they will never go away. The corporation (And its assets and IP) will stay around forever and someone can then later purchase their assets (which will be only IP by then, and their name) and assume their liabilities.

Re:Turnaround Time

[cookiepus]

." OK, so why are you asking for it? And even if I trust you, if you get bought by someone else, guess what? THEY can sell my house.

Jesus, just don't download the source if it stresses you SO badly.

Re:Turnaround Time

[J. Random Software]

It's common to buy a bankrupt company's assets without acquiring the company as a whole and assuming their obligations. The buyer can issue new licenses to new customers, while the existing licensees are on their own--they have a contract with a corporation that's no longer doing business (though I'm not exactly sure how dissolution works).

Re:Turnaround Time

[evilviper]

And what happens if they go out of business? This is one of the key things that many otherwise well-intentioned source code license agreements fail to recognize: the software may outlast the the company that created it.

The truth is, no company gives a damn what happens after they go out of business. They will make a license that works best for them while they are in business, and if they do go out of business, why should they care what happens?

Re:Turnaround Time

[J. Random Software]

This problem, the market ought to be able to solve. We should care enough about what happens that we'll reject the license until they find some way not to leave us SOL.

Re:Turnaround Time

[Simon Garlick]

So wait your 30 days, then post details of the bug/exploit/hole/whatever to Usenet anonymously. No big deal.

Differences from previous releases?

[masonbrown]

OK, as a corporate user with a Win2k machine using Outlook, is there any significant reason to upgrade to 8.0 from whatever I'm using now and have used for a year or so? I know the article says there aren't significant changes, but I'd be interested in what specifically is better / improved.

Re:Differences from previous releases?

[ergo98]

The fact that PGP doesn't work in general in Office XP should be a pretty big bonus (actually I think it even had problems with Office 2000).

Re:Differences from previous releases?

[dzym]

I'd like to see PGP/MIME support for signatures, which shouldn't even be all that hard.

Unfortunately, they seem to have decided it's an Outlook issue rather than something they can implement.

Re:Differences from previous releases?

[rosewood]

How does it not or is it supposed to work? I can quickly encrypt .doc files but not inside word. Didnt know I was supposed to be able to. I can do clipboard encryption and since I can copy a whole word doc to the clipboard, then its not so bad I guess?

don't order it this morning...

[SweetAndSourJesus]

I plunked down my cash first thing this morning.

It looks like they're pretty swamped. The download failed, and, after the third try told me that the link had expired.

We are sorry that we are unable to complete your download at this time. This download link expires three weeks from purchase and after three downloads.

I guess this means I've got to call their customer service deptartment today. So, you may want to wait a bit before buying. The beta I've got for OS X doesn't expire until 12/06/2002, so I'm not totally screwed yet.

PGP must be good encryption.

[Kenja]

PGP must be good encryption. I've been trying to brute force decrypt the phrase "zimmermann" and I've had no luck at all so far.

Re:PGP must be good encryption.

[angst_ridden_hipster]

It decrypts literally to "room man," but means "carpenter."

RedHat too

[masonbrown]

Check out RedHat. You can download everything for free, even in ISO image format. Or you can go to Fry's and plunk down $50 for the exact same thing. This business model actually works. Not everyone wants to go get a compiler and compile the source from scratch.

Re:RedHat too

[Remik]

Not exactly.

The product at Fry's comes with support and documentation that is otherwise not included. It may be a highprice to pay for information which is otherwise available all over the net, but for some it is simply a matter of convenience.

-R

Re:RedHat too

[dillon_rinker]

A high price to pay? OK...start by putting a price on your time. Print the information that's otherwise available on the net. Now cut those pages to size and bind them together. The books that come with the $50 retail package are starting to look pretty inexpensive. =)

Re:RedHat too

[larry bagina]

This business model actually works.

No, this business model actually causes a negative cashflow

PGP is overrated

[Hairy_Potter]

so is GPG. If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls. Uncrackable files don't mean much when traffic analysis shows email to the Cali cartel and cyber-cafe's in Pakistan.

But, just like the NRA sorts, who cling to the illusion that their pre-ban AR-15 will protect them against the black helicopters, PGP users delude themselves into thinking they're making a heroic stand for freedom, when in reality, no one cares about their encrypted plans to sleep in line for the Two Towers premiere.

Re:PGP is overrated

[SweetAndSourJesus]

I can't remember where I read this analogy, but I'm pretty sure Zim came up with it:

You use envelopes, right? Why? Becuase you don't want everyone in the post office reading your mail. If you didn't care, you'd use postcards. Sure, the envelope isn't bulletproof, but it's enough to keep the casual snooper out. Same deal with PGP.

You're right, if the Man wants to read your email, he's going to do it. PGP isn't designed to be a totally secure system, just a mostly secure one.

Re:PGP is overrated

[WanderingGhost]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls. Uncrackable files don't mean much when traffic analysis shows email to the Cali cartel and cyber-cafe's in Pakistan.

And that's great. They'll get the terrorists they want, and nobody will know what I've been discussing with my fiancée, or with my friends, or whoever. And they'll not know what my company has been discussing with some other business out there. (Commercial secrets are still secrets)

Doesn't sount too bad after all.

You can still get evidence to take a criminal to court -- and that's good. But people won't read yout e-mails and know what you've been discussing (they won't know too much about your private life).

Not that tere aren't other problems, of couse, but then, there is always a problem... :-)

Re:PGP is overrated

[sharkey]

they'll surround you with Tempest vans

Tempest vans? Are they anything like Super Vans?

Re:PGP is overrated

[Jonny Ringo]

I can open an envelope - no prob.
But I can't crack PGP.
plus envlopes keeps multiple items niceley together.
Close but bad analogy.

Re:PGP is overrated

[SweetAndSourJesus]

Yes, you can crack PGP. It's completely unsafe to presume that it can't be done. You can't open an envelope without tampering with it, which is where PGP signatures come in.

I guess if you want to look at the utility aspects, PGP isn't designed to keep multiple items together, that's why we have tar.

Even if it is a bad analogy, isn't this a more reasonable viewpoint than the "fuck it, Uncle Sam's got us by the nuts, I give up" attitude espoused in the original post?

Re:PGP is overrated

[RealAlaskan]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls. ....

So, given that's true, why bother encrypting anything? Answer: if a lot of innocent traffic is encrypted, it significantly raises the effort level required to identify the non-innocent traffic, and thus makes it much less likely that the government WILL decide that it ``really wants to get you''.

Is that a good idea? Even after the events of the last year, government in general still seems to have the resources to be a greater threat to us than all the Islamic malcontents in the the world put together. Some of those governments definitely have the will to do us harm; after all, some of them are run by those same Islamic malcontents. Some of us are living under the power of those evil governments. PGP and its successors have been used by human rights groups operating in countries like Yugoslavia, to keep records secret.

Don't forget, also, that while a despot might tire of amusing himself by persecuting you, the bureaucrats who persecute decent folks in the western world are doing it for our own good, and their self-image as good people and hard workers depends on putting Dimitry in jail, or busting down the doors of prople who have violated a contract with their cable company by uncapping a modem, or what-not. The people who are probably the greatest threat to us in the US and Europe are these well-intentioned, honest, hardworking idiots, who honestly believe that they are protecting us all. Sometimes they ARE protecting us all, and sometimes they are doing quite the opposite, but they are always trying to earn their pay by doing their job, no matter how destructive that may be.

Overall, I think it is an excellent idea to make it as difficult as possible for the government to keep tabs on us, or to single us out, even when our government is NOT deliberately evil, as is the case in the US.

... PGP users delude themselves into thinking they're making a heroic stand for freedom, when in reality, no one cares about their encrypted plans to sleep in line for the Two Towers premiere.

It isn't just governments that have secrets. Most companies have marketing plans, customer lists, and so on that their competition would give big bucks to get. If only the sensitive email is sent encrypted, it's obvious which messages need to be cracked. It's also obvious when there is a flurry of sensitive activity. If you also encrypt your non-sensitive email at work, that eliminates that sort of problem.

Finally, personal, frivolous users of encryption ARE helping folks who have a serious need for it, at least indirectly. See my first paragraph. If they are deluded, well, that's good for the rest of us. We can't afford to have things reach the point that using PGP makes you a suspect. The world is full of folks who are eager to do bad things to good people, some of them with the very best of intentions for the very people they'd harm.

Re:PGP is overrated

[Jonny Ringo]

I never said it couldn't be done. I just said "I" couldn't crack PGP, but I can open an envelope. I beleave the majority of people are about like me when it comes to that situation. :-) I agree with you that it does keep things together which is nice as well.

Its a close analogy, maybe not entirely bad. And yes I do agree with you about the other post. Why would I worry about the gov listening to my phone converstations when all of the communciation I want kept private are done encrypted on the net. Its possible for a slip up, but I think it can be done.

Re:PGP is overrated

[dsplat]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls.

True enough. However, I don't want to publish my travel plans to too many people via unencrypted e-mail every time I send my family the flight number I'm coming in on. I've had my home burglerized once. I don't think anyone who has had that experience wants to go through it again.

PGP and GPG also provide signatures. In the semi-anonymous world of the web and open source, there's a lot to be said for signing your source code.

Re:PGP is overrated

[4of12]

They'll get the terrorists they want, and nobody will know what I've been discussing

Yeah, except that these days they'll profile you into the same category as those sending email to the Cali cartel and to Pakistani ISPs just because you're bothering to use PGP.

Feds: "Better look into this guy concealing traffic with PGP encryption! He's hiding something!"
.
.
(later)
.
Feds: "It's OK! After we installed our Scarfo-nabbing keyboard logger on his PC and glommed onto his passphrase we found out he was just describing an over-bed trapeze with his GF."

Islamic extremists will have effectively won their biggest victory when they get the U.S. to abandon precious rights and liberties for a society as repressive as anything the Taliban could dream up.

Re:PGP is overrated

[kalidasa]

It's called "Pretty Good Privacy" for a reason. It's not perfect, but it's good enough for most purposes.

Re:PGP is overrated

[LWATCDR]

Who cares about the man??? I do nothing that they would care about anyway.
What I do care about is that the owner of the company I work for let someone get the password for his email box. Someone has been reading his email. So on goes PGP and I just hope he does not give that password to someone.

Re:Broken?

[Wesley Felter]

Bugs have been found in previous versions of PGP. Hopefully the source code release will allow the bugs in PGP 8.0 to be found sooner rather than later.

Java

[Yoda2]

I sure hope the pending SDK has support for the latest version of Java. I have yet to get the latest version of Cryptix OpenPGP to work with the J2SE v 1.4.1.

Re:Java

[CynicTheHedgehog]

I ended up resorting to doing Runtime.exec( ) on gpg with all the batch and automatic "yes" flags enabled. Works pretty good, but the feedback is a little crummy (0 on success, != 0 on failure).

The source has been available

[ergo98]

The source code to PGP has been available for a long time from pgpi.com. Indeed, there is the freeware copy (it actually links you back to the main PGP page) of PGP 8.0 available there.

So it's just for Windows and Mac?

[Wee]

All I see are Windows and Mac versions on their download page. That's, um, mostly useless to a lot of folks (as in the kind of folks into crypto who are more likely to be running Linux or Solaris or *BSD than Joe eMachine is).

I fail to see how the PGP vs. GPG question isn't settled on this very point. PGP won't even run on many platforms, so any ease-of-use claims should be dimissed out of hand on that basis alone. The choice is really between GPG (which is being actively developed) and freeware PGP (which looks to be getting pretty old). That isn't much of a choice.

Go ahead and flame away...

-B

Re:So it's just for Windows and Mac?

[sulli]

Yeah, because so few people use Windows and Mac. The idiots! Surely they should have released first for OpenBSD!

Re:So it's just for Windows and Mac?

[J. Random Software]

Might want to rethink your examples. PGP has been ported to both the Amiga and the Atari. RSA, DH, and DSA take a lot of cycles but it's not as if the rest of the app is that complicated.

Re:So it's just for Windows and Mac?

[Wee]

That I did not see. I was only looking at the MIT site.

-B

Maybe they'll fix that annoying XP problem

[angst_ridden_hipster]

... PGP 7.0 had the annoying problem that the firewall / network filtering stuff it wanted to install would completely hose XP's network stack.

Oh, and if you ran the un-installer, trying to fix it, it would remove the TCP/IP stack from XP altogether (even though that's not supposed to be possible).

If you rolled back using the XP Configuration tool, it was all OK. If you tried to reinstall XP's TCP/IP stack alone, or repair it using the install disk, you got mightily screwed by the fact that XP doesn't do a proper TCP/IP reinstall, coupled with the fact that when you run this reinstall/repair, it blows away your ability to roll back to a good configuration.

OUCH...

Of course, if you installed it without the network stuff, it was OK, and just makes XP occasionally pop up messages saying that the SDK driver is unavailable.

Re:Maybe they'll fix that annoying XP problem

[angst_ridden_hipster]

*EVENTUALLY*, their web site made it clear.

Originally, though, it was just fine print in the README.

And who reads that kinda shit?

But that's when Google Groups comes to your aid!

Re:Maybe they'll fix that annoying XP problem

[Anonymous Coward]

jesus, you're complaining about something that they warned you about in the README? The file is fucking called 'READ ME'. You should try reading it, you lazy ass.

You're the reason people hate Americans.

I use envelopes because I pay bills

[Hairy_Potter]

and the utilities and credit card companies get pissed if you staple the check to the bill.

Christmas time and ebaying are about the only time of year I mail non-bill stuff.

Depends on how they implement it...

[Kjella]

If they have an automated reply-thingie that goes something like "Thank you for your mail. We'll be looking into it as soon as possible. Your reference no for this mail is #34524" and the 30 day limit starts there, I like it. If they can arbitrarily delay it or pretend they didn't get it, I don't.

Kjella

Re:Depends on how they implement it...

[HiThere]

The problem is, that they CAN do that. Even if they don't do that originally, a change in management can change a policy. So if they CAN delay responding indefinitely, then one must operate under the assumption that at some point they WILL.

This is the same reason that corporations are reluctant to become dependant on single-source providers. Once you become dependant on someone, even if you trust totally the people you originally dealt with, there can be a change.

So this part of the licens renders the program unuseable. The rest of it makes sense. I wouldn't do it that way, but I'm not trying to run a company around a product. But the "until we acknowledge" limitation is too big a lump to swallow.

Re:Broken?

[Bishop]

Yes. An easy to find example. I believe there was a weakness way back in the early 2.1 - 2.3 versions as well. PGP (USA version) was probably also vulnerable due to some of the RSAref.lib bugs. Source for PGP up to 5i is available.

PGP has been shown to be good secure code. Makeing the source available won't lessen the security. That is the point: peer review will strengthen the code. Phil Zimmerman knows what he is doing.

I can't believe OSS zealots are taking this...

[NineNine]

I'm CONSTANTLY reading about how MS's EULA are so terrible, yet this one prohibits what you can and cannot say about the product and *this* is acceptable? Talk about truly restricting free speech (I don't even know if this is legal). Anyone who buys this has got to be out of their fucking minds. I buy MS stuff (licenses and all), but I wouldn't touch this with a 10 foot pole.

Re:I can't believe OSS zealots are taking this...

[stratjakt]

This isn't even open source at all. It's just available source. You can't compile, use, alter, distribute or discuss it.

The only thing you can do is free bugsearching.

Quite frankly, most OSS zealots I've met wouldn't know what source code was if they saw it. It's just an anti-corporate buzzword they picked up at college.

Re:I can't believe OSS zealots are taking this...

[analog_line]

MS Licensces say that you can't review the software you are licensed to use without Microsoft's approval.

How's that any better?

Re:I can't believe OSS zealots are taking this...

[TeddyR]

They could require the webmaster or the forum moderator to take the comment out; or else they would face legal hassle.

Re:I can't believe OSS zealots are taking this...

[T-Ranger]

How so? Has the webmaster or forum moderator downloaded the source code and agreed to the license? Not necessaraly, and probabaly not at all.

Re:I can't believe OSS zealots are taking this...

[TeddyR]

Unofrtunately, they would fall under "knowingly contributing" once they are informed of the "license breach" if they dont take immediate action to take down the "offending/breaching" item...

blame the DMCA....

typo:

[Bishop]

That is Phil Zimmermann. My appologies.

Only can use source code to verify integrity?

[weave]

WTF? I can download the source code to audit, but I can't compile it for any other use than to verify it? This means I can't use the compiled source code in daily normal use?

Anyone else have a problem with this? OK, I download source code, verify it looks fine, but if I want to use the program, I need to buy/download the binary from them -- whose binaries may not necessarily be compiled from the source code I verified to my satisfaction.

(Thank god for GNU and gpg, no strings attached beyond that "nasty" "viral" (sarcasm) GPL)

p.s. I guess we won't be seeing THIS product as part of gentoo! :)

Re:Only can use source code to verify integrity?

[Kupek]

I don't think you read it correctly.

Further, those who download the source code may not "use executable code versions of PGP software programs created by compiling these source code files for any purpose or reason other than verifying that there are no unknown vulnerabilities or the like or otherwise making your own assessment of the integrity of the source code and the security features of the PGP software."

My interpretation of that is you can compile the source code, and you can use the executable generated from your compile, but only for evaluation means. You can't compile their code and then use that executable as your copy of PGP. But you can still use your compiled binary for verification.

Also, they never claimed this is GPLed code. What's with the animosity? I think this is a good thing - a for profit company showing all of their proprietary source code to their customers.

Re:Only can use source code to verify integrity?

[dillon_rinker]

So you download the software, you compile the source, and you do a bit-by-bit comparison. They're the same - you have now verified that the binaries are compiled from the source code you verified.

Or they're not the same - you now call and talk to their tech support and find out why they're trying to root you. You have your lawyer send them nastygrams. You do a write-up for slashdot about the experience.

Looks like a win-win scenario to me...

Re:Only can use source code to verify integrity?

[aridhol]

Erm...no.

Differences in the compiler used will cause small differences in the binary. Used a different optimization setting? Oops, the code is different.

What you can do is build the sources, and use that to verify the signature on the binaries.

Re:Only can use source code to verify integrity?

[weave]

What you can do is build the sources, and use that to verify the signature on the binaries.

But that still requires that you trust the person who built the binaries in the first place, since they'd be the one who also signs the binary.

I also seem to remember just compiling a simple DOS exe using the same compile settings always produced a different binary, although that might just be some sort of exe preamble or something.

My paranoia may be well unjustified, but what's the big deal about me compiling and then using my own binary rev?

Re:Only can use source code to verify integrity?

[Sloppy]

What's with the animosity?

Because they missed the whole point about why people wanted the source code: to be sure there aren't backdoors. If I send you a binary that that may contain a trojan, and then I also send you this source code:

10 print "hello world"

then you can be sure that the binary I sent you, is safe to use. Right?

Maybe the very idea of a backdoor in PGP is totally and groundlessly paranoid, but then think about who the product is marketed to.

It's not just encryption

[Gemini]

A lot of people have posted comments to the effect of "If they want to get at your secret email, they will anyway despite PGP". Don't forget that GnuPG/PGP has a huge other use as well. OpenPGP signatures are what protects a huge number of software packages from tampering.

The recent trojanings of OpenSSH, etc, would have been caught even earlier if users had checked the OpenPGP signature distributed along with the tarball.

Failing assumption...

[Kjella]

You use envelopes, right? Why? Becuase you don't want everyone in the post office reading your mail. If you didn't care, you'd use postcards.

Umm no. Not that I use letters much anymore, e-mail / IM / phone covers most of my informal contact need. When I send a letter in an envelope it's because:

• I'm sending something too long to fit on a postcard
  
• I'm attaching something (photos, birthday card)
  
• It's typed up on my computer, and my printer doesn't handle postcards well
  
• The reciever expects a letter (say a job application)

Granted, there are a few times when I want an envelope for privacy reasons. But that's far from the only reason.

Kjella

Re:GPG?

[entrylevel]

Competition by looking at your "competitor's" code and using what you've learned in your own product? I think the term you are looking for is "cooperation".

Re:There may be strings...

[Rick the Red]

I agree. For a company that's marketing proprietary code (and as much as you may support Open or Free software, only RMS would claim there's something morally wrong with selling proprietary software), they are being very open and above-board about this.

It's only reasonable for them to require 30 days to fix any bugs you might find, lest their customer's secrets be compromised in the meantime. Would you buy PGP if you knew any loopholes would be revealed before they could be closed, potentially exposing the secrets you're buying it to protect?

I wish Mr. Zimmerman success.

Student License

[rosewood]

You know - when PGP was owned by NAI I had no qualms just warezing it. I loved PGP disk and a few other PGP things. Just quick encryption of files was nice. A little tighter encorporation with Outlook and taking up less recourses would be very cool.

Now that its PGP not owned by NAI, I really want to own and use and promote this product. I however have no money as a college student. However, as a college student I think I would REALLY benefit from PGP. Not only keeping email between advisors and other students encrypted but also just keeping my personal records safe on the "wonderfully" secure campus network.

Anyhoo, just my thought trinkles.

Re:Student License

[rosewood]

I might have to do this as a tax write off or something cause I would really like to see my profesors and advisors talking to me via PGP encrypted IMs and emails.

I guess with trilian and ICQ I dont need encrypted IM since it does a secure connection.

Re:There may be strings...

[J. Random Software]

"At least 30 days after PGP sends its email acknowledgement" is a bit worrying, since they haven't committed to ever acknowledge reports of weaknesses that aren't "serious". I have great respect for Zimmerman, but any corporation is required to act in the interests of its shareholders....

Raising The Bar

[Steve B]

If the government really wants to get you, they'll surround you with Tempest vans, put a key sniffer in your keyboard, grab all your traffic through your ISP and monitor your phone calls.

The objective is not to create perfect security (which is, as you correctly say, not possible). The objective is to make your security good enough for most practical purposes.

Yes, the government can use various sorts of surveillance measures to get your messages anyway. However, requiring trained personnel to set up monitoring vans or do black-bag jobs limits the total number of surveillance targets. That makes wide-ranging fishing expeditions impractical, and inhibits abuse by bored or vindictive individuals. Also, it leaves a bigger trail (more memos, more people directly involved) to be traced if -- OK, when -- the government does break the law.

I contributed $50 to Phil's legal fund...

[e40]

back in the 90's. Does this mean I get a discount?

Anyone else think it's expensive? $80 for Windows for one year, or $165 for a perpetual license. Ouch!

Re:I contributed $50 to Phil's legal fund...

[Contact]

The "personal" edition is only $39, which is much more reasonable for personal use. I bought it online a few hours ago (for Mac OS X), downloaded and installed it flawlessly over the beta which I've been using for the past few weeks.

Re:Parent is overrated. Mod down please.

[J. Random Software]

A software key sniffer is more vulnerable. Hardware versions are widely rumored to be seeing field use. Hell, ThinkGeek sells one, though it's too big to conceal easily.

There's a more important use of PGP than privacy!

[aquarian]

To me, there's a more important, significant use of PGP than privacy. One of the biggest obstacles to *really* doing business over the internet is being able to verify where messages come from. PGP provides this. A PGP signed message is as good as a signed piece of paper.

I never cease to be amazed at how this aspect of PGP is never discussed. I guess all the stupid, nose-picking, trainspotting geeks all over the world really can't see beyond the government prying into their porn collections.

Re:One thing I've noticed:

[Junta]

The implication seems to be they just want a 30 day grace period. Does not seem to be unreasonable to me. After the 30 day grace period I guess it is open season. The only part that bothers me is that the terms seem to indicate that the 30 day period starts from their acknowledgement that you submitting a flaw, not from the time of acknowledgement. If they chose to not acknowledge responses in a timely manner, that could be a problematic loophole.

gpg can actuall help sell pgp

[kevin lyda]

we use (or advocate the use of) gpg to encrypt and auth sensitive data for our servers. this is not to protect the files from the gov't, it's to stop data with a high monetary value from being stolen. most of us at work at least have gpg configured.

we usually recommend pgp for less technical users - of which there are far more then on the server side. so pgp would get more sales from us due to gpg. i hope they sell lots of their s/w and make it even easier to use - it would really help us if less technical people were more exposed to pgp.

You could say the same thing about Windows.

[mmol_6453]

You could say the same thing about Windows. Granted, for the people who know of them, PGP Corp has a better reputation.

Re:You could say the same thing about Windows.

[shaitand]

I thought Hilter was just ballmer's predecessor, or at least just another M$ employee?? Can someone please verify this???

XP like activation

[bwalling]

From reading their site, it sounds like they are now using XP like product activation. You enter your license key, then it contacts their servers to validate your license.

Re:One thing I've noticed:

[TeddyR]

My question is:

Does it preclude the person from saying "I found a flaw in PGP" without saying what the flaw is. [maybe even only saying THAT 30 days after sending the initial message to PGP corp informing them of the details of the flaw]...

This may put a little pressure on PGP corp to fix the flaw.... And alert others that there may be a flaw that can be found with a little digging on their own so that they can also inform PGP corp thus adding more pressure....

GnuPG seems a better choice

[njdj]

I can't think of any reason to prefer PGP to GnuPG, and there are some reasons (already pointed out) for preferring GnuPG to PGP.

So, overall, I can't why anyone would use PGP.

Zimmerman made a great contribution, deserves tremendous credit for what he did, but as he says himself, it's all history.

Re:GnuPG seems a better choice

[Mitchell Mebane]

What about PGPDisk?

Re:Good for United States Residents: +1, Patriotic

[fsharp]

Hmmmm, lets see. I'm an American and if I want to I can say whatever I want to about the President. I can critique, disagree, agree, and even (gasp) not respect or support him.

Guess what dude, this comes under the heading of freedom of speech and last time I looked, the Constitution allowed me to just that. And does that make my unpatriotic? Not in my book, dissenting views ultimately created this Nation. Remember?

Oh, if you want to make a point, then do so with a reasoned and intelligent response. Why is dissention bad? How is speaking your mind in disagreement with leadership un-American? Because you said so? Hmmm.

PGP is underrated

[ChaosDiscord]

PGP is overrated... so is GPG. If the government really wants to get you [they will]

Well, duh. However, PGP might just protect my trade secrets from being intercepted by a competitor. PGP might also protect my medical information from a private detective trying to dig up some dirt on me for a bitter ex-spouse. Competitors and private detectives don't have the resources of the United States government and PGP works just fine against them. Furthermore, PGP has most certainly been successfully used to protect human rights workers from clumsy oppressive governments. If that's not a great accomplishment, I don't know what is.

Source available not as good as open source

[ChaosDiscord]

There's a difference between letting people look at your source code -- finding bugs, fixing problems -- and giving it away.

Great, I was looking for an opportunity to debug someone elses commercial software for free!

I applaud his efforts toward transparency, and restricted source is better than no source. But if I'm thinking of putting some effort into improving some software for me own use, it's an easy choice between GPG and PGP. With GPG, I know that my changes and the code that my changes are based on will be available to myself forever, and I can share my changes with others if the official source goes away.

Re:Source available not as good as open source

[Tassach]

Great, I was looking for an opportunity to debug someone elses commercial software for free!

It's called "peer review" and a long standing tradition in the academic world. It's also a matter of trust. By releasing the source, they are saying, "look, nothing up my sleeve". It's proof that they are not selling you a crippled product. It doesn't matter if you ever read the source, because someone will. There are plenty of people who have the desire and the ability to do so.

Re:One thing I've noticed:

[Sheetrock]

That was kind of my point. If you send them an e-mail or two and get absolutely nothing back, you can't publish -- therefore, you're subject to their whims.

This provision renders dubious the actual security benefits gained from open examination of the source code, and I'll explain why:

If the corporation is on the top of its game and follows up on each and every report, sending an acknowledgement whether or not they actually decide to fix the flaw, we'll have a situation not unlike GPG or other open source projects. Anyone who agrees to a set of restrictions can examine the code and point out flaws in addition to offering fixes.

On the other hand, if they fail to acknowledge some of the issues being submitted to them, then the situation may actually be worse than not having the source code available at all. People with less-than-pure interests can find the flaws in the program much more easily, however those who actually want to help the community (perhaps making a name for themselves as well in the process) can neither disclose the vulnerability nor offer a patch.

No doubt this policy has been introduced as an attempt to encourage bugfinders to use more community-friendly methods of disclosure. My only problem with it as a potential customer would be that it fails to take into account the possibility that the company could be less than perfect with dealing with bug reports... and thirty days of operating a product of this nature with a known flaw is bad enough. Isn't RFP's policy fair?

Re:Broken?

[Bishop]

There are no backdoors in PGP.

This is why we have certified mail and notaries

[Tassach]

For something important like this, where it's important to document when you sent someone a document, you have to use certified (snail) mail and have everything notarized.

Regardless of the wording of the click-through license, they would have a VERY hard time convincing a court that you were not acting in good faith if you can produce hard physical evidence that you did in fact notify them N days in advance of disclosing the bug publicly.

Re:There's a more important use of PGP than privac

[ragnar]

A PGP signed message is as good as a signed piece of paper

Possibly in the legal sense where you have the authority to take action, like billing the person or shipping a product, but not in terms of real authentication. Forging a signature (expecially one unfamiliar to you) is easy, but a PGP signed message requires knowledge of a passphrase. I have more trust in the PGP signed message.

(from a person whose mother "signed" a lot of notes to excuse him from days in high school)

Why businesses use PGP instead of GnuPG

[Nonesuch]

njdj writes:

I can't think of any reason to prefer PGP to GnuPG, and there are some reasons (already pointed out) for preferring GnuPG to PGP.

So, overall, I can't why anyone would use PGP.

You might not see any reason to prefer PGP to GnuPG, but there are many reasons why a business user my prefer to deploy PGP:

1. Technical support.
2. Well-designed GUI interfaces.
3. Directory integration with NDS, LDAP, AD, etc.
4. Key Escrow and additional decryption key (ADK) support.
5. Includes a non-intrusive and reliable MS-Outlook (not just OE) plugin.

Yes, I know the whole idea of key escrow and ADK are seen as horrible invasions of privacy by personal users, however, these features have a valid business purpose in a corporate enterprise deployment and are mandatory for certain types of business communication.

Re:Why businesses use PGP instead of GnuPG

[njdj]

there are many reasons why a business user my prefer to deploy PGP:

1. Technical support.

You can easily buy technical support for GnuPG and other open-source products. This is another advantage of open-source - support from a small independent company is usually better than support from a big company, even when it's the company that produced the software

Re:There's a more important use of PGP than privac

[ChrisJones]

For signatures to work, you need to trust the other persons key, that means both that it really is who it says it is (which requires a web of trust, which presents significant problems and scalability issues), plus the other person must be trusted to keep their private key safe and their password protected. That is hard enough on a single user machine, but becomes almost impossible if you want to send a message while you're mobile (e.g. an Internet cafe is right out).
The two are interlinked as well, if someone in your web of trust is not secure, by trusting their key to some degree, you are also potentially tainting the authenticity of other keys.
If OpenPGP were a more widely used standard, it would be nice to be able to get your keys signed by respectable authorities (i.e. the functional equivalent of SSL authorities). Many of the SSL key vendors also do personal certificates, but they aren't really in an especially useful form for PGP type stuff.

"Chained" encryption is uncrackable.

[Futurepower(R)]

If you encrypt a file, then scramble the bytes, then encrypt that result with another encryption method, there is no way to crack the result. "Cracking" depends on playing by the rules and using only a known encryption method. Cryptographers use mathematical methods to try to break encryption; these methods are not available when chaining is used.

To use the chain encryption method, you must secretly communicate the scramble-descramble method and encryption process to anyone who is allowed to decrypt the file, and the method and process must be kept secret. That's a big drawback in some cases, and not in others.

Zimmerman vs Stallman?

[technoCon]

Zimmerman sounds reasonable, but I'd dearly love to hear what RMS has to say about this.

I think that both Zimmerman and Stallman are Good Guys.

There's daylight between Zimmerman's source release and the GPL. I think Zimmerman's license intends to accomplish something different than the GPL. "There's no NSA backdoors in here." is different than "Here's the source, send back any improvements you find."

I think the GPL is more realistic in that it acknowledges that (healthy) software is not static. The proof of this conjecture will come when PGP and GPG have been out there for a few years and we see which one has more useful features and fewer bugs.

We'll see.

Ragnar

[charon_on_acheron]

I liked your pic on your Magic card. Johan was great too. **sniff** Those were the days.

I just paid my $39

[Simon Garlick]

For the use I've had out of freeware and compiled-from-source versions of PGP over the years, this is a no-brainer. PGP has been invaluable to me for a long time.

Come on PGP users, put your money where your privacy is!

A "chained" encryption method cannot be public.

[Futurepower(R)]

The "whole new algorithm" is just changing the byte scrambler. Scrambling the bytes in 512 byte chunks is very easy and fast, and there are a huge number of ways of doing this. Note that the scrambling method can depend on the 326th letter of the last email message received, or something like that.

If the chaining algorithm is compromised, the attacker must still attack the underlying encryption.

Also, your private key is stored somewhere. You can store the scrambling algorithm in the same place.

Note that chaining does not depend on encrypting the file twice. Just encrypting once and scrambling the bytes (and removing the file identifying bytes) is enough to harden an encrypted a file against mathematical attack.

The entire problem with scrambling is that it is not possible to distribute the scrambling method publicly. Public-key encryption allows distributing the public key. The scrambling method requires delivery in person, or by some other trusted manner.

eBusiness Server

[chiph]

FYI: Network Associates kept the rights to their eBusiness Server when they sold the rights to the desktop version of PGP to the new PGP Corporation. eBusiness Server is used by many corporations to automate their PGP encryption for batch processes, SOAP servers, etc.

Even when (If!) the Gnu GPG group decides to release a library/DLL version of their privacy tool, I suspect a fair number of companies will continue to use the NAI product in order to avoid having to deal with the Bureau of Industry and Security in the US Department of Commerce for exporting their own compiled encryption software.

Paranoia

[vadim_t]

That license doesn't make sense. Let's see:

1. You can use the binary they compiled.
2. You can compile the source, but not use it.
3. Source is provided to verify lack of backdoors.
4. That means that the source should produce the binary you get on their site.
5. Therefore, both binaries are identical so different use restrictions are nonsense.
7. Somebody mentioned here that while they provided information about the build environment attempts to get an identical binary weren't successful.
8. All this seems to indicate there's a quite strong possibility of PGP being backdoored.

Re:Paranoia

[MikeBabcock]

Producing the binary on their site would also require the same compiler they used (same revision of all headers too).

Great Article

[Anonymous Coward]

Since Timothy posted this, i'm going to assume that he wrote it, too. Thanks Timothy. This is possibly the best-written article I've found here in two years I've been reading Slashdot.

Here's to real tech journalism on the web. You covered the topic with the details that the Slashdot audience wants and polished it to a level of quality that is worthy of any self-respecting newspaper. If this kind of quality keeps up, I'll definately buy a subscription.

Be warned, editors who post shoddy articles here. This is the standard to which you should aspire. If you write well, you shall be rewarded.

Zimmerman Telegram

[Vryl]

Anyone notice this co-incidence before?

http://www.archives.gov/digital_classroom/lessons/ zimmermann_telegram/zimmermann_telegram.html

Re:Zimmerman Telegram

[Jim Efaw]

Anyone notice this co-incidence before? http://www.archives.gov/digital_classroom/lessons/ zimmermann_telegram/zimmermann_telegram.html

You're the first!

CORRECTION -- PGP works fine with MS Office

[Raetsel]

Dear Sir;

I regret to inform you that you have no idea what you are talking about. I am using PGP Freeware version 7.0.3 to communicate with family members. My parents use Office XP (with Outlook XP as their mail client) on Windows 2000, my in-laws use both Office 97 (Outlook 98) and Office 2000 (Outlook 2000) on Windows 98, and I use Office 2000 (yup, Outlook 2000 again) on Windows 2000. There have been no problems -- zero, zilch, none. Encrypting an email is a one-button affair; PGP adds a simple set of three buttons to the taskbar, one of which is "Encrypt Before Sending." Reading a message is as simple as opening it -- you get a dialog for your passphrase, and that's it.

To borrow a phrase, "It just works."

I will occasionally get a phone call to provide tech support for WordPerfect Office, but I have never had a complaint -- or even a question -- about PGP.

I am very curious about exactly what you were thinking when you started the FUD machine.

I have purchased PGP before. Now that NAI is out of the picture, I will do so again -- this ought to make a nice stocking-stuffer, burned onto 3-inch CDs.

Facts, please -- not anecdotes.

[Raetsel]

• "...the fact that PGP 7 does not properly integrate with the (sic) Outlook 2002 (Office XP)..."

Interesting choice of words ("properly integrate")... are you taking that to mean "works the way I fantasized it would" or "works the way it was designed to"? There's a difference. This "moron", as you are so quick to label me, managed to get PGP 7.0.3 working with Outlook XP without a hitch. That doesn't lend much weight to your assertion that it doesn't work. Denying the facts won't make them go away.

• "...in the case where I selected PGP and had it installed company wide, to find that it did not properly integrate with Outlook 2002..."

Am I supposed to assume you're some sort of IT wizard and not question your anecdotal assertions because of that statement? That's not going to happen. Further, you just admitted you're the moron. You deployed it, and then found problems. That's why people use test labs -- even for small businesses, test first, then deploy.

Since you were so insistent about it, I searched Google. In the first few pages of hits, I found several articles about PGP 8, some news about (now patched) possible security holes, and what appear to be several warez sites. Odd that I didn't find the numerous tales of woe that you did...

Now, about that Fear, Uncertainty, and Doubt bit... Masonbrown wrote:

• "...as a corporate user with a Win2k machine using Outlook, is there any significant reason to upgrade to 8.0 from whatever I'm using now..."

And you replied:

• "The fact that PGP doesn't work in general in Office XP should be a pretty big bonus (actually I think it even had problems with Office 2000). "

1. Your statement offers no supporting facts.
2. "...doesn't work in general..." is laughable in light of the ease with which I managed to install and use it.
3. If you read his post again, you'll notice he's successfully using a PGP version that is not 8.0.
4. Reading it, a user will be uncertain and doubt whether or not their current version of PGP will work -- perhaps spending money on an unnecessary upgrade.
5. Further, you're spreading the fear of "problems" with Office 2000. "Gee... I've been using it, God knows what has been going wrong behind my back..."

Congratulations, you've spread FUD.

I have demonstrated a working system. You claim it won't work, and call me a moron. You can't dispute the facts, so you attack the messenger. (That's step 2 in the FUD manual.) I suggest you RTFM, install the patches, and try again. (And no, I won't go away.)

Re:Parent post is overrated

[RealAlaskan]

Who can you trust? Who can carry out his intentions, good or bad? If the bad guys are powerless to harm you and the good guys quite likely to accidently screw you up, who do you watch out for? What does trust have to do with your answer?

I thought I said quite plainly that our government in the US has good intentions for us. They also have the ability to do us far more harm than Osama ever could. Partly that's because we trust our government, partly that's because our government is keeping a lid on Osama and company.

I don't think we should change that second reason: we definitely want our government to continue keeping after the terrorists. I do think that we should never trust our government blindly; not when they're doing us good, not when they're chasing terrorists, in fact, just plain never.

Think about this: if we were in Afganistan before the US invasion, the roles of Osama and the US government would have been reversed, more or less: the US would have seemed threatening but powerless, while the Osamites might have seemed less malevolent, since they professed good intentions, but immediately dangerous. The Afganis couldn't TRUST either, but they had to watch out for the Osamites.

Re:have you seen the price for a license?

[Simon Garlick]

Err, how about $39 for life? Did you actually READ anything at pgp.com?