Symantec To Acquire PGP and GuardianEdge

An anonymous reader noticed the news that Symantec has bought PGP and Guardian Edge for $370 million. They plan to standardize their encryption stuff on PGP keys.

Comments

suckitude

[SoupGuru]

Let the soul sucking begin!

Re:suckitude

[sopssa]

It means hold on to your current PGP versions.

I wont be trusting Symantec with it.

What are good open source alternatives?

Re:suckitude

[Virak]

GnuPG is what you're looking for.

Re:suckitude

[Em Emalb]

Not off-topic at all.

Symantec will more than likely manage to screw this up just like they screw everything else up. Seriously, once upon a time their virus stuff was good. Now, you've gotta jump through hoops to remove it, their enterprise-level customer service is garbage, so I can only imagine how bad their home user support must be, and at some point their code base for the AV stuff grew so bloated you could run a Toyota (poorly) off it.

What's wrong with pointing out that they're simply gonna screw it up?

Re:suckitude

[sexconker]

Symantec will more than likely manage to screw this up just like they screw everything else up. Seriously, once upon a time their virus stuff was good. Now, you've gotta jump through hoops to remove it...

Symantec has always made great virus stuff. That shit fucks up a system to no end, and is hell to cleanly remove.

Their anti-virus stuff on the other hand, has always been shit. It fucks up a system to no end, and is hell to cleanly remove, and doesn't do it's job.

Re:suckitude

[Lunix Nutcase]

Because you trusted it when it was in the hands of McAfee? LOL.

Re:suckitude

[icebraining]

It wasn't part of Mcafee since 2002: http://en.wikipedia.org/wiki/Pretty_Good_Privacy#Current_situation

Re:suckitude

[Em Emalb]

-1 funny...you win at the internet sir.

FWIW, I thought it was amusing. Like little kid amusing, you know, when your friends retarded brother eats a crayon or something.

Nah, I kid. Your comment was spot on. :)

Re:suckitude

[Amouth]

... and doesn't do it's job.

hey hey now.. that was uncalled for - last time i checked Symantec makes a lot of money off that crap, i'd say it is serving it's intended function quite well

Re:suckitude

[homer_ca]

Check out TrueCrypt for full disk encryption. Not many FDE vendors left after Symantec scoops up these two. FreeOTFE does volume encryption but no boot loader for FDE.

Of course, if you're not stuck on Windows many recent distros support installing on an encrypted root volume. The Ubuntu alternate install CD is one of them.

Re:suckitude

[sopssa]

TrueCrypt is great for hard drive or file encryption, but PGP does a lot more than that like email encryption, digital signatures, certificates and the "web of trust" feature.

Re:suckitude

[westlake]

GnuPG is what you're looking for.

Is GnuPG what you need when what you are looking for is a uniform GUI for the non-technical end user and enterprise deployment and management tools for your business?

Re:suckitude

[Anonymous Coward]

OSS alternatives?

If you want basic signing and not using smart cards, gpg is very good. Hard disk encryption, TrueCrypt is the utility for Windows.

But unfortunately, there are features that PGP has that you are not going to find in other places, and most have to deal with business/enterprise level requirements. Some examples:

Smart card support, especially on boot.
Ability to use smart cards to sign/decrypt PGP format files.
Whole disk encryption on the Mac. One can say FileVault is good for that, but there are laptop thieves more interested in what license keys a Mac has (so they can "borrow" them) than what is in someone's home directory.
Key servers.
Key recovery.
Enterprise infrastructure requirements. These don't matter to individuals, but the ability to recovery data using an ADK is crucial for regulatory compliance in some cases.
Hard disk encryption with multiple passphrases.

I'm sorry to say, but I hope Symantec treats their product lines well. It will suck if this is lost.

Re:suckitude

[Locklin]

It *is* uniform if you pick one of the available GUI's and standardize on it.

Re:suckitude

[Sorthum]

Nice to see that Symantec is continuing its tradition of buying terrific products solely to bloat them, screw them up, and effectively turn them into shit.

BackupExec, Norton Utilities, Brightmail... it's like they've got some kind of bizarre scatological alchemy going on.

I do hope that the whole disk encryption solution that PGP was offering for Mac and Linux will continue to be supported; IIRC Symantec tends not to focus overly much on non-Windows solutions.

Re:suckitude

[Anonymous Coward]

If you think Symantec is bad you should look at McAfee. McAfee is a pain in the ass to deal with. Symantec only to the extent they sell you more than you really need. Although even what you really need is the anti-malware/virus part and even that doesn't really work because the stuff you really need is actually a fix to the holes which can only be provided by Microsoft and a handful of other companies that provide the proprietary components people are using. Which leads us to what people really need is free software solution that can be streamlined into one package management and update system. Ohh that would be Ubuntu. haha I sell that. Now if I could only get more people to buy into it. Actually I'm doing a pretty decent job of selling it. What I'm lacking is the financials to keep the damm products in stock.

Re:suckitude

[Anonymous Coward]

I wont be trusting Symantec with it.

Yet you trusted Network Associates? No difference between the two companies.

Re:suckitude

[hairyfeet]

Yeah no crap, and not just their AV. Anybody remember when Norton Utilities was actually good? Man those were the days, we wouldn't hardly let a PC out of the shop until they had bought a copy of Norton Utilities. Hell Norton's Disc Doctor was light years better than anything MSFT had for Win9X! Then Symantec bought it and it went from a "must have" to a tool more likely to cause screw ups than to actually fix them. Norton, Partition Magic, man it seems like every decent tool Symantec gets their hands on turns to big piles o' poo.

Well to the guys that made PGP...it was nice knowing you, thanks for all the encryption. I hope your next business is as successful as your last, but hopefully not successful enough to get bought by Symantec. Oh and for those old timers that miss the AIO goodness of Norton Utilities I would recommend Tuneup Utilities. Great tool for keeping a Windows machine humming nicely. I use it myself as well as sell it to my customers and they couldn't be happier. Registry, broadband, startup, defrags, you name it, Tuneup will automate it. Gotta love their "turbo" button if you are a gamer, as it kills all unnecessary background tasks, turns off any themes, and generally kicks your game a little kick in the pants.

You can get a free key for last year's version here if you just want to give it a spin. I have a feeling once you try it you'll probably buy the latest version like I did, as like Norton before Symantec they get better every year. damned shame about PGP though, this old greybeard hates to see any decent company get swallowed by such a craptastic company.

Re:suckitude

[Anonymous Coward]

Symantec currently makes a great security solution. Instead of following religious dogma or popular opinion bashing you should do some research and fact checking for yourself. They did go through a pretty bad spot for a while so the criticism isn't unwarranted but it's no longer accurate. I always recommend people review their security solutions annually. Sometimes a good vendor can go through problems and not be the optimal solution through a given software version. Both Kaspersky and AVG have had serious problems as well.

Symantec, Kaspersky, AVG, MBAM and several other major vendors have pretty good support forums to help users. What is wrong with your point is that it relies on FUD to support it not facts.

Symantec provides local, intranet, and remote backup solutions. I would guess this acquisition is to support their products and provide their user base with a more secure solution.

I'm posting AC because I'm moderating and no I didn't mod you down even though your "informative" post isn't really all that informative or insightful.

Re:suckitude

[Anonymous Coward]

Symantec will more than likely manage to screw this up just like they screw everything else up.

Too bab, PGP Corp already did that. Big $ licensing fees and annual subscription renewals? Get lost.

You know the only time PGP is actually useful? When you and other people you know use it. Putting big $$$ in the way doesn't help this.

Re:suckitude

[Anonymous Coward]

I'd disagree here. Norton as a home product is one thing, but Symantec's enterprise offerings have been pretty good overall. Symantec Enterprise Protection is something I'd recommend to businesses. One of its biggest advantages is that it isn't yearly subscription based like the Norton line is, so come 366-367 days, a machine that has a copy of SEP still will be grabbing virus definitions and remaining up to date.

Of course, these days, I'd probably give a client a choice of A/V software. For home/SOHO work, MSE, Avast!, or AVG work well. For business/enterprise use, I'd probably go with Forefront, SEP, or a utility that suits a client's needs the best.

Re:suckitude

[Antiocheian]

It was the "Norton Utility" in its early days; NDD appeared later and it was great for DOS but didn't catch up with Windows early. Symantec did a good job with Ghost, you have to give them credit for that.

As for PGP, I don't have a problem with them buying the PGP company. Keeping in mind that GnuPG is the real deal, if "Symantec PGP" means more clueless people using good security that's more power to us since it weakens the "if you hide it then its not legal" argument and it also decreases the signal to noise ratio for cryptanalysts.

Re:suckitude

[X0563511]

GnuPG (gpg) is the underlying tools and libraries. As locklin states parralel to me, there are plenty of GUIs out there.

Have a look but realize that there are even more out there, these are just the hilights.

Re:suckitude

[ZERO1ZERO]

Any decent web-based GPG interfaces that can be 'pointed at a directory of files, and encrypt each one', like wise for decryption?

I coded the basics of one in PHP, but wondered if anyone had a decent implemented solution already?

Re:suckitude

[Kozar_The_Malignant]

I have no problem with GPG, and use it with Linux. I've also used PGP since the good old illegal days when it was all command line, and the Feds were still trying to put Phil in jail. The problem with GPG is that it's not going to really get traction until there is a one-shot binary install for Windows that integrates with common programs that people use. While we all know it isn't that tough to install the command line version and then a GUI front end, most users can't/won't do that.

Re:suckitude

[X0563511]

Not that I am aware of, but then I am no fan of web-based anything but web pages (so, I can't say I've looked for a solution like what you ask for).

Re:suckitude

[infinitelink]

Can you explain for me the brouhaha over PGP and about the Feds targetting this "Phil" character? Long or short, your choice, or even just a link. : )

Re:suckitude

[Kozar_The_Malignant]

Short version - Phil Zimmerman wrote PGP. PGP incorporated the RSA algorithm. This got the feds after him for violation of the Arms Export Control Act, because strong crypto was considered munitions. Sanity prevailed after about three years and a bunch of lawyers' bills. A slightly longer version is here in the Wikipedia article on PGP.

Re:suckitude

[infinitelink]

Thanks. : ) By the way, I feel obligated to do this: http://xkcd.com/504/

Re:suckitude

[lonecrow]

Any AV software worth anything is hard to remove BY VIRUSES. For humans its only as hard as visiting the vendors site and downloading the removal program.

Serioulsy I also used to get irate that I couldn't just click uninstall and have it vanish, but probably due to some underlying OS issues, that also makes it easy for the bad guys to remove it. Once you get used to downloading the removal tool it is very easy to remove Symantec, which is something I do on a regular basis.

Re:suckitude

[Anonymous Coward]

Really? and viruses made in the last year or two can't do exactly that?

Re:suckitude

[MoeDumb]

They're so sucky the man in the middle called and he wants his credibility back.

Re:suckitude

[fwarren]

Ran Corporate version 9, 10 and 11, then with 12 it all fell apart. The replication database should only grow to 5 gigs in size. But it keeps growing till there is no space on the servers hard drive. We had to literally uninstall it, reinstall it, configure it and run it for 3 months till the database filled a 200 gig hard drive. 3 times. After 9 months and a promised "fix" always soon to be released but never actually seeing the light of day, we switched to Kaspersky.

Re:suckitude

[kiwimate]

I do not trust Symantec on enterprise anything since the days I was working with their Storage Foundation.

Bad trick #1
Go to the training course, where the instructor is bragging how he helped write the product. Observe that occasionally during the training course the software happens to lose sight of your volumes. Ask instructor, "how do I fix this?". Received response, "hmm...format and start again. I don't know how to fix that." If this is a production environment, I've just lost terabytes of critical information.

Bad trick #2
Have this up and running in a production environment. Have it go ballistic and take your file system down. Call technical support. Take several hours to fix it.

Bad trick #2 - follow-up
After you've had this happen a few times, write a letter to Symantec management complaining that you really need to have better than this kind of reliability in a product for which the entire reason of its existence is to provide mission-critical data with superior redundancy and protection in an enterprise. Receive a whining response back that "this kind of thing is really hard to do, you have to expect the occasional problem with it".

I know it's hard to do, which is why my company pays lots of money to you on the premise you're selling an enterprise level product. And no, I do not have to expect the occasional problem with it; I expect this level of product to perform the way it's supposed to.

My learning from this: I do not trust Symantec for any of their products. Based on my company's experience, they can't do enterprise products properly, thereby placing our data at more risk, not less, and think this is acceptable. Bad.

Re:suckitude

[RockDoctor]

Let me guess - you're under 25 AND you've only recently discovered that there is technical stuff going on behind the screen of your computer?

You've got your link to the story. While I wasn't particularly bothered one way or another about mail encryption, I did see the potential and understand it both for personal use, and for encrypting client's data while moving it around (as opposed to couriering it with a trusted person, which was the norm for us, then). But could I find a copy of PGP? Could I fsck! (Obviously I couldn't get it off the web, because at the time I had neither email, an ISP, or even a telephone line.) Not until I happened to go to do some work in the Netherlands did I manage to get hold of a copy to fiddle with. And then, to bring it back into the country I decided to bury it on an un-labelled floppy in a box of others, all used, all carrying pretty random zip files.

Imagine, if you will, having to physically travel to another country before you can get software that you need, and which the author wishes to give to you.

Joke from the time : never under estimate the bandwidth of a jumbo jet full of floppy discs!
(Second person's counter-punch line : but they're all AOL floppies!)

[grumble]Kids today![grumble] don't know they're born [grumble, fart] Gerrroff my lawn.

Re:suckitude

[infinitelink]

Er...actually I just wanted to know about the case and outcome. As for "behind the screen", I'm well aware: a friend, my last room mate, is a computer science major; I keep track with the trends myself, and I'm studying math (though my major is bio) for its elegance and utility--and would love to dive back back into programming (and that coupled with a growing and working knowledge of computing machines' innards: in my mind it's not even right to just call them "computers", which is what a number cruncher [person] is), which I loved: pressuring the brain to solve problems big and small, concoct algorithms, and watch it all come to life. I got sick so I had to quit! (And by the time they were done with me, my brain was quite fried.)

I'm also not against exporting encryption or such things as it's a good idea for international stances, the well being of the country in which I live and reside, and I appreciate that it permits such programmers from across oceans, continents, and borders, to more freely collaborate; the one up-side to encryption export restrictions might have been parallel development of different approaches, which results I know not of, but hope there were.

Not bad

[Mikkeles]

It's Pretty Good Proprietory!

Re:Not bad

[Seakip18]

But, according to my bosses, that proprietary stuff is better! It has support contracts and since we buy the license, that must mean it's good.

It's not like Opensource stuff comes close, right?

Well, that is true for Outlook email client interfacing, which is a crapshoot anyways. The rest OpenSource handles quite well.

Re:Not bad

[Lunix Nutcase]

The rest OpenSource handles quite well.

Which is why professional graphic design have all dumped Photoshop for Duh GIMP? And all those people who work in professional video arena have dumped all their proprietary tools for KDenlive?

Re:Not bad

[CastrTroy]

Here's where we get into the point of "professional tool" vs. "something I install on my home PC". For professional people, the cost of software like Photoshop, VS.Net, Final Cut Pro, and others is almost completely insignificant. Compared to all the other costs of doing business, it's almost crazy not to pay for it. However for the home user, or hobbyist, these products seem completely out of range with what you get out of them. When you pay $300 for a computer, even $50 on a windows license, or $50 for a word processor seems like a lot of money. That's why in a lot of cases you'll see the companies offering cut down versions for much cheaper, or even free, which will get the job done. Keep the mindshare, and still get professionals to pay for the full product.

Re:Not bad

[fph il quozientatore]

Where's the "sad but true" moderator category when you need it?

Re:Not bad

[Seakip18]

I was specifically talking about PGP vs. GPG.

Re:Not bad

[Lunix Nutcase]

Here's where we get into the point of "professional tool" vs. "something I install on my home PC".

The GP was talking about software for his job. So no, your point has nothing to do with the topic.

For professional people, the cost of software like Photoshop, VS.Net, Final Cut Pro, and others is almost completely insignificant. Compared to all the other costs of doing business, it's almost crazy not to pay for it. However for the home user, or hobbyist, these products seem completely out of range with what you get out of them.

That's why home users buy Photoshop Elements and they will download Visual Studio Express.

Re:Not bad

[phantomcircuit]

You shouldn't be using PGP for email encryption anyways. S/MIME is built into almost all modern email clients. The real reason that email encryption has not caught on is that it is basically impossible to implement it in webmail clients. (although signing is still possible).

Re:Not bad

[JWSmythe]

    You know, I've seen a lot of that in the corporate world. That's why folks have gone with RHEL rather than Fedora. They get to pay for something, so they feel better about it.

    Of course, Microsoft servers are that much better, in that they can pay more for them. :)

    Way back in the day, one boss was interested in going to Linux, but he couldn't find anything that satisfied his needs to pay for it. That was primarily a BSDi shop, but it switched over to Windows because we could pay. Even under BSDi, they had paid for licenses, but didn't want to pay to upgrade to current, so we had quite a few problems, including getting network and SCSI card drivers that worked. It became a quest to find new hardware that was still supported by the older version.

  It was a hosting company, and it broke anyone's sites with CGI's on them, so they grudgingly allowed customers to request to be moved back over to the *nix platform machines.

    {sigh} I hate it when the misguided interests of the bosses are in conflict with the customers. Needless to say quite a few customers jumped ship when their sites broke and the migration path back to a *nix platform was very slow and manual.

    Another place I was at was bent on support contracts. They refused to believe that a free version of Linux could run their custom software. They still refused to believe it when I demonstrated on my Slackware workstation. When I asked how many times they had requested support, they admitted it had never happened. It's not a matter of *using* the contract, it's a matter that it's there to make them feel warm and fuzzy.

Re:Not bad

[Seakip18]

True, as I was looking at S/MIME with openSSL. That implementation would be quite clean, with the right certificates.

Turns out they wanted more than S/MIME and GPG/PGP was the next tool on the list to look at.

Also true about the webmail client. I have a firefox addon that'll do both sign and encryption for gmail, but never really have a use for it.

Re:Not bad

[K. S. Kyosuke]

Which is why professional graphic design have all dumped Photoshop for Duh GIMP? And all those people who work in professional video arena have dumped all their proprietary tools for KDenlive?

GIMP started as a toy project. It's much better now, but would certainly profit from a major redesign (and I'm *not* talking about UI here). As far as video editing is concerned, what about Lightworks? :)

Re:Not bad

[Anonymous Coward]

Reading comprehension. You need to learn it. You just regurgitated CastrTroy's point.

Re:Not bad

[mlts]

If I want top notch security and not trusting some firm (possibly a CA that is offshore and is hostile to anything the country I reside in anyway), I will be using a PGP/gpg web of trust. I will either get a copy of the public key of someone face to face printed physically with a fingerprint (and will download and verify the public key and has from a keyserver), or I will agree on a passphrase that is used only once, and that is to send and receive a copy of the public key.

I also don't like keeping my public key that would be needed for S/MIME on an online machine. My secure private key resides on a machine that isn't Internet connected, it will reside on a smart card, or it will be on a smart card and used on an offline machine, so an attack would have to be done on a physical/local level in order to compromise my private key material. I do use S/MIME and a client key, but that is mainly a stopgap, better than nothing measure, compared to actual end to end manual encryption of data with gpg or PGP.

PGP WOTs were in use a lot in the early to mid 1990s by cypherpunks, but for the most part, convenience won over security and it is extremely rare for someone to use a public key of someone to send mail. A good WOT is far better than a CA. I have more trust in a public key claimed to be someone that is 3-4 links out from me on my PGP/gpg keyring than I do a key that is signed by a CA and told "hey, trust us." Of course, creating a WOT is a lot harder than just letting a CA do the work, but like Phil Zimmermann said, it is better to pack your own parachute when security is critical.

Another use for PGP over S/MIME is signing of files. A signed E-mail is difficult to forward and keep the integrity intact. However, if I have a file and a PGP/gpg signature of it (or just a PGP signed file), I can forward it, archive the two files, back them up to whatever backup media, and all it takes is a validation in the future to ensure that the file and the signature were not tampered with, assuming I have the public key in my keyring, and that hasn't been tampered with. Of course, I can use facilities like the file signing capabilities built into Acrobat, Word, or other software, but again, I have to use a third party CA, or pay for a special signing key, as opposed to a secure WOT. Plus, some files (archives and such) can't be signed internally, so having a separate .sig file is needed.

S/MIME is decent, built into most dedicated E-mail clients, and is better than nothing. However, if you want reliable E-mail security, you are best off using a PGP/gpg WOT.

Re:Not bad

[phantomcircuit]

Maybe you should look up what a signature is...

Re:Not bad

[phantomcircuit]

I just want a nice lock icon in clients inboxes. It makes them feel all warm and fuzzy. :P

Re:Not bad

[Sorthum]

Actually, CentOS is the free version of RHEL; Fedora has an 18 month lifecycle.

You'd have to be some kind of masochist to deploy that as a server to an environment of more than a few servers.

Re:Not bad

[aztracker1]

There are a few OpenSource email clients that do a decent job. Evolution works as well as Outlook, and Thunderbird + Lightning trumps Live/Windows Mail. Where OpenSource falters, is they don't have a solution that works better, or equal to Exchange and costs less. There are open-source Exchange-like servers, but are generally hindered in some way for the open-source version, or require a closed-source plugin to be really effective with Outlook, and/or other exchange clients. Usually this licensing winds up being more costly than even hosted Exchange solutions, while providing lower service levels.

Re:Not bad

[Anonymous Coward]

my point was that you should look up encryption......

Re:Not bad

[X0563511]

Start reading.

You apparently have a very minimal understanding of what SSL/TLS actually are.

Re:Not bad

[X0563511]

Or an idiot.

I've got to pull/clean lots of Fedora-Core 7 (or older) dedicated servers because of inept customers.

Re:Not bad

[Anonymous Coward]

Believe it or not, I've had people go into panic when they saw the red ribbon in Outlook when I signed E-mails, thinking it is a virus or Trojan horse.

Just make sure the client understands that the icon is a good thing, so you don't have their IT department or legal team calling you up demanding what you sent them... even though they will commiserate with you how stupid people are once they find what the issue was.

Re:Not bad

[muckracer]

> Evolution works as well as Outlook

Not on clustered Exchange it doesn't! Tried it with the mapi plugin...no good.

But as far as GPG is concerned, it's well done. Integrated nicely as it should be.

Re:Not bad

[JWSmythe]

    Off the record, once they deployed, they stayed like that forever. No patches, no upgrades, nothing. The party line was "It works this way, and has worked this way, we'll keep doing it this way." That was regardless of the fact that machines got exploited. If it didn't come in on the install CD, they didn't want it. Some days I'd just sit down and cry.

Re:Not bad

[ToasterMonkey]

Arg... this is so painful to read. What is with the mods? +1 Long post?

If I want top notch security and not trusting some firm (possibly a CA that is offshore and is hostile to anything the country I reside in anyway), I will be using a PGP/gpg web of trust.

I'm not a big defender of the big CAs, but trust chains serve a purpose. In a WOT, who first decides that someone really is associated with a given name, and why on Earth do you trust _them_? Sure, you will all be talking to the same person, but who is that? The point of the chain model is that at least someone is responsible for verifying a certificate holder's identity in some minimal way. To what length they go depends on what the next link in the chain of trust requires.. MS, Apple, Firefox, etc, then you trust them, and so on.

I will either get a copy of the public key of someone face to face printed physically with a fingerprint (and will download and verify the public key and has from a keyserver),

An in person key exchange is the best you could possibly do, and does away with the other complex trust models. This is what the financial industry mostly does, a bunch of P2P symmetric key exchanges. You do have to change keys now and then (you do right?) so P2P gets very expensive. This is why your debit cards have different processor logos on them, because each bank only talks to a couple big processors, and not every other bank in the world. There is no need to use a public keyserver (why would you trust _that_?) if you meet the message recipient in person...

or I will agree on a passphrase that is used only once, and that is to send and receive a copy of the public key.

Uh.. why a passphrase? You were only going to give the passphrase over a secure channel or in person right? Then you'd only need to send the key. Try to think all that through..

I also don't like keeping my public key that would be needed for S/MIME on an online machine.

Im not going to explain PKI here. Just wow.

My secure private key resides on a machine that isn't Internet connected, it will reside on a smart card, or it will be on a smart card and used on an offline machine, so an attack would have to be done on a physical/local level in order to compromise my private key material.

Good. At least you understand the important half of PKI I guess..

I do use S/MIME and a client key, but that is mainly a stopgap, better than nothing measure, compared to actual end to end manual encryption of data with gpg or PGP.

Just wow.

PGP WOTs were in use a lot in the early to mid 1990s by cypherpunks, but for the most part, convenience won over security and it is extremely rare for someone to use a public key of someone to send mail.

Yah...?

A good WOT is far better than a CA. I have more trust in a public key claimed to be someone that is 3-4 links out from me on my PGP/gpg keyring than I do a key that is signed by a CA and told "hey, trust us." Of course, creating a WOT is a lot harder than just letting a CA do the work, but like Phil Zimmermann said, it is better to pack your own parachute when security is critical.

Look, I'm not going to hawk webs, chains or direct or whatever trust schemes.. the only thing that matters is how keys are exchanged, and why you trust them. Just because a CA makes money, that doesn't make the chain model wrong..

Another use for PGP over S/MIME is signing of files. A signed E-mail is difficult to forward and keep the integrity intact. However, if I have a file and a PGP/gpg signature of it (or just a PGP signed file), I can forward it, archive the two files, back them up to whatever backup media, and all it takes is a validation in the future to ensure that the file and the signature were not tampered with

Re:Not bad

[Tekfactory]

Ahem, just to clarify what you mean by lifecycle.

Fedora has a 6 month release cycle, CentOS has an 18 month release cylce. This is how often they come up with a new version.

Fedora provides updates for the last 3 versions so 18 month supported updates.

CentOS provides updates for 5-7 years same as RHEL.

Smart move

[Enderandrew]

This is a smart move on their part, but I just have a really bad feeling about this.

I have zero trust when it comes to Symantec.

Scary

[desertjedi85]

Having my data encryption in Symantec's hands makes me feel extremely safe..... NOT!!!

Re:Scary

[dgatwood]

Just another enterprise company that Symantec will acquire, make a half-hearted attempt to integrate it into their company, then systematically lay off all the workers, outsource product development to India, release a nearly completely nonfunctional successor to it, and eventually cancel it outright after the support contract revenue dries up. I've seen this worthless company pull this stunt too many times to expect anything different.

Note to CEOs: getting acquired by Symantec is corporate suicide. If you care at all about your employees or your product, the correct answer is not "no", but rather "hell f**king no". Just saying.

Re:Scary

[Anonymous Coward]

Ye but on that note, the CEO Dunk I'm sure is sitting pretty with what that SOB got out the deal.
Nice move dude, sell your soul why dont you...oh too late.

Pretty Bloated Privacy

[Fraggy_the_undead]

oh great, just what everyone was waiting for.

Open Source Alternative

[Anonymous Coward]

GPG is out there { http://www.gnupg.org/ } and we should use it.

Privacy is a human right. Democracy can't work if it's citizens are controlled like slaves in the roman empire.

Freedom is ours to take! Long live the RPG!

Re:Open Source Alternative

[wealthychef]

Freedom is ours to take! Long live the RPG!

Rocket propelled grenades?

Re:Open Source Alternative

[Anonymous Coward]

We live in a democracy ???? What country are you in?

Re:Open Source Alternative

[jack2000]

And the sniper rifle. I've always been a stay out of harms way type of player:)

Re:Open Source Alternative

[Chris Mattern]

"...that among these are life, liberty, and the pursuit of BOOM HEADSHOT!"

Re:Open Source Alternative

[JWSmythe]

    Ya, that doesn't quite make sense. An RPG survives until it hits the target. While I like explosions as much as any pyromaniac, they aren't designed to be long lived items unless you never use them. What fun is a box full of RPGs when you don't use it?

Re:Open Source Alternative

[SCPRedMage]

+1 Frag

Re:Open Source Alternative

[Explodicle]

We live in a democracy ???? What country are you in?

Slashdot.

Be a patriot! Mod this comment up!

Re:Open Source Alternative

[Anonymous Coward]

Fucking campers.

Re:Open Source Alternative

[steelfood]

I think he meant Final Fantasy.

Long live Final Fantasy indeed.

Re:Open Source Alternative

[Linker3000]

Long live ROT13!

Re:Open Source Alternative

[CelticWhisper]

Bah, Shin Megami Tensei is so much better.

Re:Open Source Alternative

[BJ_Covert_Action]

As most of the powers in WWII figured out, the most efficient means of getting rid of a pesky sniper involves an excessive use of explosive directed in the general direction of the sniper. That said, those RPGs can come in very handy. ;)

Re:Open Source Alternative

[Terrasque]

Sniper's a good job, mate!

http://www.youtube.com/watch?v=3PrHKs2c0ZQ

Re:Open Source Alternative

[fat_mike]

$350 millions makes a lot of morals go out the window. If I made/controlled GPG and a company came to me and said $350 million, I'd say "Where do I sign?".

Re:Open Source Alternative

[jonadab]

Among computer geeks, RPG usually stands for Richard P. Gabriel. Not sure what he has to do with PGP, though.

in 3 years from now

[Anonymous Coward]

You can get a PGP key AND free 60 day trial of Norton 2013!

I his shocked.

[MyLongNickName]

I his shocked at this development.... so shocked, I stole the summary's "h".

Re:Pretty *Bogus* Privacy

[denis-The-menace]

You can just bet there will be backdoors for the NSA/CIA/FBI/etc in no time.

Re:Pretty *Bogus* Privacy

[calmofthestorm]

>> You can just bet there are already backdoors for the NSA/CIA/FBI/etc.

Fixed that for you.

Re:Pretty *Bogus* Privacy

[TheLink]

Some years ago PGP was bought by Network Associates Inc (which was a merger of McAfee + Network General).

McAfee, Symantec? Meh...

I don't trust Symantec

[Anonymous Coward]

This really sucks. In dial-up days, I used a cool, lightweight firewall application published by WRQ called AtGuard. Symantec licensed the product and incorporated it into their own software; the stand-alone product known as AtGuard then disappeared from the market. I used to use Partition Magic. Again, Symantec bought it and it exists no more.

With that little bit of sample history, I'm sure we can bid PGP farewell.

Re:I don't trust Symantec

[GPLHost-Thomas]

I fully agree with the above, same experience here.

Partition Magic code is also seen in Parted (and it's Gnome companion GParted that uses it), so we have a (free as free speech) alternative. However I'm not sure there's a windows equivalent, who cares when you can boot on the standalone GParted live CD.

The pain with ATGuard was more painful. It was a really good small piece of software, easy to use but with all what a decent firewall should contain (that is: a real table with rules order like in Linux, and not just a random rule list like in the stupid new product Symantec did).

As for PGP, who will care, since there's a very good free core library alternative (gnupg) and so many graphical interface in both Linux and windows? What we really need to care about now, is a free implementation of libzrtp available in all distros and windows (and to mobile phones too), so we can encrypt our phone calls. THAT is the important feature that is currently missing from the Desktop, especially if you consider that wire-tapping from governments is a fact almost everywhere in this big brother world.

Re:I don't trust Symantec

[Anonymous Coward]

So, in other words, Symantec is the anti-Midas of the software world?

Good news for GnuPG!

[Anonymous Coward]

You should all be using gpg =)

Lol

[Anonymous Coward]

PGP was bloatware before. Now that the most talented producer of bloatware in the world (Symantec) bought it, the PGP software will might soon win the bloatware of the year award.

Re:Lol

[CondeZer0]

> PGP was bloatware before. Now that the most talented producer of bloatware in the world (Symantec) bought it, the PGP software will might soon win the bloatware of the year award.

If Adobe bought Symantec I suspect the massive concentration of bloat would cause the creation of a super massive black hole that would eat instantaneously eat up the whole solar system.

Re:Lol

[CannonballHead]

eat instantaneously eat up the whole solar system

Wow, so it eats it twice :-o

Re:Lol

[someSnarkyBastard]

I think this just drives home how much suckage there will be if that were to ever come to pass.

Re:Lol

[Anonymous Coward]

Bloat by definition is low density. I don't think we have anything to worry about with regards to black holes.

Re:Lol

[Anonymous Coward]

If Adobe bought Symantec I suspect the massive concentration of bloat would cause the creation of a super massive black hole that would eat instantaneously eat up the whole solar system.

Not quite the whole solar system, you'd need to add SAP to the mix for that.

Re:Lol

[Anonymous Coward]

I think that blackhole combination would take out the galaxy...

Re:Lol

[silanea]

Only if done in a consortium along with T-Systems, Motorola and EADS.

Re:Lol

[steelfood]

I suspect the LHC operators would be very disappointed if this were to happen before they could get it to run at full power.

Re:Lol

[CondeZer0]

If you added SAP and Oracle, it would eat up the whole galaxy.

Re:Lol

[Anonymous Coward]

And vanish in a... ...Flash? ;-)

Re:Lol

[ksd1337]

Pfft. Emacs can already do that.

Re:Lol

[Anonymous Coward]

How else do you think it gets so bloated?

Oh. My. God.

[BenEnglishAtHome]

I work for a giant TLA. Our AV is Symantec. Our removable media and whole-disk encryption products are in mid-migration to all-GERS (from a combination of GERS and WinMagic).

We're headed straight to hell, aren't we?

What is this, aquire and merger week?

[frambris]

Everybody seems to buy eachother this week. By the end of the year the Internet is run by three companies: MicroApple (software), HP (hardware) and Ciscoogle (Internet)

Re:What is this, aquire and merger week?

[bipbop]

What do you mean? MicroApple has always been at war with Oceania!

Re:What is this, aquire and merger week?

[Anonymous Coward]

GoopleSoft.

Re:What is this, aquire and merger week?

[jonadab]

Actually, I heard Microsoft and HP were looking to merge with McDonald's, and that Apple was going to merge with Pepsico (which owns, among other things, Taco Bell and Pizza Hut), and then Google will acquire the parent company of Nabisco and Kraft Foods. They're going to set things up so that which electronics you own, and which data plan you subscribe to, also determines what food you can buy. So for example if you want to be able to buy both Big Macs and Lunchables, you'll need to own an iPhone and an Android phone, and carry them both around with you everywhere.

Also, I heard Obama was going to run for office in the EU when his terms are up in the US.

Re:Pretty *Bogus* Privacy

[icebraining]

There was a time when despite not being Open Source licensed, the source was available. I don't know if it's still the case.

Encrypt file containers, partitions with TrueCrypt

[Futurepower(R)]

TrueCrypt is reliable, reputable, fast, free, open source, and works on Windows, Mac OS X, and Linux.

The TrueCrypt documentation is very good, but not perfect.

TrueCrypt can encrypt a file that contains other files (a drive letter) or encrypt an entire partition, even the boot partition.

No one I know has any connection with TrueCrypt. We are just happy users.

Negative is too positive, in this case.

[Anonymous Coward]

Considering my extensive experience, you are being too positive about Symantec.

Acronym change

[Limburgher]

Now, it's Pretty Good Privacy. Soon, it will be Poof Gone Permanently.

Re:Acronym change

[Anonymous Coward]

Fork
Fork
FORK!

Re:Oh. My. God.

[Amouth]

I work for a giant TLA. ... We're headed straight to hell, aren't we?

humm I believe you have already arrived

Re:Oh. My. God.

[Anonymous Coward]

He works for the IRS dosnt he? So yeah, he has his own slice of hell.

The Good, The Bad and The Ugly

[BitZtream]

The good side to this is, they'll cram it into a package and force it down everyones throat, meaning more people will use encryption. This will at the very least make encryption more well known and possibly get normal people talking about it. Right now theres really no reason for any normal person to use encryption, regardless of what the paranoid slashdotters say. This will help get people thinking about it even if they don't need it.

The bad side is, it'll be a bloated, slow pile of shit.

The ugly side is, it'll encrypt everything just fine, but the password input mechanism will come with your password already entered for you so all you and visible in clear text, effectively rendering it useless ... just like their AV products.

Re:Pretty *Bogus* Privacy

[calmofthestorm]

Regardless, I would assume the NSA has its fingers everywhere. Backdoors are not trivial to catch in the source code, like the famous if (uid = 0) test on an obscure flag combination on an obscure call.

Don't get me wrong, I'll trust OSS a lot more if the code can be read by anyone,but what good is the potential if no one actually does it?

The beauty is the I don't do anything the NSA cares about, I just like my privacy. Anyone powerful enough to get my personal data has bigger fish to fry.

This is fantastic!

[JonJ]

I've always wanted encryption-software from people who can't write a fucking uninstaller properly.

Re:This is fantastic!

[MoeDumb]

Symantec? Oy, there goes the cipherhood.

Not really...

[BenEnglishAtHome]

It's a pretty nice place to work if you're in IT. Other parts of the organization vary widely. Generally speaking, if you're willing to work hard at helping people, you can find a place to do it here.

This may be blasphemous, but I actually *like* my job.

Re:Not really...

[Amouth]

It's not blasphemous.. your fortunate that you like where you work and what you do.

personally i like where i work but not exactly what i do.. but i'll take the good with the bad to not have to live in an over crowded city and have more than a 15-20min commute

S/MIME trust model

[tepples]

You shouldn't be using PGP for email encryption anyways. S/MIME is built into almost all modern email clients.

Does S/MIME work with a web of trust like that of PGP and other implementations of OpenPGP, or does it rely exclusively on central commercial certificate authorities?

Re:S/MIME trust model

[phantomcircuit]

S/MIME relies entirely on central certificate authorities. Of course in a corporate environment you would create your own certificate authority.

Re:S/MIME trust model

[X0563511]

Which is great and all, for everyone who don't have a magical CA available to them, or the cash to shell out to a commercial CA.

Re:S/MIME trust model

[phantomcircuit]

They're freely available from comodo and instantssl. http://www.instantssl.com/ssl-certificate-products/free-email-certificate.html http://www.comodo.com/home/internet-security/free-email-certificate.php

However they just verify your email address not your identity, but fortunately nobody is going to notice that...

Re:S/MIME trust model

[X0563511]

... which rely on companies.

GPG doesn't. It's not centralized, by nature.

Re:S/MIME trust model

[tepples]

GPG relies on companies to run the public key servers (such as pgp.mit.edu) and the key signing meetup sites (such as biglumber.com).

Re:S/MIME trust model

[profplump]

It absolutely does not. Those are handy places to find new keys, but it's perfectly possible for someone to simply send you their public key as part of the first exchange, and then do whatever sort of out-of-band validation you'd do with a key you found in the keyserver.

Re:S/MIME trust model

[X0563511]

In addition to what profplump just said, you realize that MIT isn't a "company"? It's an educational institution.

Besides, you don't even NEED keyservers for the system to function.

PGP leadership already bolted.

[Anonymous Coward]

PGP co-founder takes OS security job with Apple
http://www.theregister.co.uk/2010/04/22/jon_callas_joins_apple/

Re:Pretty *Bogus* Privacy

[RobertLTux]

but what if the agent just needs a few XP to "level up"??

Great, I can't wait for this to be pre-installed

[dwinks616]

I wonder how long until this becomes part of the Symantec Suite of malware that comes pre-installed as a trial in most big-box computers. Just think of the kind of money they'll rake in when the 60 days is up and the user is unable to decrypt their data... Of course, I'm sure it won't be encrypted by default, but it will certainly have some big red flashy box letting users know their computer is "at risk" and give them a shiny button to click to set up whole disk encryption. Then when the trial period is over, the passphrase quits working until they re-activate their encryption. Brilliant!!!

Re:Encrypt file containers, partitions with TrueCr

[X0563511]

Truecrypt is not the same thing as PGP/GPG. Truecrypt is great, mind you, but it is not public key cryptography and signing, with web-of-trust. It's just data encryption and hiding.

I'm still using PGP freeware version, heh

[simetra]

I've kept a copy of the installer for the freeware version of PGP before they started getting uppity about it.
Works on XP just great. Version 8.0.2.... dunno if this version is still found in the wild....

Re:I'm still using PGP freeware version, heh

[Kozar_The_Malignant]

A lot of older versions are available from The International PGP Home Page.

Re:I'm still using PGP freeware version, heh

[simetra]

But if you follow the links to download, they go back to pgp.org where you have to pay $$$$

Re:I'm still using PGP freeware version, heh

[Kozar_The_Malignant]

Only for version 8.0.2. The rest go to mirrors outside the US.

Used to belong to McAffee

[Anonymous Coward]

When I worked back at Network Associates (a merger of Network General and McAffee Associates) they owned it. Now it is bought by a competitor a decade later. Just funny, that's all.

Re:Pretty *Bogus* Privacy

[Anonymous Coward]

The encryption portion of the PGP software is open source.

Bad deal for PGP

[comrade1]

PGP was doing over 100 million a year in business (dropped down to 75 last year with the recession). They could have IPOd at a billion. However, because most of the upper management was originally from Symantec they took this bad deal.

Don't forget one more...

[Anonymous Coward]

There's one more company that exists in that ecosystem... BRAWNDO! It's what your programmers crave. Crushing

Damn

[Kittenman]

I like PGP and hate Symantec.

Another product gone. I wonder what's waiting in the wings?

Re:Pretty *Bogus* Privacy

[WillDraven]

I don't do anything the NSA cares about right now,

Fixed that for you.

It used to be the Japanese, then the commies, now the Muslims. Who's to say in 20 years it wont be some group you happen to be a part of.

Re:Pretty *Bogus* Privacy

[Trogre]

Until you come to realise that, with all that expensive computing power and data mining algorithms, they can happily fry you, your neighbours and the big fish in the same pan.

PGP was already privatized! By McAfee & co.

[CuteSteveJobs]

PGP got taken over by McAfee / Network Associates years ago. Look here: http://www.openpgp.org/members/nai.shtml

They took it over and killed it.

Well, it was already dead. Although we loved PGP at the time because it was encryption when no one was allowed to have it, the product itself was very badly designed. The user interface was hostile (Trust? Invalid? Implicit? WTF?), and although they provided E-mail plugs for Eudora and Outlook they never supplied one for Mozilla/Thunderbird. You had to copy paste through the clipboard which was a huge pain.

Then there were compatability problems over RSA keys (dropped thanks to those ratbags Rivest, Shamir and Adleman) and the now-thankfully-dead IDEA (why didn't they choose an unencumbered algorithm?) so you couldn't guarantee someone sent PGP mail could actually read it. You couldn't even be sure you could look at your own e-mail with an older version.

Add all this together, and little wonder it tanked.

PGP never got with the times and gave us a nice fluid GUI. Instead their GUI mimiced the CLI. The McAfee / Network Associates take over made it worse; they made parts of payware (so suddenly PGPDisk you were using was no longer available unless you paid CASH) and stopped releasing the source. Phil (creator of PGP) complained they were neglecting it, but McAfee didn't care.

PGP with its confusing interface remained sadly stuck in the world of DOS. Sadly GNU PgP (GPG) copied the same cryptic command line interface, so never improved. There are plug-ins for Thunderbird now, but they're not smoothly integrated and the horse has long bolted.

My friends and I who were all PGP mad gave up and now exchange e-mail plaintext via Gmail. As Scott McNeally said, "You have no privacy. Get over it." He was wrong, but I guess we did.

Re:PGP was already privatized! By McAfee & co.

[thoughtsatthemoment]

I guess since you didn't want to pay so you've never used PGP Desktop 9.0+. Nothing wrong with that except that you perspective maybe outdated.

Re:Pretty *Bogus* Privacy

[calmofthestorm]

I was trying to differentiate ability to get info on /anyone/ vs ability to get info on /everyone/ but I guess I didn't make it clear. As long as you have nothing to hide AND htey can't watch us all, life is good.

Too late!

[CuteSteveJobs]

No one else is using it and that is the point
Once a comms product drops below critical mass it's dead.

Why not just GPG, then?

[Futurepower(R)]

GPG is also reliable, reputable, fast, free, open source, and works on Windows, Mac OS X, and Linux.

What we need is a list of things PGP can do that the free, open source GPG can't do. Is there anything? If GPG can do everything PGP can do, then there is no reason to pay a lot of money for a closed-source alternative.

For example, here is the GPG manual: web-of-trust.

It would be difficult to trust closed-source encryption software, especially from a company that so many people who have commented here have said they have found unreliable.

MIT Corporation

[tepples]

you realize that MIT isn't a "company"?

This page begs to differ. MIT is a non-profit corporation.

Besides, you don't even NEED keyservers for the system to function.

Without keyservers, how would you follow the signature chain in order to verify that the public key that you're using to encrypt a message actually belongs to the recipient?

Re:MIT Corporation

[X0563511]

By them giving me said key through any other secure means, including physically.

You got me with MIT. Though, do you really trust random for-profit over MIT?

They never learn, do they...

[Phred T. Magnificent]

We've been through this once before, when the original PGP was acquired by Network Associates (McAffee). Didn't they learn their lesson after that fiasco?

Re:Oh. My. God.

[dwye]

> He works for the IRS dosnt he? So yeah, he has his own slice of hell.

Not necessarily. One of the Disciples/Apostles was a tax collector, too (actually, probably a tax farmer, which is far worse).

Re:Pretty *Bogus* Privacy

[Anonymous Coward]

There was a time when despite not being Open Source licensed, the source was available. I don't know if it's still the case.

Gee, I wonder if there may be a way to find out...
http://lmgtfy.com/?q=pgp+source+code

Re:Pretty *Bogus* Privacy

[icebraining]

I simply didn't care enough. I use GnuPG anyway.