Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
How secure is PGP and what are the alternatives?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Off the Wall
View previous topic :: View next topic  
Author Message
Butts McCokey
Advocate
Advocate


Joined: 23 Apr 2004
Posts: 3313

PostPosted: Fri Aug 23, 2013 1:37 pm    Post subject: How secure is PGP and what are the alternatives? Reply with quote

Now Groklaw has shut down and the reason given was privacy I was wondering about secure communication and privacy, how secure is the security that everyone seems to use?

What will be the next stage? All this increasing bits from 64 to 128 to 256 in encryption doesn't eliminate PEBKAC so where will security be in 3 or 5 years time?
_________________
Since the bible and the church are obviously mistaken about where we came from, how can we trust them with where we're going?

"An eye for an eye will make us all blind" - Gandhi
Back to top
View user's profile Send private message
wswartzendruber
Veteran
Veteran


Joined: 23 Mar 2004
Posts: 1217
Location: Jefferson, USA

PostPosted: Fri Aug 23, 2013 1:42 pm    Post subject: Reply with quote

Keep your private keys safe on your machine. And use something newer like OpenPGP 8. That's mainly supported by GnuPG.
Back to top
View user's profile Send private message
sikpuppy
n00b
n00b


Joined: 12 Jun 2012
Posts: 34
Location: Central Coast, NSW

PostPosted: Fri Aug 23, 2013 1:43 pm    Post subject: Re: How secure is PGP and what are the alternatives? Reply with quote

cokehabit wrote:
Now Groklaw has shut down and the reason given was privacy I was wondering about secure communication and privacy, how secure is the security that everyone seems to use?

What will be the next stage? All this increasing bits from 64 to 128 to 256 in encryption doesn't eliminate PEBKAC so where will security be in 3 or 5 years time?
Carrier pigeon looks good. Or Welsh or Choctaw Indian code talkers. All those consonants and no vowels will fuck up the NSA.
Back to top
View user's profile Send private message
Dr.Willy
Guru
Guru


Joined: 15 Jul 2007
Posts: 318
Location: NRW, Germany

PostPosted: Fri Aug 23, 2013 1:52 pm    Post subject: Reply with quote

Alternatively encrypt your messages by using Windings
Back to top
View user's profile Send private message
Butts McCokey
Advocate
Advocate


Joined: 23 Apr 2004
Posts: 3313

PostPosted: Fri Aug 23, 2013 1:55 pm    Post subject: Re: How secure is PGP and what are the alternatives? Reply with quote

sikpuppy wrote:
cokehabit wrote:
Now Groklaw has shut down and the reason given was privacy I was wondering about secure communication and privacy, how secure is the security that everyone seems to use?

What will be the next stage? All this increasing bits from 64 to 128 to 256 in encryption doesn't eliminate PEBKAC so where will security be in 3 or 5 years time?
Carrier pigeon looks good. Or Welsh or Choctaw Indian code talkers. All those consonants and no vowels will fuck up the NSA.
Navajo?
_________________
Since the bible and the church are obviously mistaken about where we came from, how can we trust them with where we're going?

"An eye for an eye will make us all blind" - Gandhi
Back to top
View user's profile Send private message
sikpuppy
n00b
n00b


Joined: 12 Jun 2012
Posts: 34
Location: Central Coast, NSW

PostPosted: Fri Aug 23, 2013 5:31 pm    Post subject: Re: How secure is PGP and what are the alternatives? Reply with quote

cokehabit wrote:
Navajo?
No.
Quote:
The name code talkers is strongly associated with bilingual Navajo speakers specially recruited during World War II by the Marines to serve in their standard communications units in the Pacific Theater. Code talking, however, was pioneered by Choctaw Indians serving in the U.S. Army during World War I. These soldiers are referred to as Choctaw code talkers.
But that's Wikipedia, so it could all be a bunch of shite.
Back to top
View user's profile Send private message
Butts McCokey
Advocate
Advocate


Joined: 23 Apr 2004
Posts: 3313

PostPosted: Fri Aug 23, 2013 5:38 pm    Post subject: Re: How secure is PGP and what are the alternatives? Reply with quote

sikpuppy wrote:
cokehabit wrote:
Navajo?
No.
Quote:
The name code talkers is strongly associated with bilingual Navajo speakers specially recruited during World War II by the Marines to serve in their standard communications units in the Pacific Theater. Code talking, however, was pioneered by Choctaw Indians serving in the U.S. Army during World War I. These soldiers are referred to as Choctaw code talkers.
But that's Wikipedia, so it could all be a bunch of shite.
I was going by an even worse source
_________________
Since the bible and the church are obviously mistaken about where we came from, how can we trust them with where we're going?

"An eye for an eye will make us all blind" - Gandhi
Back to top
View user's profile Send private message
sikpuppy
n00b
n00b


Joined: 12 Jun 2012
Posts: 34
Location: Central Coast, NSW

PostPosted: Fri Aug 23, 2013 5:44 pm    Post subject: Re: How secure is PGP and what are the alternatives? Reply with quote

cokehabit wrote:
sikpuppy wrote:
cokehabit wrote:
Navajo?
No.
Quote:
The name code talkers is strongly associated with bilingual Navajo speakers specially recruited during World War II by the Marines to serve in their standard communications units in the Pacific Theater. Code talking, however, was pioneered by Choctaw Indians serving in the U.S. Army during World War I. These soldiers are referred to as Choctaw code talkers.
But that's Wikipedia, so it could all be a bunch of shite.
I was going by an even worse source
Heh. That's the reason I know the truth...because it's out there.
Back to top
View user's profile Send private message
patrix_neo
Guru
Guru


Joined: 08 Jan 2004
Posts: 372
Location: Svedala

PostPosted: Fri Aug 23, 2013 6:40 pm    Post subject: Re: How secure is PGP and what are the alternatives? Reply with quote

sikpuppy wrote:
cokehabit wrote:
sikpuppy wrote:
cokehabit wrote:
Navajo?
No.
Quote:
The name code talkers is strongly associated with bilingual Navajo speakers specially recruited during World War II by the Marines to serve in their standard communications units in the Pacific Theater. Code talking, however, was pioneered by Choctaw Indians serving in the U.S. Army during World War I. These soldiers are referred to as Choctaw code talkers.
But that's Wikipedia, so it could all be a bunch of shite.
I was going by an even worse source
Heh. That's the reason I know the truth...because it's out there.

You are funny

Besides, The protection 'Anonymous' has, I would like to have.
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 16090
Location: Colorado

PostPosted: Sat Aug 24, 2013 3:11 am    Post subject: Re: How secure is PGP and what are the alternatives? Reply with quote

cokehabit wrote:
sikpuppy wrote:
cokehabit wrote:
Navajo?
No.
Quote:
The name code talkers is strongly associated with bilingual Navajo speakers specially recruited during World War II by the Marines to serve in their standard communications units in the Pacific Theater. Code talking, however, was pioneered by Choctaw Indians serving in the U.S. Army during World War I. These soldiers are referred to as Choctaw code talkers.
But that's Wikipedia, so it could all be a bunch of shite.
I was going by an even worse source
To tie in to another thread, Windtalkers was excellent.
_________________
lolgov. 'cause where we're going, you don't have civil liberties.

In Loving Memory
1787 - 2008
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1553
Location: U.S.A.

PostPosted: Sat Aug 24, 2013 3:26 am    Post subject: Reply with quote

OpenPGP is excellent for email security, if you implement it yourself and protect your private keys.

Personally, I think it's more secure than x.509 (i.e., PKCS-7/MIME a.k.a. "S/MIME"), which is what our military uses (although x.509 is far more well-suited to use by a large organization).

Encryption doesn't solve the whole problem, though. Most of the domestic spying going on is more about who's talking to whom (as opposed to what they're saying). For protection from that, you need something like bitmessage. Of course, it may only be a matter of time before somebody kicks in their doors and shuts them down too, unless they find a nice island bunker somewhere.
Back to top
View user's profile Send private message
energyman76b
Advocate
Advocate


Joined: 26 Mar 2003
Posts: 2025
Location: Germany

PostPosted: Sat Aug 24, 2013 4:14 pm    Post subject: Reply with quote

get a smartcard reader and a chipcard.

btw, the state of smartcards and using them for login etc on linux is beyond fucked up.
_________________
AidanJT wrote:

Libertardian denial of reality is wholly unimpressive and unconvincing, and simply serves to demonstrate what a bunch of delusional fools they all are.

Satan's got perfectly toned abs and rocks a c-cup.
Back to top
View user's profile Send private message
wswartzendruber
Veteran
Veteran


Joined: 23 Mar 2004
Posts: 1217
Location: Jefferson, USA

PostPosted: Sat Aug 24, 2013 5:49 pm    Post subject: Reply with quote

systemd and PulseAudio will fix all of this.
Back to top
View user's profile Send private message
Dr.Willy
Guru
Guru


Joined: 15 Jul 2007
Posts: 318
Location: NRW, Germany

PostPosted: Sat Aug 24, 2013 5:58 pm    Post subject: Reply with quote

Ironically, the chances of PulseAudio getting a driver for a smartcard reader aren't all that bad…
Back to top
View user's profile Send private message
energyman76b
Advocate
Advocate


Joined: 26 Mar 2003
Posts: 2025
Location: Germany

PostPosted: Sat Aug 24, 2013 7:37 pm    Post subject: Reply with quote

Dr.Willy wrote:
Ironically, the chances of PulseAudio getting a driver for a smartcard reader aren't all that bad…


*g*
_________________
AidanJT wrote:

Libertardian denial of reality is wholly unimpressive and unconvincing, and simply serves to demonstrate what a bunch of delusional fools they all are.

Satan's got perfectly toned abs and rocks a c-cup.
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1553
Location: U.S.A.

PostPosted: Sat Aug 24, 2013 11:54 pm    Post subject: Reply with quote

Unless you're running a big corporation with high security needs, I think smartcard readers are unnecessary pieces of single-purpose hardware. Just use a USB key. They make ones the size of a Tic-Tac now for about $5 that are well-suited to the purpose.
Back to top
View user's profile Send private message
Ahenobarbi
Developer
Developer


Joined: 02 Apr 2009
Posts: 345
Location: Warsaw, PL

PostPosted: Sun Aug 25, 2013 1:17 am    Post subject: Reply with quote

How about not having any persistent storage except read-only bootable pre-generated system :wink:
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 16090
Location: Colorado

PostPosted: Sun Aug 25, 2013 3:22 am    Post subject: Reply with quote

Ahenobarbi wrote:
How about not having any persistent storage except read-only bootable pre-generated system :wink:
How Zen, the email which is never sent.
_________________
lolgov. 'cause where we're going, you don't have civil liberties.

In Loving Memory
1787 - 2008
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1553
Location: U.S.A.

PostPosted: Sun Aug 25, 2013 4:36 am    Post subject: Reply with quote

Ahenobarbi wrote:
How about not having any persistent storage except read-only bootable pre-generated system :wink:

I got you covered right here (and it's gentoo):
http://opensource.dyc.edu/tinhat

And it's blaaayyyzing fast, once you get it booted.
Back to top
View user's profile Send private message
energyman76b
Advocate
Advocate


Joined: 26 Mar 2003
Posts: 2025
Location: Germany

PostPosted: Sun Aug 25, 2013 9:29 am    Post subject: Reply with quote

BoneKracker wrote:
Unless you're running a big corporation with high security needs, I think smartcard readers are unnecessary pieces of single-purpose hardware. Just use a USB key. They make ones the size of a Tic-Tac now for about $5 that are well-suited to the purpose.


I have a identity card, that is also a RFID smartcard.

I should be able to use it to login.

I also have a hbci banking card
http://en.wikipedia.org/wiki/HBCI

which isn't 'just' a smartcard. And with a good reader it is more secure than an ATM.
_________________
AidanJT wrote:

Libertardian denial of reality is wholly unimpressive and unconvincing, and simply serves to demonstrate what a bunch of delusional fools they all are.

Satan's got perfectly toned abs and rocks a c-cup.
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1553
Location: U.S.A.

PostPosted: Sun Aug 25, 2013 10:06 am    Post subject: Reply with quote

If that makes you happy, then I'm glad for you.

Personally, I'd rather not need to add a special piece of hardware just for that purpose, since it provides no material advantage.
Back to top
View user's profile Send private message
energyman76b
Advocate
Advocate


Joined: 26 Mar 2003
Posts: 2025
Location: Germany

PostPosted: Sun Aug 25, 2013 10:16 pm    Post subject: Reply with quote

BoneKracker wrote:
If that makes you happy, then I'm glad for you.

Personally, I'd rather not need to add a special piece of hardware just for that purpose, since it provides no material advantage.


maybe, but it is convinient.
_________________
AidanJT wrote:

Libertardian denial of reality is wholly unimpressive and unconvincing, and simply serves to demonstrate what a bunch of delusional fools they all are.

Satan's got perfectly toned abs and rocks a c-cup.
Back to top
View user's profile Send private message
Naib
Advocate
Advocate


Joined: 21 May 2004
Posts: 4076
Location: Removed by Neddy

PostPosted: Sun Aug 25, 2013 10:23 pm    Post subject: Reply with quote

well megaupload Fatboy Kim is suppose to be coming out with an encrypted email system soon and considering the BS that NZ & NSA (since it seems PRISM data was used as a basis of the raid...) put him and the original megaupload through I can see him not giving a fuck about any threats to close him down, threats others have buckled under.

Until then, the only real secure method is a park bench, but if you insist on sending the data then a park bench meeting to decide on a piece of literature (the longer the better) and then using that as a one-time cypher using a simple caesar shift. While a Caesar cipher is one of the easiest to crack IT is all but impossible if each letter is individually encoded and the key is as long as the message.

I myself have a few choice agreed upon literature creations on a disk if I ever find the need to send some information across the net to some people to protect the knowledge of my 1st borned poo consistency


THAT or just accept its open and at the end of the day no one outside of your bubble really cares about your existance, just don't cause that bubble to grow to contain any gov'n/corporate agencies... besides monetary transactions credentials (actual value and goods... so what...) there isn't anything I really don't give a fuck if my boss,head of MI5, wife, grandmother reads or stores
_________________
A free press is the unsleeping guardian of every other right that free men prize; it is the most dangerous foe of tyranny. Where men have the habit of liberty, the Press will continue to be the vigilant guardian of the rights of the ordinary citizen.
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1553
Location: U.S.A.

PostPosted: Mon Aug 26, 2013 3:03 am    Post subject: Reply with quote

Aye, there's the rub, for you might feel now nobody cares about your existence, but the future is untold.

The bones fermenting in the rice paddies of China and Cambodia or fertilizing fields all across Eastern Europe and Russia, once held flesh secure in the same thought that nobody cared about their existence or meant them harm. Cattle probably feel that way too.

Bad things that happen aren't limited to such atrocities. You don't have to end up in a mass grave to have been persecuted or discriminated against, perhaps even without your knowledge, based on your personal beliefs, knowledge, preferences, past behavior, genetics, health problems, etc., etc.

Technical solutions are necessary, but I think we must also demand legal protection of privacy, even and perhaps especially from the state.
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1553
Location: U.S.A.

PostPosted: Tue Aug 27, 2013 1:07 pm    Post subject: Reply with quote

energyman76b wrote:
BoneKracker wrote:
If that makes you happy, then I'm glad for you.

Personally, I'd rather not need to add a special piece of hardware just for that purpose, since it provides no material advantage.


maybe, but it is convinient.

After saying all this, I remembered that my old laptop has an ExpressCard slot I'm using for nothing, so after thinking that it would be nice to just stick a card in my wallet rather than carrying around a usb stick, I ordered a smartcard reader/writer for it. :lol:

I also have an fancy government ID (I call it my "ObamaCard"), but it's based on RFID and some optical shit, and not ISO/IEC 7816, so I'm not even going to try and use that.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Off the Wall All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum