Slashdot Log In
PGP Is 15 Years Old
Posted by
samzenpus
on Wed Nov 15, 2006 08:08 PM
from the happy-secure-birthday dept.
from the happy-secure-birthday dept.
An anonymous reader writes "PGP Corporation salutes the 15th anniversary of PGP encryption technology. Developed and released in 1991 by Phil Zimmermann, Pretty Good Privacy 1.0 set the standard for safe, accessible technology to protect and share online information."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Finally Legal! (Score:2, Offtopic)
Congratulations, PGP! Now legal [ageofconsent.com] in Bulgaria, France, Monaco, and Thailand.
Oh, and I almost forgot Poland!
Re:Finally Legal! (Score:5, Funny)
Parent
First encrypted post (Score:5, Funny)
Version: 2.6.2
hIwDY32hYGCE8MkBA/wOu7d45aUxF4Q0RKJprD3v5Z9K1YcR
eW4GDdBfLbJE7VUpp13N19GL8e/AqbyyjHH4aS0YoTk10QQ9
g9VGQxFeGqzykzmykU6A26MSMexR4ApeeON6xzZWfo+0yOqA
AABH78hyX7YX4uT1tNCWEIIBoqqvCeIMpp7UQ2IzBrXg6Gtu
1yt21DYOjuLzcMNe/JNsD9vDVCvOOG3OCi8=
=zzaA
-----END PGP MESSAGE-----
Re:First encrypted post (Score:4, Funny)
Regards,
The NSA.
Parent
Re:First encrypted post (Score:4, Funny)
Parent
It's sad... (Score:2)
That thing ROCKS
Re:It's sad... (Score:5, Informative)
Parent
PGPfone was AMAZING (Score:2)
What's been the problem with encrypted voice? (Score:2)
Re: (Score:2, Informative)
Twinkle [twinklephone.com] (Linux) supports both SRTP and ZRTP.
Minisip [minisip.org] and Minisplat [minisplat.org] (both Linux) presently support SRTP and are working toward ZRTP support.
Eyebeam [counterpath.com] (Windows) supports SRTP
ZFone [zfoneproject.com] (Windows, Linux, MacOSX) uses ZRTP and can work with any SIP-based software (because it intercepts and encrypts the stream).
OpenWengo [openwengo.org] (Windows, Linux) is in the process of implementing SRTP, with some automated key exchange, and later ZRTP is planned.
So really, the answer is: yes, yes there are implementations.
too bad (Score:3, Interesting)
Hell, even mutt supports S/MIME. Imagine SSL with a web of trust--yuck!. PKI is the way to go...
Re:too bad (Score:5, Interesting)
Parent
Re:too bad (Score:5, Informative)
Web of Trust (WoT) is a PKI model. Certificate Authorities (CA) is a competing PKI model, and the one apparently you prefer. Have you taken a look at the CA list of trust in your browser lately? I for one prefer WoT, although more work on the part of the user to maintain, the trust model is based on me, not "Staat de Nederlanden" or any other company I've never heard of. Not to mention the stolen Microsoft certificates of a few years ago. There is nothing to stop us from moving to a WoT model for our browser PKI, just as there is nothing stopping us from using the CA model for email, it's just how it's been implemented for us thus far, and which we choose to use.
MIME vs Inline are competing ways of using PKI in email, it appears you prefer MIME which does appear to be the merging standard.
Parent
Re: (Score:3, Interesting)
S/MIME is great. Inside a single organisation. But beyond that.... forget it. And I have seen many MANY attempts across MANY serious organisations.
Webs of trust are not the only trust model PGP can implement. In the serious business world, PGP Universal is making steady progress; policy driven, nice and easy for the users. Of course, it supports S/MIME too for all the poor souls in external organisations stuck with that
S/MIME has been around a long time too (Score:5, Interesting)
Also, bear in mind that CA-based PKI is a strict subset of web of trust.
The lesson is that crypto goes nowhere in the market unless it's as transparent as TLS.
>can not or do not want to maintain a web of trust
PKI shouldn't be difficult, but from what I've seen it does seem to be beyond human comprehension.
Parent
Re: (Score:2)
Thanks, Phil!!! (Score:3)
Re: (Score:2)
If I met him, Id buy him a few drinks (well, as many as he wants. he deserves it).
Re: (Score:2, Funny)
No lie, a lesbian friend of mine once shared drinks in a hot tub with Phil in Colorado. She said he was a bit of a jerk. Of course, she hates all men so I really can't go by her opinion.
Ya know, I've been waiting a long time to share that factoid with somebody who would know who Phil Zimmerman is. Never thought for a moment it would be a Slashdot post...
Re: (Score:3, Informative)
That not withstanding he [and people like him] went through hell to free up crypto projects for the rest of us. I, myself, give out a crypto library that slips through relaxed regulations on free software.
Kudos to Phil, his supporters, and PGP as a whole. [except Jon Callas, he's a jerk and I still hate him]
Tom
Re: (Score:2)
For crying out loud it's NBS (defunct, now NIST) who solicited for and published DES and 3DES in the first place!
Tom
it's too bad... (Score:5, Insightful)
Re:it's too bad... (Score:5, Informative)
So even though use of PGP / GPG have not penetrated the mainstream, there were other beneficial aspects of its existence.
Parent
Re: (Score:2)
Don't forget to use OTR [cypherpunks.ca] for your GAIM [sourceforge.net] sessions...
Too bad it isn't better integrated into things (Score:5, Interesting)
chicken or egg (Score:2)
I know there are sites like hushmail.com but we need to get an existing userbase setup with encryption, and everything has to be automatic.
Unfortunately, I'm in no position to organize such a thing.
The demand for theoretically solid security (Score:2)
The use case you want is prevented by existing public key systems. They consider it insecure because there wouldn't be any proof that you were really encrypting to your friend's public key, as opposed to a public key belonging to whoever is wiretapping you. Hence the whole need for directory systems, trust systems, signers and "CA"s (signers you don't know but who are supposed to do
Maybe Google needs to kick start things (Score:2)
That is exactly the issue. Most people have pretty boring lives, and don't need encryption. While many of us could make at least a business case that it would be a good thing to encrypt our mail, at the end of the day, expedient convenience wins out over The Right Thing.
Until strong encryption is seemlessly and effortlessly incorporated for a critical mass of users, it isn't going to happen.
This is where you n
Re: (Score:2)
You obviously haven't tried lately.
Both Enigmail for Thunderbird and also the mail client for OSX have pgp and key management built in. They have methods for downloading, signing and uploading keys to the key servers. I've been signing my email for years, very automatically. Also, the few individuals that have keys get their email encrypted automatically. It's v
GPG not integrated into Mail by default. (Score:2)
It has some S/MIME capabilities built in (and almost totally undocumented, as far as I can tell, and it's a bit of a bear to set up), but to get anything related to PGP, you need to install the excellent set of plugins from Sente, called GPGMail [sente.ch]. It is basically an interface between Apple Mail, and the CLI gpg tools.
It relies on some undocumented and unsupported APIs in
Re: (Score:2)
The only problem I've had is with the IMAP client not seeing new messages in various folders. I have to go upstairs to my workstation to get an accurate view of my new email.
Re: (Score:2)
You do send email, right? When people ask you about that funny little attachment to all your emails, explain PGP to them and help them generate their own key. As long as they understand that the public key must be securely verified, most people (even nontechnical people) do alright with the concept.
you've given up? too hard? (Score:2)
Indeed, it's just too much trouble, which show you and I both agree with the parent to your post. It's one thing being a highly competent email user and setting your own PGP up, but can we really be bothered setting up all our friends, work colleagues and family? I can't. And why don't they set up PGP? Because it's too much work and too difficult for the average user.
As one of the parent posts noted, the same people understand and happily use secure payment methods over the web. S
Speaking of PGP... (Score:3, Interesting)
If there's one thing that annoys me it's when a program disappears like that...
Re: (Score:2)
Re: (Score:3, Informative)
http://www.pgp.com/downloads/desktoptrial2.php [pgp.com]
It's fully functional for 30 days, then falls back to the functionality of the old PGP Freeware product, i.e. you can encrypt and decrypt files, windows, and the clipboard, and you can create, import, and manage keys.
GPG+Enigmail. (Score:2)
The title is wrong. Quit perpetuating the myth (Score:5, Informative)
There were two people who were hauled up in front of the Federal Grand Jury. Phil was one. Kelly Goen was the other. It was Kelly who paid Phil, who researched the law (so that the release could be done legally) and who had been pushing for developing public key cryptography for years before he ever met Phil. And it was Kelly who had the guts to do the actual release. Phil thought he was completely safe at the time (and legally speaking he probably was, not that innocence has ever stopped the Feds before).
If you want to search, you might be able to find the original Jim Warren articles in Microtimes around, who Kelly kept in touch with during the actual release. Jim thought Kelly was paranoid as hell until the FBI showed up on his door, and he wrote at least one article about it.
For your amusement, Kelly went around the San Francisco Bay area with an old acoustic coupler modem to various pay phones and would upload it onto a different server. Then he'd call Jim to tell him where it was at, in case something happened to him. He was under the impression that the single best thing the NSA could do was to knock him off before he put it on those servers. Looking back at it now, he was quite right.
And no, this isn't being posted by Kelly. Just someone else who was there at the time.
So please, get your facts straight and give Kelly some credit while he's still alive. Thanks.
For the history files (Score:4, Informative)
Parent
15 years (Score:2)
It's......... (Score:2)
Sosumi, Sir Paul! (Score:2)
PGP didnt Invent RSA encryption (Score:2, Interesting)
The first step... (Score:2)
Inappropriate PGP usage: my sin. (Score:3, Funny)
So i relentlessly harangued a national organization to distribute a windows/DOS/Mac PGP release to all of their chapters.
I felt pretty good about it until i got a call from someone in another state:
"duuuude. i forgot my passphrase..."
How did you do that?
"we were rilly baked
i've always wondered how much damage i did to the marijuana movement by handing a bunch of stoners a tool that required memorizing a passphrase...
my bad!
Re: (Score:2)
I believe thawte offers a viable and professional alternative to PGP.
Open up your IE browser, Internet Options->Content->Certificates and then click on the intermediate and root trusted authorities. Each of these you must trust. Further, another weak point, someone else has the keys that can gerate other keys to spoof domains.
Rememeber, there are devices that can do SSL in the middle. Don't believe me, see http://www.bluecoat.com/downloads/support/BCS_tb_ r everse_proxy_with_SSL.pdf [bluecoat.com] Your best d
Re: (Score:2)
As for the big list of pre-trusted CAs, just remove the ones you don't trust.
PGP may be more secure for point to point, but shared secret or one-time pad is even better. If all you want is secure communications with someone you already have a rela
Re: (Score:2)
And suddenly, I can't visit any https URLs except my own.
Really, the PGP concept of "trust" is important. There are multiple levels of trust, from simply "I trust that this key actually belongs to this person" to "I fully trust this person to be competent at signing keys, and will trust any key they sign"...
Generally, trust is earned, based on experience. Really, what has Thawte, VeriSign, or any other root CA done to earn my tru
Re: (Score:2)
What guarantees the integrity of IE's list of trusted root certificate authorities? In other words, what stops a piece of malware from installing its own public key as an ultimately trusted one?
Hint: they're stored in the registry.
Because they're not. (Score:3, Insightful)
Public and private isn't too bad, it's just that no one ever, EVER bothers to learn them. I mean, come on, if people can learn words like "clutch", "gearshift", "ignition", and so on, why can't they understand that the PUBLIC key is what you send to everyone, and the PRIVATE key is what you don't even share with your lover?