PGP Is 15 Years Old 119
An anonymous reader writes "PGP Corporation salutes the 15th anniversary of PGP encryption technology. Developed and released in 1991 by Phil Zimmermann, Pretty Good Privacy 1.0 set the standard for safe, accessible technology to protect and share online information."
Finally Legal! (Score:2, Offtopic)
Congratulations, PGP! Now legal [ageofconsent.com] in Bulgaria, France, Monaco, and Thailand.
Oh, and I almost forgot Poland!
Re: (Score:1)
Re:Finally Legal! (Score:5, Funny)
Wait? ZIMMERMAN? (Score:1, Offtopic)
As in Zimmermann with the same spelling as this Zimmerman [wikipedia.org] who was tied to this event? [wikipedia.org]
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Age of consent laws are there to say.. "until you are this age, you are not mature enough to decide if you can have sex or not"
it is the Age of COnsent laws that define the difference between Rape and statutary Rape. with the latter being where the young person 'consents' but is deemed to not be able to make that choice.
it is analogous to driving and achohol laws.. at age X are allowed to buy alchohol or drive a car on public roads.. but at age (X - 1day) you are not.
an
First encrypted post (Score:5, Funny)
Version: 2.6.2
hIwDY32hYGCE8MkBA/wOu7d45aUxF4Q0RKJprD3v5Z9K1YcR
eW4GDdBfLbJE7VUpp13N19GL8e/AqbyyjHH4aS0YoTk10QQ9
g9VGQxFeGqzykzmykU6A26MSMexR4ApeeON6xzZWfo+0yOqA
AABH78hyX7YX4uT1tNCWEIIBoqqvCeIMpp7UQ2IzBrXg6Gtu
1yt21DYOjuLzcMNe/JNsD9vDVCvOOG3OCi8=
=zzaA
-----END PGP MESSAGE-----
Re:First encrypted post (Score:4, Funny)
Regards,
The NSA.
Re:First encrypted post (Score:4, Funny)
Re: (Score:1, Redundant)
It's sad... (Score:2)
That thing ROCKS
Re:It's sad... (Score:5, Informative)
PGPfone was AMAZING (Score:2)
Re: (Score:1)
What's been the problem with encrypted voice? (Score:2)
Re: (Score:2, Informative)
Twinkle [twinklephone.com] (Linux) supports both SRTP and ZRTP.
Minisip [minisip.org] and Minisplat [minisplat.org] (both Linux) presently support SRTP and are working toward ZRTP support.
Eyebeam [counterpath.com] (Windows) supports SRTP
ZFone [zfoneproject.com] (Windows, Linux, MacOSX) uses ZRTP and can work with any SIP-based software (because it intercepts and encrypts the stream).
OpenWengo [openwengo.org] (Windows, Linux) is in the process of implementing SRTP, with some automated key exchange, and later ZRTP is planned.
So really, the answer is: yes, yes there are implementations.
too bad (Score:3, Interesting)
Hell, even mutt supports S/MIME. Imagine SSL with a web of trust--yuck!. PKI is the way to go...
Re:too bad (Score:5, Interesting)
Re: (Score:1, Informative)
Actually with modern PDF you can digitally sign a document, much like with PGP
Re: (Score:1)
Re:too bad (Score:5, Informative)
Web of Trust (WoT) is a PKI model. Certificate Authorities (CA) is a competing PKI model, and the one apparently you prefer. Have you taken a look at the CA list of trust in your browser lately? I for one prefer WoT, although more work on the part of the user to maintain, the trust model is based on me, not "Staat de Nederlanden" or any other company I've never heard of. Not to mention the stolen Microsoft certificates of a few years ago. There is nothing to stop us from moving to a WoT model for our browser PKI, just as there is nothing stopping us from using the CA model for email, it's just how it's been implemented for us thus far, and which we choose to use.
MIME vs Inline are competing ways of using PKI in email, it appears you prefer MIME which does appear to be the merging standard.
Re: (Score:2)
It doesn't matter what you prefer. It will WoT will NEVER catch on. S/MIME will catch on as more organizations adopt it internally. Soon people will want to do at home what they do at work, and companies like Thawte will let them do so. Once gmail or hotmail start allowing "verified" (signed) mail to premium users, the rest will be history.
Re: (Score:3, Interesting)
S/MIME is great. Inside a single organisation. But beyond that.... forget it. And I have seen many MANY attempts across MANY serious organisations.
Webs of trust are not the only trust model PGP can implement. In the serious business world, PGP Universal is making steady progress; policy driven, nice and easy for the users. Of course, it supports S/MIME too for all the poor souls in external organisations stuck with that
S/MIME has been around a long time too (Score:5, Interesting)
Also, bear in mind that CA-based PKI is a strict subset of web of trust.
The lesson is that crypto goes nowhere in the market unless it's as transparent as TLS.
>can not or do not want to maintain a web of trust
PKI shouldn't be difficult, but from what I've seen it does seem to be beyond human comprehension.
Re: (Score:2)
Re: (Score:2)
Sure, getting signed by a CA is useful for trust but only when the signature bestowes trust. Look at the small print on most sites and you'll see that the signature bestowes
Re: (Score:2)
Oh, I dunno, it would be really great if someone developed a plugin that could work with a major email client, so you could use just one click to sign or encrypt emails, or import keys from a keyserver, or decrypt emails from others. I'm thinking they could call it something like "Enigmail" [mozdev.org]. I think that name has a nice ring to it, don't you?
Thanks, Phil!!! (Score:3)
Re: (Score:2)
If I met him, Id buy him a few drinks (well, as many as he wants. he deserves it).
Re: (Score:2, Funny)
No lie, a lesbian friend of mine once shared drinks in a hot tub with Phil in Colorado. She said he was a bit of a jerk. Of course, she hates all men so I really can't go by her opinion.
Ya know, I've been waiting a long time to share that factoid with somebody who would know who Phil Zimmerman is. Never thought for a moment it would be a Slashdot post...
Re: (Score:3, Informative)
That not withstanding he [and people like him] went through hell to free up crypto projects for the rest of us. I, myself, give out a crypto library that slips through relaxed regulations on free software.
Kudos to Phil, his supporters, and PGP as a whole. [except Jon Callas, he's a jerk and I still hate him]
Tom
Re: (Score:1)
Re: (Score:2)
For crying out loud it's NBS (defunct, now NIST) who solicited for and published DES and 3DES in the first place!
Tom
Re: (Score:2)
Yes, but he PUBLISHED it on teh INTARWEB (well... usenet...but anyway) which the gubment then claimed was EXPORTATION [wikipedia.org] (Read the first two paras in the History section)... not only is the GP 100% correct, but so are you... go figure, huh
/me hands Tom a KitKat
chillax...
Re: (Score:2)
Re: (Score:2)
(and technically, without an export license, closed source software must be reviewed first..., even today)
Yes, but thankfully if you get caught (assuming what you say is true) you won't get crucified for being an arms dealer... which is what they wanted to do to him, for allowing it to get out. And actually, it wasn't illegal for him to make it available on usenet... it became illegal the second a non-USian downloaded a copy.
I heard somewhere that one of the biggest reasons why this attempt to screw Phi
Re: (Score:2)
Phil wasn't the only one going through the hell. Daniel Bernstein had a similar experience. They both had quite a few supporters along the way too, so lets not forget about them.
Tom
Mt. Rushmore - Encryption Style (Score:1)
Hopefully somewhere (prolly MIT) there are statue to these guys. Pioneers. Legends.
Re: (Score:1)
Re: (Score:1)
Callas is not a jerk. He's a personal friend of mine from the VMS days. I saw him a few weeks ago at the RSA Conference in Europe. I don't know what your beef is, but it's obviously something childish. Jon is a nice guy. Always has been, always will.
Re: (Score:2)
During my talk I didn't have net access, so I let him rant in order to save some grace, but afterwards I found the CERT advisory for the bug and I emailed him. He never replie
it's too bad... (Score:5, Insightful)
Re:it's too bad... (Score:5, Informative)
So even though use of PGP / GPG have not penetrated the mainstream, there were other beneficial aspects of its existence.
Re: (Score:2)
Don't forget to use OTR [cypherpunks.ca] for your GAIM [sourceforge.net] sessions...
Re: (Score:2)
Not too bad (Score:1, Insightful)
And after the battles to preserve it were over, the way was quite safe for the networking protocols to hit, and expand, in the mainstream.
So, while I agree with you that it is too bad that it isn't more widespread,
But... (Score:1)
thawte offers free x.509 certificates . . . (Score:1)
Re: (Score:2)
I believe thawte offers a viable and professional alternative to PGP.
Open up your IE browser, Internet Options->Content->Certificates and then click on the intermediate and root trusted authorities. Each of these you must trust. Further, another weak point, someone else has the keys that can gerate other keys to spoof domains.
Rememeber, there are devices that can do SSL in the middle. Don't believe me, see http://www.bluecoat.com/downloads/support/BCS_tb_ r everse_proxy_with_SSL.pdf [bluecoat.com] Your best d
Re: (Score:2)
As for the big list of pre-trusted CAs, just remove the ones you don't trust.
PGP may be more secure for point to point, but shared secret or one-time pad is even better. If all you want is secure communications with someone you already have a rela
Re: (Score:2)
And suddenly, I can't visit any https URLs except my own.
Really, the PGP concept of "trust" is important. There are multiple levels of trust, from simply "I trust that this key actually belongs to this person" to "I fully trust this person to be competent at signing keys, and will trust any key they sign"...
Generally, trust is earned, based on experience. Really, what has Thawte, VeriSign, or any other root CA done to earn my tru
Re: (Score:1)
Re: (Score:2)
What guarantees the integrity of IE's list of trusted root certificate authorities? In other words, what stops a piece of malware from installing its own public key as an ultimately trusted one?
Hint: they're stored in the registry.
Too bad it isn't better integrated into things (Score:5, Interesting)
chicken or egg (Score:2)
I know there are sites like hushmail.com but we need to get an existing userbase setup with encryption, and everything has to be automatic.
Unfortunately, I'm in no position to organize such a thing.
Re: (Score:1)
The demand for theoretically solid security (Score:2)
The use case you want is prevented by existing public key systems. They consider it insecure because there wouldn't be any proof that you were really encrypting to your friend's public key, as opposed to a public key belonging to whoever is wiretapping you. Hence the whole need for directory systems, trust systems, signers and "CA"s (signers you don't know but who are supposed to do
Maybe Google needs to kick start things (Score:2)
That is exactly the issue. Most people have pretty boring lives, and don't need encryption. While many of us could make at least a business case that it would be a good thing to encrypt our mail, at the end of the day, expedient convenience wins out over The Right Thing.
Until strong encryption is seemlessly and effortlessly incorporated for a critical mass of users, it isn't going to happen.
This is where you n
Gmail and encryption (Score:2)
Thunderbird, OS X Mail, Lotus Notes, Exchange and Outlook all support S/MIME out of the box. If we could get webmail users using it, we might have a chance to get other people using it.
Webmail has problems (but should do it anyway) (Score:2)
The problem with webmail, is that encryption will never (can never) be trustworthy, since it needs to be implemented on the server, rather than on the user's trusted, known-uncompromised workstation. No one would ever really be able to rely on gmail's security.
On the other hand, there are some good reasons that they should do it, anyway.
First of all, we have to remember that a lot of users don't really have workstations that they know are safe. Sure Google (or s
Re: (Score:2)
Which kinda undermines your first point.
I suspect that the average webmail user's workstation is (as you suggest) a virus
Re: (Score:2)
You obviously haven't tried lately.
Both Enigmail for Thunderbird and also the mail client for OSX have pgp and key management built in. They have methods for downloading, signing and uploading keys to the key servers. I've been signing my email for years, very automatically. Also, the few individuals that have keys get their email encrypted automatically. It's v
GPG not integrated into Mail by default. (Score:2)
It has some S/MIME capabilities built in (and almost totally undocumented, as far as I can tell, and it's a bit of a bear to set up), but to get anything related to PGP, you need to install the excellent set of plugins from Sente, called GPGMail [sente.ch]. It is basically an interface between Apple Mail, and the CLI gpg tools.
It relies on some undocumented and unsupported APIs in
Re: (Score:2)
The only problem I've had is with the IMAP client not seeing new messages in various folders. I have to go upstairs to my workstation to get an accurate view of my new email.
Re: (Score:2)
You do send email, right? When people ask you about that funny little attachment to all your emails, explain PGP to them and help them generate their own key. As long as they understand that the public key must be securely verified, most people (even nontechnical people) do alright with the concept.
you've given up? too hard? (Score:2)
Indeed, it's just too much trouble, which show you and I both agree with the parent to your post. It's one thing being a highly competent email user and setting your own PGP up, but can we really be bothered setting up all our friends, work colleagues and family? I can't. And why don't they set up PGP? Because it's too much work and too difficult for the average user.
As one of the parent posts noted, the same people understand and happily use secure payment methods over the web. S
Not too hard, just too much apathy (Score:2)
I'd set it up for them, taking care of #2 -- I wouldn't mind setting up all my friends, work colleagues, and family -- bu
Re: (Score:1)
It needs to get into web browsers (Score:2)
If a popular web browser, such as Mozilla, were to implement both x509 certs and PGP certs for encrypted/authenticated connections (using GNU TLS or something like it), that would be a damn good start.
Speaking of PGP... (Score:3, Interesting)
If there's one thing that annoys me it's when a program disappears like that...
Re: (Score:2)
Re: (Score:3, Informative)
http://www.pgp.com/downloads/desktoptrial2.php [pgp.com]
It's fully functional for 30 days, then falls back to the functionality of the old PGP Freeware product, i.e. you can encrypt and decrypt files, windows, and the clipboard, and you can create, import, and manage keys.
Re: (Score:1)
GPG+Enigmail. (Score:2)
GPGShell (Score:2)
http://www.jumaros.de/rsoft/index.html [jumaros.de]
It requires GnuPG to be installed as well so it's effectively a two part installer, but it works fine and does most of what you ask (it's still not the easiest GUI when it comes to paths but better than WinPT).
HTH
Re: (Score:2)
And also, Gpg4Win [gpg4win.org] as no one else has mentioned. Very nice package...with a tray icon for encrypting/decrypting. Installs a shell extension for explorer too. Fantastic setup.
The title is wrong. Quit perpetuating the myth (Score:5, Informative)
There were two people who were hauled up in front of the Federal Grand Jury. Phil was one. Kelly Goen was the other. It was Kelly who paid Phil, who researched the law (so that the release could be done legally) and who had been pushing for developing public key cryptography for years before he ever met Phil. And it was Kelly who had the guts to do the actual release. Phil thought he was completely safe at the time (and legally speaking he probably was, not that innocence has ever stopped the Feds before).
If you want to search, you might be able to find the original Jim Warren articles in Microtimes around, who Kelly kept in touch with during the actual release. Jim thought Kelly was paranoid as hell until the FBI showed up on his door, and he wrote at least one article about it.
For your amusement, Kelly went around the San Francisco Bay area with an old acoustic coupler modem to various pay phones and would upload it onto a different server. Then he'd call Jim to tell him where it was at, in case something happened to him. He was under the impression that the single best thing the NSA could do was to knock him off before he put it on those servers. Looking back at it now, he was quite right.
And no, this isn't being posted by Kelly. Just someone else who was there at the time.
So please, get your facts straight and give Kelly some credit while he's still alive. Thanks.
For the history files (Score:4, Informative)
Re: (Score:2)
Here's a copy of Jim Warren's article [google.com], for anyone interested.
15 years (Score:2)
Re: (Score:1)
It's......... (Score:2)
Sosumi, Sir Paul! (Score:2)
PGP didnt Invent RSA encryption (Score:2, Interesting)
Re: (Score:1)
PGP popularized RSA encryption (Score:2)
RSA has(had) the patent on RSA public key encryption. PGP was just the first to popularize it, and make it easy for people to use it. And, in fact, not having the patent (on both RSA PK and also IDEA symmetric) is what caused PGP to later switch to ElGamal and 3DES, so that those are now part of the OpenPGP standard whereas RSA and IDEA are deprecated and fading into disuse, despite the fact that the RSA patent finally expired. (Yet Another Example of math patents doing the exact opposite of promoting th
Re: (Score:1)
Key to the problem (Score:1)
I've supported applications that use PGP for almost 9 years, and the number of times I must explain and re-explain how PGP keys work is just sad. In fact, there is one PGP administrator who methodically signs and distributes, every month, his company's latest public key *and* key pai
Because they're not. (Score:3, Insightful)
Public and private isn't too bad, it's just that no one ever, EVER bothers to learn them. I mean, come on, if people can learn words like "clutch", "gearshift", "ignition", and so on, why can't they understand that the PUBLIC key is what you send to everyone, and the PRIVATE key is what you don't even share with your lover?
Re: (Score:1)
Re: (Score:1)
Would that be because the "encoder" used for encryption is the "decoder" used for signing?
GnuPG 2 is released (Score:1)
The first step... (Score:2)
Inappropriate PGP usage: my sin. (Score:3, Funny)
So i relentlessly harangued a national organization to distribute a windows/DOS/Mac PGP release to all of their chapters.
I felt pretty good about it until i got a call from someone in another state:
"duuuude. i forgot my passphrase..."
How did you do that?
"we were rilly baked
i've always wondered how much damage i did to the marijuana movement by handing a bunch of stoners a tool that required memorizing a passphrase...
my bad!
Re: (Score:1)
I'm sure that "the man" appreciates your help.
LK
Re: (Score:2)
Ideas (Score:2)
I know there's problems with security legislation in the USA, and it's patented/restricted somehow. I would use gnupg for email if I had anyone to use it with. I only come across it in signed software.
Do you think signed/encrypted mail has a part to play in the new email? Email as we have it is WANK, with all the spam and shit. Something needs to be done. Perhaps a system could really on signing email with a unique key from a sender. Then there's an delocali
Re: (Score:1, Funny)
"Are you GAY?
Are you a NIGGER?
Are you a GAY NIGGER?
Are you a member of the GNAA?
If you answered "Yes" to all of the above questions, you should go find a cliff or a bridge somewhere, then take your entire fucktarded family. Have all of them jump off to their deaths, and after that jump to yours. Then there will be less fucktards in the gene pool."
Re: (Score:1)
Bitch, I have more hair now than I did 15 years ago.
LK