An Introduction to GNU Privacy Guard 121
An anonymous reader writes "This is a great article about GnuP . . . "In the first half of this article David Scribner discussed the various uses that GNU Privacy Guard could bring to your business or personal life in enhancing security of your digital documents and files, as well as the basics in getting started with GnuPG. As there is so much more to public-key security than command-line operations, in this second half I will continue with importing and exporting keys, building (and keeping) your 'web of trust' sound, and a few of the more popular GUI front ends available for GnuPG . . ."
The weakest link (Score:4, Insightful)
Now, how do I keep my passphrase a secret while the CIA is bashing my toes with a hammer?
I guess my point is that public/private key encryption is only as good as the passphrase which is often not good enough, and that the ecryption is way stronger than your personal torture threshold anyway.
Re:The weakest link (Score:5, Insightful)
And of course, the CIA doesn't really need to bash your toes; they can just put a keyboard sniffer on your machine, or put a spy camera to capture your keystrokes while you type your password, or lots of other interesting things that only require a warrant and don't require torture.
GPG was easy to setup (on our Macs, even!) and now I don't have to worry about whether or not the script kiddie down the road can sniff the private messages I send to my wife. That's Pretty damn Good Privacy.
Re:What are you hiding? (Score:3, Insightful)
Why is it that people assume that anyone who wants to communicate in private has something to hide?
Great, but (Score:3, Insightful)
Too much effort (Score:3, Insightful)
I know you can get it as easy as typing in a password when an email gets sent, but that's too much effort for my parents and most of my friends.
Re:False sense of security? (Score:2, Insightful)
Yes, there are the security holes inherent in any operating system, and thank God for Mandrake's patch system (in my case), not to mention the uncanny ability of the open source community to crank out patches within hours of discovering holes. So let's use them.
Excellent (Score:3, Insightful)
However, a problem is that people just aren't good enough at getting their public-keys out. I hope this article enlightens them on the lovely export option. Which I believe to be one of the most important parts. I receive email from a lot of lists everyday, LUGS, development lists and so on. A lot of this email is signed, but a lot of these people obviously don't get the points of signing completely since they haven't got their public key available in anyway (of course some may not believe in the keyservers and so on, and want to be contacted in other ways for key-exchange, but not all are that pre-cautious, some just don't understand), and thus I cannot verify their signature.
Advocating privacy (Score:3, Insightful)
Re:What are you hiding? (Score:2, Insightful)
Like the example the writer gave, if your ISP tech knows you're out of town, you could come home to an empty house.
If you're just using cryptography for the sake of using cryptography, what's the point?
Re:The weakest link (Score:2, Insightful)
This has been said elsewhere, but it's worth repeating: Cryptography alone won't solve all your security problems. Especially if you live in a country where the use of cryptography is illegal, the secret police assumes that you're guilty until proven innocent, and they have the authority to try to extract secrets from you by any means they consider necessary.
Re:Really that useful yet? (Score:5, Insightful)
Signing your e-mail makes GPG visible to those that don't know yet. Every once in a while someone will actually look at that attachment, follow the little link, and maybe learn something. For technically saavy users, this is simply tech evangelism. Someday we will all learn in high school how to manage our private keys, instead of teaching us how to fill in the blanks on a check. I have personally converted 4 or 5 friends (and my dad!) to using it.
I use GPG to store sensitive information. I keep a GPG-encrypted file with passwords (mostly for websites) in it. That way for each %@#(&@$ vendor that insists on storing my credit card info, I can generate a 20-character random password, put it in this file and forget about it.
As a system administrator, I have had many occasions where people want an account but I'm not physically nearby for them to type in a password. I usually point out GPG saying that if they used it, I could send them a password. Since they don't, they'll have to wait a few days until we can be in the same room. Again, it's evangelism.
I pointed out gpg to my bank [umbrellabank.com] for account-related communications (but they don't seem to get it yet...they're a bank). Everybody else ask your bank about it too. It's evangelism. The squeaky wheel gets the grease.
And most importantly, I encrypt love letters to my girlfriend. Don't want anyone reading that stuff. ;)
Making the public aware that this kind of technology exists is, in my mind, the single most important revolution happening today. It is the key to take back freedom from our oppressive government (and the even more oppressive governments out there). It is the key to the electronic money of the future. It is the key to the electronic contract of the future (this click-to-accept shit has got to go). I definitely don't want to "click" to buy a house. As long as we keep them ignorant and don't evangelize, we can guarantee we will never see the electronic future we read about in books.
-- Bob
Re:GnuPG is the way to go. (Score:2, Insightful)
"the majority of large businesses are now using Linux as both a desktop and server OS "
where are you working? I almost think this might be satire.