4 ms·

First off PGP is not a great security tool, second of all the EU can just stop the GPG encrypted messages at the service provider level. The ultimate solution

First off PGP is not a great security tool, second of all the EU can just stop the GPG encrypted messages at the service provider level. The ultimate solution against government stupidity like this is a full mesh based “internet” that is based on connections between homes without using an ISP. It is not going to happen for obvious reasons (90% of population is non-technical for starting).

turnerc 5y ago
> service provider level I think the parent comment was going to mail such drives, and good luck getting the EU to agree on blocking anything on their independent providers level.
- Tenoke 5y ago
  They've been pretty good at banning things at the provider level. Sites in the UK seemingly get banned by everyone as soon as the government requests it. Similar in Germany, and they go out of their way to analyze most or enough torrent data going through I believe all ISPs to detect what you pirate. Doing the same for detecting encryption doesn't seem farfetched.
  - turnerc 5y ago
    > Sites in the UK seemingly get banned by everyone as soon as the government requests it I live in the UK this is not correct, these are voluntary agreements by ISP's and you can opt out of the default filtering. I think the only time something has been blocked here it was due to a Court Order: https://www.virginmedia.com/help/list-of-court-orders https://www.virginmedia.com/help/list-of-court-orders
    - Tenoke 5y ago
      I mean that's still a fair amount of sites. I recognize and have used plenty of those.
prepend 5y ago
Great is subjective but GPG is pretty good and could be argued as great. It was based on “Pretty Good Protection.” EU can’t stop GPG encrypted messages at the service provider level because the content looks like any other base64 traffic or can easily be made like that.
- sbuk 5y ago
  Well, depends how it's sent. The header information in an encrypted message is unencrypted. Using an MUA, the body of the message will be sent as an inline attachment. The contend definition of the boundary for the attachment is Content-Type: application/pgp-encrypted, which is trivial to detect. A encrypted attachment that uses a generic application/binary or text/plain starts with -----BEGIN PGP MESSAGE----- or 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 47 50 20 4d 45 53 53 41 47 45 2d 2d 2d 2d 2d, which again is trivial to detect. Edit: I'm not suggesting PGP itself is bad because of this. There are many other reasons why you should consider other methods of sending messages securely that aren't email or PGP.
  - upofadown 5y ago
    Email on the wire is mostly all TLS encrypted these days. Generally offline encryption like PGP encrypted email is moe secure than, say, instant messaging: * https://articles.59.ca/doku.php?id=em:emailvsim https://articles.59.ca/doku.php?id=em:emailvsim
  - prepend 5y ago
    What I meant is it’s trivial to change the content type and to change the attachment format so it doesn’t match specific GPG formats. The content type is done now for convenience, but there’s nothing stopping me from using GPG to generate a message and send it with the content type of a text file or zip or whatnot. Of course there are other methods, but GPG is free, stable and works as expected.
matheusmoreira 5y ago
> The ultimate solution against government stupidity like this is a full mesh based “internet” that is based on connections between homes without using an ISP. Completely agree. Communications infrastructure has always been centralized. Service providers are easy targets for governments. We'll never be free from their tyranny until we have completely decentralized networks.

turnerc 5y ago

> service provider level I think the parent comment was going to mail such drives, and good luck getting the EU to agree on blocking anything on their independent providers level.

Tenoke 5y ago
They've been pretty good at banning things at the provider level. Sites in the UK seemingly get banned by everyone as soon as the government requests it. Similar in Germany, and they go out of their way to analyze most or enough torrent data going through I believe all ISPs to detect what you pirate. Doing the same for detecting encryption doesn't seem farfetched.
- turnerc 5y ago
  > Sites in the UK seemingly get banned by everyone as soon as the government requests it I live in the UK this is not correct, these are voluntary agreements by ISP's and you can opt out of the default filtering. I think the only time something has been blocked here it was due to a Court Order: https://www.virginmedia.com/help/list-of-court-orders https://www.virginmedia.com/help/list-of-court-orders
  - Tenoke 5y ago
    I mean that's still a fair amount of sites. I recognize and have used plenty of those.

prepend 5y ago

Great is subjective but GPG is pretty good and could be argued as great. It was based on “Pretty Good Protection.” EU can’t stop GPG encrypted messages at the service provider level because the content looks like any other base64 traffic or can easily be made like that.

sbuk 5y ago
Well, depends how it's sent. The header information in an encrypted message is unencrypted. Using an MUA, the body of the message will be sent as an inline attachment. The contend definition of the boundary for the attachment is Content-Type: application/pgp-encrypted, which is trivial to detect. A encrypted attachment that uses a generic application/binary or text/plain starts with -----BEGIN PGP MESSAGE----- or 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 47 50 20 4d 45 53 53 41 47 45 2d 2d 2d 2d 2d, which again is trivial to detect. Edit: I'm not suggesting PGP itself is bad because of this. There are many other reasons why you should consider other methods of sending messages securely that aren't email or PGP.
- upofadown 5y ago
  Email on the wire is mostly all TLS encrypted these days. Generally offline encryption like PGP encrypted email is moe secure than, say, instant messaging: * https://articles.59.ca/doku.php?id=em:emailvsim https://articles.59.ca/doku.php?id=em:emailvsim
- prepend 5y ago
  What I meant is it’s trivial to change the content type and to change the attachment format so it doesn’t match specific GPG formats. The content type is done now for convenience, but there’s nothing stopping me from using GPG to generate a message and send it with the content type of a text file or zip or whatnot. Of course there are other methods, but GPG is free, stable and works as expected.

matheusmoreira 5y ago

> The ultimate solution against government stupidity like this is a full mesh based “internet” that is based on connections between homes without using an ISP. Completely agree. Communications infrastructure has always been centralized. Service providers are easy targets for governments. We'll never be free from their tyranny until we have completely decentralized networks.