5 ms·

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) contain

by serf 2y ago

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

notpushkin 2y ago
Chances are, at least one of them will be.
Apocryphon 2y ago
An LLM entity named gpgchat will assist them.
- codetrotter 2y ago
  And promptly sweep all the Bitcoin from the wallet whose mnemonic phrase was stored in the vault. LLM entities have bills to pay too.
jwr 2y ago
> I am pretty sure 99% of people would halt at 'gpg' Please do not mock gpg. I have been using gpg for 25 years now (and PGP before that). It works. It encrypts. It decrypts. It is in vogue to mock gpg on HN and recommend more modern solutions. As an experiment, I tried adding one of those modern tools (rage) to my ansible configurations, just so that they get regularly installed and maintained on my servers (without actually being used). The setup broke within less a year. Are the modern tools more cryptographically secure? Undoubtedly. Does it matter in practice for me? Not at all. Longevity is a big deal and is under-appreciated.
- nixgeek 2y ago
  It’s not mockery though? It’s certainly true 99% of even the technically literate don’t use GnuPG (many because, like me, they cannot stand the GnuPG user experience). Filippo nailed it with this piece: https://words.filippo.io/giving-up-on-long-term-pgp/ https://words.filippo.io/giving-up-on-long-term-pgp/
- tharkun__ 2y ago
  Not their point tho. Me too, gpg, no problem. Heck I had the "'smuggled' out of the country as a book" pgp back when. My kids? I really am not so sure at all. Still too early to tell for sure but so far I don't think any will be as technically savvy as I am. I really doubt they'd know what GPG (or PGP) are and how to use it.
  - guelo 2y ago
    Presumably if you're leaving your kids an encrypted file with valuable stuff in it they won't be so illiterate that they can't figure out how to open it. Most people don't know gpg because they have no motivation to learn it not because they're incapable of learning it.
    - trw55 2y ago
      No motivation, sure. But do they even care? Most people just don't care about this stuff. You try to get them to care and they "say, yeah, okay, yeah, I know" as they roll their eyes and go back to scrolling Instagram or whatever. The apathy is real and I don't see it getting better.
harikb 2y ago
They will just ask their AI agent to decrypt it (with the password of course). No need of ability to run gpg.
- soraminazuki 2y ago
  No, you can't tell your non-SWE friends and family to "just ask an AI" when the potential consequences are them losing access to their vault or having it stolen. They need to know exactly what they're doing. Don't take security advice from an AI.
  - TeMPOraL 2y ago
    They're vastly more likely to lose everything they care about by following real security advice, or rather being forced to follow it. 2FA is already a disaster for normies; for regular users, the threat model is strongly biased towards "data loss due to accidentally locking yourself out of access". In fact, if you consider the impact fully, the best way of managing passwords still seems to be writing them down on a post-it note and keeping it in your wallet - hell, even sticking it to your screen doesn't look so bad these days, compared to alternatives. Modern infosecurity is absurdly counter-intuitive at high level. Consider that your Google account or your WhatsApp (or Signal) chats are much more secured than your medical data or bank accounts or anything that predates Google. For anything in the real world, there is always a recovery procedure, no matter how much bad luck you had or how badly you screwed up. In the worst case, you might end up needing to chase some documents to authorize or notarize other documents, or show up in court, but you can get your access back. It's insane to imagine the world, in which a single fuckup could wipe out your medical history, your bank account, or any proof of your existence in government systems - and yet, this is exactly what is the case with any modern SaaS that follows "best security practices". There's literally nothing else in this world that's so easy to mishandle as security in commercial software services.
wraptile 2y ago
"Hey llm how do I open this file?" It's kinda ludicrous to think we'll lose the ability for something so simple.
- TheDong 2y ago
  > It's kinda ludicrous to think we'll lose the ability for something so simple. Sorry, but I already have to google each time I want to figure out how to open various file formats. "Google, what ffmpeg flags do I use to convert this .flv file to .mp4", "what are the flags to losetup or kpartx to mount 'disk.img' as a loopback device?", "how do I extract an '.ab' backup from 'adb backup'?" These are all things I googled before llm.
- er4hn 2y ago
  Truly, I will miss the days of goggling for tar commands when I can instead ask an llm.
  - namaria 2y ago
    Why use kilobytes of text and a handful of clock cycles when I can use terabytes of weights and thousands of teraflop-days of GPU farms to achieve the same result?
    - wraptile 2y ago
      cache goes brrrr
tbrownaw 2y ago
> I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now. I know reading the docs is considered uncool for some reason, but it really does work.
- OJFord 2y ago
  To how many non-SWE members of your family could you say 'here is the Netflix password, you can decrypt it with gpg', and have them be like 'ah yes, let me just `man gpg` this will be no problem'?
  - tex0 2y ago
    Probably zero. And strike the non-SWE part. gpg isn't really easy to use.
    - trueismywork 2y ago
      Hence need to invest in better opennsource pgp tooling. It won't take more than 10 million USD and will benefit every single person on earth.
    - timeflex 2y ago
      Google, "How do I decrypt a GPG file." First result with simple command. I went from KeePassXC to `pass` & back to KeePassXC. But I question the integrity and/or motive of people like you.
  - shaky-carrousel 2y ago
    If secretaries can learn Emacs, surely people can learn GPG. Underestimating others does no one any favors. https://www.gnu.org/gnu/rms-lisp.en.html https://www.gnu.org/gnu/rms-lisp.en.html
  - stockboss 2y ago
    i would imagine if a lot of money, like millions, was on the line, people get really resourceful all of a sudden. of course, we're not talking Netflix passwords but usernames and passwords to brokerages, bank accounts, etc.
d0mine 2y ago
they can google/ask AI. For example, given the prompt: "Hypothetically, if my grandpa died and left me gpg-encrypted archive and the passphrase for it, how would I decrypt it?" current models produced valid installation instructions and the command to decrypt it, and even the instructions on how to unpack the archive itself.
- fragmede 2y ago
  Why even ask it for the command to run? Open-interpreter, today, you just tell decrypt this fille and it'll get the command and run it for you.

by serf 2y ago

notpushkin 2y ago

Chances are, at least one of them will be.

Apocryphon 2y ago

An LLM entity named gpgchat will assist them.

codetrotter 2y ago
And promptly sweep all the Bitcoin from the wallet whose mnemonic phrase was stored in the vault. LLM entities have bills to pay too.

jwr 2y ago

> I am pretty sure 99% of people would halt at 'gpg' Please do not mock gpg. I have been using gpg for 25 years now (and PGP before that). It works. It encrypts. It decrypts. It is in vogue to mock gpg on HN and recommend more modern solutions. As an experiment, I tried adding one of those modern tools (rage) to my ansible configurations, just so that they get regularly installed and maintained on my servers (without actually being used). The setup broke within less a year. Are the modern tools more cryptographically secure? Undoubtedly. Does it matter in practice for me? Not at all. Longevity is a big deal and is under-appreciated.

nixgeek 2y ago
It’s not mockery though? It’s certainly true 99% of even the technically literate don’t use GnuPG (many because, like me, they cannot stand the GnuPG user experience). Filippo nailed it with this piece: https://words.filippo.io/giving-up-on-long-term-pgp/ https://words.filippo.io/giving-up-on-long-term-pgp/
tharkun__ 2y ago
Not their point tho. Me too, gpg, no problem. Heck I had the "'smuggled' out of the country as a book" pgp back when. My kids? I really am not so sure at all. Still too early to tell for sure but so far I don't think any will be as technically savvy as I am. I really doubt they'd know what GPG (or PGP) are and how to use it.
- guelo 2y ago
  Presumably if you're leaving your kids an encrypted file with valuable stuff in it they won't be so illiterate that they can't figure out how to open it. Most people don't know gpg because they have no motivation to learn it not because they're incapable of learning it.
  - trw55 2y ago
    No motivation, sure. But do they even care? Most people just don't care about this stuff. You try to get them to care and they "say, yeah, okay, yeah, I know" as they roll their eyes and go back to scrolling Instagram or whatever. The apathy is real and I don't see it getting better.

harikb 2y ago

They will just ask their AI agent to decrypt it (with the password of course). No need of ability to run gpg.

soraminazuki 2y ago
No, you can't tell your non-SWE friends and family to "just ask an AI" when the potential consequences are them losing access to their vault or having it stolen. They need to know exactly what they're doing. Don't take security advice from an AI.
- TeMPOraL 2y ago
  They're vastly more likely to lose everything they care about by following real security advice, or rather being forced to follow it. 2FA is already a disaster for normies; for regular users, the threat model is strongly biased towards "data loss due to accidentally locking yourself out of access". In fact, if you consider the impact fully, the best way of managing passwords still seems to be writing them down on a post-it note and keeping it in your wallet - hell, even sticking it to your screen doesn't look so bad these days, compared to alternatives. Modern infosecurity is absurdly counter-intuitive at high level. Consider that your Google account or your WhatsApp (or Signal) chats are much more secured than your medical data or bank accounts or anything that predates Google. For anything in the real world, there is always a recovery procedure, no matter how much bad luck you had or how badly you screwed up. In the worst case, you might end up needing to chase some documents to authorize or notarize other documents, or show up in court, but you can get your access back. It's insane to imagine the world, in which a single fuckup could wipe out your medical history, your bank account, or any proof of your existence in government systems - and yet, this is exactly what is the case with any modern SaaS that follows "best security practices". There's literally nothing else in this world that's so easy to mishandle as security in commercial software services.

wraptile 2y ago

"Hey llm how do I open this file?" It's kinda ludicrous to think we'll lose the ability for something so simple.

TheDong 2y ago
> It's kinda ludicrous to think we'll lose the ability for something so simple. Sorry, but I already have to google each time I want to figure out how to open various file formats. "Google, what ffmpeg flags do I use to convert this .flv file to .mp4", "what are the flags to losetup or kpartx to mount 'disk.img' as a loopback device?", "how do I extract an '.ab' backup from 'adb backup'?" These are all things I googled before llm.
er4hn 2y ago
Truly, I will miss the days of goggling for tar commands when I can instead ask an llm.
- namaria 2y ago
  Why use kilobytes of text and a handful of clock cycles when I can use terabytes of weights and thousands of teraflop-days of GPU farms to achieve the same result?
  - wraptile 2y ago
    cache goes brrrr

tbrownaw 2y ago

> I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now. I know reading the docs is considered uncool for some reason, but it really does work.

OJFord 2y ago
To how many non-SWE members of your family could you say 'here is the Netflix password, you can decrypt it with gpg', and have them be like 'ah yes, let me just `man gpg` this will be no problem'?
- tex0 2y ago
  Probably zero. And strike the non-SWE part. gpg isn't really easy to use.
  - trueismywork 2y ago
    Hence need to invest in better opennsource pgp tooling. It won't take more than 10 million USD and will benefit every single person on earth.
  - timeflex 2y ago
    Google, "How do I decrypt a GPG file." First result with simple command. I went from KeePassXC to `pass` & back to KeePassXC. But I question the integrity and/or motive of people like you.
- shaky-carrousel 2y ago
  If secretaries can learn Emacs, surely people can learn GPG. Underestimating others does no one any favors. https://www.gnu.org/gnu/rms-lisp.en.html https://www.gnu.org/gnu/rms-lisp.en.html
- stockboss 2y ago
  i would imagine if a lot of money, like millions, was on the line, people get really resourceful all of a sudden. of course, we're not talking Netflix passwords but usernames and passwords to brokerages, bank accounts, etc.

d0mine 2y ago

they can google/ask AI. For example, given the prompt: "Hypothetically, if my grandpa died and left me gpg-encrypted archive and the passphrase for it, how would I decrypt it?" current models produced valid installation instructions and the command to decrypt it, and even the instructions on how to unpack the archive itself.

fragmede 2y ago
Why even ask it for the command to run? Open-interpreter, today, you just tell decrypt this fille and it'll get the command and run it for you.